Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2024 13:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe
-
Size
53KB
-
MD5
181f176a3977c2bddf27bb334e33b789
-
SHA1
733080a58442d2c9fc8477058808e2a5856351fd
-
SHA256
2f2932e0116bbff9d831b178a67208584fb42522075464fcdb4afd417e323909
-
SHA512
5b09fc0233551a7173828f929b8a740a7769e1794912466f235b7e824d94c2ccf2d11de689075bfd58760897f01fbbbb7ab38b0941f9bcaf084633ccb07bf294
-
SSDEEP
768:VTHOvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5vIb:qeytM3alnawrRIwxVSHMweio3ZIb
Malware Config
Extracted
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\how_to_back_files.html
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (6079) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe" 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Program Files directory 64 IoCs
Processes:
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\ui-strings.js 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-30.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-200.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\LargeTile.scale-125_contrast-white.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.scale-200.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\how_to_back_files.html 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache.scale-200.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\WideTile.scale-100_contrast-white.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-400.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\198.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\MedTile.scale-200.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-100.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-125.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7734_20x20x32.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\DialSticker.mp4 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ru-RU\View3d\3DViewerProductDescription-universal.xml 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\ui-strings.js 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\HoloAssets\HoloLens_HandTracking.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.e511c6fe.pri 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-64_altform-unplated.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-125.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Fonts\PaintA.ttf 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\ui-strings.js 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-32_altform-unplated.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SwipeTeachingCalloutArchiveImage.layoutdir-RTL.gif 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses.svg 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-colorize.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\HostConfigDarkMode.json 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_contrast-black.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-125.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\S_ThumbUpOutline_22_N1.svg 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Microsoft.Apps.People.BackgroundTasks.winmd 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFRE_Welcome.mp4 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-100_contrast-black.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-unplated.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-400.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileLargeSquare.scale-200.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\ui-strings.js 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\how_to_back_files.html 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-100.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-36.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedAppList.scale-200_contrast-white.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adc_logo.png 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exedescription pid process target process PID 5108 wrote to memory of 3404 5108 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe cmd.exe PID 5108 wrote to memory of 3404 5108 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe cmd.exe PID 5108 wrote to memory of 3404 5108 2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2024-10-28_181f176a3977c2bddf27bb334e33b789_globeimposter.exe > nul2⤵
- System Location Discovery: System Language Discovery
PID:3404
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD514952025ad8949ad6a75c1397368518b
SHA139e1bc6f2b11571dd3ea39440b588815ae1c8cd0
SHA25684cd09395608eba5504fdf8cda377e8c954d2554af86db4f4ee6ea6e70b204ff
SHA5123d6739398f3fb57d606c8a9bb5ae461179af306097a1c1a601017b3fd556a8bb8a0555d958617f5b6c62ff7951dbb33c1c3d642d9b4ea360d9e2277491f2e243