Analysis
-
max time kernel
101s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2024 13:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe
-
Size
53KB
-
MD5
181f176a3977c2bddf27bb334e33b789
-
SHA1
733080a58442d2c9fc8477058808e2a5856351fd
-
SHA256
2f2932e0116bbff9d831b178a67208584fb42522075464fcdb4afd417e323909
-
SHA512
5b09fc0233551a7173828f929b8a740a7769e1794912466f235b7e824d94c2ccf2d11de689075bfd58760897f01fbbbb7ab38b0941f9bcaf084633ccb07bf294
-
SSDEEP
768:VTHOvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5vIb:qeytM3alnawrRIwxVSHMweio3ZIb
Malware Config
Extracted
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\how_to_back_files.html
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (6081) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe" 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Program Files directory 64 IoCs
Processes:
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\SmallTile.scale-125.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-256.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\Url.ot 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\plugin.js 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left-pressed.gif 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-150.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_bg.json 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch-Dark.scale-200.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-400.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\how_to_back_files.html 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\ui-strings.js 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\acrobat_pdf.svg 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-200.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\how_to_back_files.html 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_File_Transfer_Complete.m4a 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\how_to_back_files.html 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-60_altform-lightunplated.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-36_altform-unplated.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-400.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_contrast-black.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\MedTile.scale-125.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\ui-strings.js 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\winamp2.xml 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\LargeTile.scale-100_contrast-black.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\how_to_back_files.html 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_shared_multi_filetype.svg 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\ui-strings.js 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-125.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\java.policy 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\how_to_back_files.html 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Viewer.aapp 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\StandardShader.vs.cso 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_SplashScreen.scale-100.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\how_to_back_files.html 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-100.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-white_scale-125.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\ui-strings.js 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exedescription pid process target process PID 2108 wrote to memory of 3776 2108 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe cmd.exe PID 2108 wrote to memory of 3776 2108 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe cmd.exe PID 2108 wrote to memory of 3776 2108 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe > nul2⤵
- System Location Discovery: System Language Discovery
PID:3776
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5dcf444e048bd798ab3a9098daa35a3f4
SHA1bfc56d4ed5642c882416fec93c50b4589025cf87
SHA256cb30a658202342117924d0d3aa7b4d84d2f3787ed1fa336dba05e577525ee46e
SHA512cfa3c2eb683e437a652e402d8d6374362b26ba4816caae1c3d26c49b3605997ca5269bfe8ce548053078060f194492636ed8fb05c5dba6ab068f098e7c018a53