Overview

overview

10

Static

static

3

22abc470d7...8a.exe

windows7-x64

10

22abc470d7...8a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    02-08-2024 19:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe

  • Size

    220KB

  • MD5

    0f79c1cda4b2f9230203cf1def2a9d02

  • SHA1

    609d9c995e7d1f657d56e12c388234d76bffcb83

  • SHA256

    22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a

  • SHA512

    631381caeb6598ac284f0bacba3d840496a571db1573c4550ece8a2414a3c76291e0aa160b7ce38a31ce22eb34a8ccbd12b44c46f7bf10bb7e3221f77a747d3c

  • SSDEEP

    3072:RguO56UGXss77V+Vau63bPuezMXBNLhy1njptnwk84Xpc5I:FUGFWauaIB5hyNjUkC5I

Score
10/10
globeimposterdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (8656) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Clears Network RDP Connection History and Configurations 1 TTPs 2 IoCs

    Remove evidence of malicious network connections to clean up operations traces.

    defense_evasion
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
    "C:\Users\Admin\AppData\Local\Temp\22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\tmpB9BE.tmp.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2312
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2268
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
        3⤵
        • Clears Network RDP Connection History and Configurations
        • System Location Discovery: System Language Discovery
        PID:1780
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
        3⤵
        • Clears Network RDP Connection History and Configurations
        • System Location Discovery: System Language Discovery
        PID:1288
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1072
      • C:\Windows\SysWOW64\attrib.exe
        attrib Default.rdp -s -h
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:1588
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2408
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Direct Volume Access

1
T1006

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

4
T1070

Clear Network Connection History and Configurations

1
T1070.007

File Deletion

3
T1070.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini
    Filesize

    1KB

    MD5

    a1582afa9c98165a49a19223e79c09b1

    SHA1

    34659b60a728c5a0c0daeb7548ef15fc9c317e6f

    SHA256

    46eb74f44c6c07cf5a7f396e07410fc7c373c9741cc464bcb93a8f68802668dc

    SHA512

    b8385b6f71cf738ff0a77dc8885f500df0aeba75f9df2e2a08776e50af705b6255724f7508e68766527b67dec08979e2ce92d6dd77068bb5070305ddf785fd37

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpB9BE.tmp.bat
    Filesize

    445B

    MD5

    32d8f7a3d0c796cee45f64b63c1cca38

    SHA1

    d58466430a2bba8641bd92c880557379e25b140c

    SHA256

    1a6f73b5c28d1c10f63f2056068c1de61487b8cf8f1dcf7516548df144b3e9ea

    SHA512

    288213b92a03ac750ea319bb23c52e7bdf47f5a47ecb70c905c7610a84c63a3ec0a30801b5880e6def8df2c9f577082072e342198d23a19f64e561923e1ef698

    Download Submit

  • C:\Users\Public\Videos\Read___ME.html
    Filesize

    4KB

    MD5

    3120c601fe5d916e095039d6f798f7f4

    SHA1

    143290aed9354508101891a5dd189c23fb190925

    SHA256

    1908b055202464df4d93ee55724e0a553056cd7361e3e14132f3b17b7d283a11

    SHA512

    42253240a51e1b6dd7008956130069543ef84395f035d907ba963ccee8c02d6e3a96bb557e9b3933df1a72d3853fb465e765196ecdabe79fceaa72bba4de3dfd

    Download Submit

  • memory/3008-2-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/3008-1-0x00000000006B0000-0x00000000007B0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3008-1468-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/3008-2306-0x00000000006B0000-0x00000000007B0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3008-3061-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download