Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 11:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
202409275709e6e2c04703a779bef68714cd5305globeimposter.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
202409275709e6e2c04703a779bef68714cd5305globeimposter.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
202409275709e6e2c04703a779bef68714cd5305globeimposter.exe
-
Size
53KB
-
MD5
5709e6e2c04703a779bef68714cd5305
-
SHA1
cb6999e0d01f205fb58f21acd625d11dd986f8cd
-
SHA256
32bf1d17adf782b65621c1ec19414dbdd65c94996ab6a133c69a259ec327b7c4
-
SHA512
72a8892aae280cae6a509af96c146e62c53258e505d47a0b6e34620a334478a381b01bdf3704e83e1746fe4b176fc017ec694e5bc0c91587b4fd9f8d3b05321c
-
SSDEEP
1536:3oQeytM3alnawrRIwxVSHMweio3m3EvI:4Qey23alnaEIN/Wm3G
Score
10/10
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Renames multiple (6467) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\202409275709e6e2c04703a779bef68714cd5305globeimposter.exe" 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe -
Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Public\Desktop\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Music\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Links\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Music\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Documents\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Videos\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNOteFilter.dll 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\PUSH.WAV 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE_F_COL.HXK 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR45B.GIF 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveResume.dotx 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\tab_on.gif 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ERROR.GIF 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIconsMask.bmp 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\TAB_ON.GIF 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REMOTES.ICO 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\HowToBackFiles.html 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCINFO.XML 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_on.gif 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGNL.ICO 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGNS.ICO 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRINTL32.DLL.IDX_DLL 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessData.xml 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CONTACTINFOBB.POC 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Currency Rates.iqy 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SENDTO.DLL 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\ARROW.WAV 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_ON.GIF 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hiring Requisition - Customized.fdt 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DBGHELP.DLL 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB2B.BDR 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_COL.HXT 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OMSINTL.DLL.IDX_DLL 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR46F.GIF 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\WidescreenPresentation.potx 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.dll 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL010.XML 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\OliveGreen.css 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageSlice.gif 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\validation.js 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PINELUMB.HTM 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl.css 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImagesMask256Colors.bmp 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveMergeLetter.dotx 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Status Report.fdt 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATALOG.XML 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\THOCR.PSP 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBPQT.DPV 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.AR.XML 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SEARCH.GIF 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.CSS 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIcon.jpg 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL093.XML 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\INFOMS.ICO 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Author2XML.XSL 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB_K_COL.HXK 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR48F.GIF 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginMergeLetter.Dotx 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\TAB_OFF.GIF 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\EmptyDatabase.zip 202409275709e6e2c04703a779bef68714cd5305globeimposter.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD577160ed4aba126dec77672ef9f063ba8
SHA105bf8d0cad372a76ba59b0d730e38594e0a5ba1f
SHA256b8aa5cf75d073b3c28e1c1ff5aabbb20afcd1f36392b89df37bd4d205c4abe89
SHA512fb1fcb780df1257b7890ab71a2e93b5e92da718b3748697903043215b319fc9c2d4aea826f2c558285716e62198cb4ecd35a5d7b6b9a92ae64e55228f5db20d5