Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/08/2024, 23:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe
-
Size
53KB
-
MD5
d6d78dd3190e9b80975ed8e281bd4d60
-
SHA1
96934ee9d9d8fe3b531331fe1fc578e66591304b
-
SHA256
204999f72452d3245497aca2e878dde751eff81cf11ceb7d8d17cc6cf8dc03d4
-
SHA512
c4e6b3846b3724f7728c971421bfe336b69737289126dcdcb255b0515eb56ec2735f3e47bb8e19743e0681552d6c3002ff266c683079c73c0aa54598e004177b
-
SSDEEP
768:3Ovuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5ZoiJ:3keytM3alnawrRIwxVSHMweio3To
Malware Config
Extracted
C:\Users\Public\Videos\How_to_back_files.html
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Renames multiple (6131) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe" 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe -
Drops desktop.ini file(s) 30 IoCs
description ioc Process File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Public\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\SY______.PFM 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteWideTile.scale-125.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-32_altform-lightunplated.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_contrast-black.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-300.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_contrast-white.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\How_to_back_files.html 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\SmallTile.scale-100.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-150_contrast-black.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_altform-unplated_contrast-white.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\ui-strings.js 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyStateDCFiles_280x192.svg 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\nub.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\review_poster.jpg 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\ui-strings.js 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_18.svg 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square44x44Logo.scale-125.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EMLAttachmentIcon.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-150.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\zy______.pfm 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_altform-unplated_contrast-black.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\vi-VN\View3d\3DViewerProductDescription-universal.xml 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36_altform-unplated.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\WideTile.scale-125.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\ui-strings.js 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-125.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.ViewElements.winmd 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\ui-strings.js 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_altform-unplated_contrast-black.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-100.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-256.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SimpleProgressBarTheme.xbf 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\How_to_back_files.html 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-150.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageLargeTile.scale-100.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-125_contrast-white.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\README.txt 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\How_to_back_files.html 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_altform-lightunplated.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\share_icons.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\How_to_back_files.html 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-unplated_contrast-white.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_cancel_18.svg 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-125_contrast-white.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W7.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\PartyChat.winmd 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsWideTile.scale-200.png 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\lpcstrings.json 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\How_to_back_files.html 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2648 wrote to memory of 1068 2648 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe 100 PID 2648 wrote to memory of 1068 2648 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe 100 PID 2648 wrote to memory of 1068 2648 2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe > nul2⤵
- System Location Discovery: System Language Discovery
PID:1068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a1010dcf4fc79736f3afc30a1ddc645e
SHA14702f4030cc23267ab21c09aee2d0239294041c7
SHA256b2bcc8cb800994ed5a9a6c14e414879209d052b7b48b05ed29ba7be02e57513b
SHA512777976a2733a848b518e739cd5a577d5e1cc76abf22e9c99c00f332c4ce655f36d0d0c0507a3f85d65114eba47df960133cad0356ac51821f3f280d65349d904
-
Filesize
4KB
MD5b13650a57d8c11e15a8fc0552c85f62c
SHA1cd6ea1d21d5c795e19cea5f8275ee79912970ced
SHA2562dba200bf5ab5e9022fc145760d0f21eb8d4f51645375ae5de03819f14b4ccf4
SHA512a929ce9bd0280c100287b8302bddb51eaeabb62f51e973f4d1afe610adb3400fbee383e2e2fa9be2ec4247740d214f80b463966d2382ba0e91db3a461d54d5c0