Overview

overview

10

Static

static

3

2025-01-22...er.exe

windows7-x64

10

2025-01-22...er.exe

windows10-2004-x64

10

Resubmissions

22/01/2025, 17:27

250122-v1trtsxjbz 10

22/01/2025, 15:28

250122-swt6paspet 10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2025, 15:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-22_1748fc9c3457f6102469044a18a67095_globeimposter.exe

  • Size

    55KB

  • MD5

    1748fc9c3457f6102469044a18a67095

  • SHA1

    ff7a2abf8f53c2cac4d2d7d8c70b1784362414bb

  • SHA256

    aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc

  • SHA512

    3b2baccde64139657ba2cfcb17398078956b8302f32347ff344861ade61f26496e61a8f913df02ce56d7628ee58381b695fd58f92500cd0f9d0c00a9bd6d3463

  • SSDEEP

    1536:3ibgutzZi79QlgTHf4tq6KhxXwr3+mG3Kk:3itz479QlOWWXKNGak

Score
10/10
globeimposterdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #303030; } .letter { color: #DC143C; font-weight: 600 } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>35 4E CE DA 72 EA 1E DA A8 08 95 77 A5 4F 6F 2A DB 2C B2 CE 30 0A 87 77 D6 1A 2D 60 E4 A6 10 74 6E 91 06 2C 29 5B 83 4D 50 53 AC 0E 87 58 39 7D 17 B4 42 3B A4 C6 67 2D 8A 0C 93 53 EA B5 27 AA 90 61 81 B6 0A BA 42 A5 A5 B2 D5 AA 55 96 A1 95 84 8A 35 0A 75 86 F5 21 05 FC 1E 17 3F 81 0A 3D 68 31 D3 BD 0A 80 8A 23 C4 EF 26 C4 9F 56 7A 96 72 43 AA 6C 80 73 63 72 18 7B E6 F7 18 55 73 7B 03 9B D3 B9 91 BC A7 11 F1 47 10 0B 4F 4C 55 74 F7 DD E1 0C D7 D1 E3 A0 AB 53 7B D0 05 96 12 C8 E0 2F F8 77 B4 26 F1 D5 E5 6D 7A DA 1E EE 46 97 5A DF 01 57 D1 6C A6 B7 46 5D DC 8E 60 C8 D0 4C 4C 4F 80 BB 89 A2 5B DB 0D 8A 46 63 53 14 33 B5 79 9C 5A 13 82 49 F1 04 39 24 07 68 DA 25 7B 07 47 2E E0 2D 92 57 D9 06 8F 68 0F FA 63 35 FF 78 F3 4E 38 58 96 F2 81 CF 45 82 56 6C 18 54 D1 65 </p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9763; Your files are encrypted! &#9763;</h1> <hr/> <h3> To decrypt, follow the instructions below. </h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span></br> (Or alternate mail <span class="letter"> [email protected]</span>)<p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> You can not decrypt your files cheaper than we offer you. You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE. No one, except [email protected], will decrypt your files with a guarantee 100%. </p></center> <hr color=red> <ul> <li>Only [email protected] can with a guarantee decrypt your files </li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (8673) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Clears Network RDP Connection History and Configurations 1 TTPs 2 IoCs

    Remove evidence of malicious network connections to clean up operations traces.

    defense_evasion
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-22_1748fc9c3457f6102469044a18a67095_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-22_1748fc9c3457f6102469044a18a67095_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\tmp7465.tmp.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2216
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
        3⤵
        • Clears Network RDP Connection History and Configurations
        • System Location Discovery: System Language Discovery
        PID:2848
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
        3⤵
        • Clears Network RDP Connection History and Configurations
        • System Location Discovery: System Language Discovery
        PID:2864
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2560
      • C:\Windows\SysWOW64\attrib.exe
        attrib Default.rdp -s -h
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2700
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-01-22_1748fc9c3457f6102469044a18a67095_globeimposter.exe > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2176
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Direct Volume Access

1
T1006

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

4
T1070

Clear Network Connection History and Configurations

1
T1070.007

File Deletion

3
T1070.004

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini
    Filesize

    1KB

    MD5

    f481e5780709ef3b4eec6a562fc8cedd

    SHA1

    6c96602549253a5c91bced29a6f24dbad33e1f76

    SHA256

    77989d9b22dd38498d6dac092b120acd5f899ce75e1bb173ae66769ca5b518c9

    SHA512

    12c49c0b0358a50db7ba647e5d7855f61645daaeed3c7f5881c924babe9b25eb77a0469fc728fa1d522ba96c57178e433826f70daf9fce221f3b418005a36d75

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp7465.tmp.bat
    Filesize

    445B

    MD5

    32d8f7a3d0c796cee45f64b63c1cca38

    SHA1

    d58466430a2bba8641bd92c880557379e25b140c

    SHA256

    1a6f73b5c28d1c10f63f2056068c1de61487b8cf8f1dcf7516548df144b3e9ea

    SHA512

    288213b92a03ac750ea319bb23c52e7bdf47f5a47ecb70c905c7610a84c63a3ec0a30801b5880e6def8df2c9f577082072e342198d23a19f64e561923e1ef698

    Download Submit

  • C:\Users\Public\Videos\how_to_back_files.html
    Filesize

    5KB

    MD5

    d5f02b568edc8fde9b5bfc53f2161b73

    SHA1

    b08331d50a5763d343cd9e3c0b2a60e1a904672c

    SHA256

    7f0f075de74d2f593035935c4ac75f3d03992ee5f57f1dbc0c8a5e8d76aab6b6

    SHA512

    e7b77bc74685431ca1749eb45fa47abf42f1abd299d85c6777cb6e3b19dcac0c62a98860cbbf9e39df23b43ee9349381a0d15c42a70aba11266ac2ccd1f1863c

    Download Submit