File name:

2017-11-30-GlobeImposter-KMNVnNNppv.exe

Full analysis: https://app.any.run/tasks/a8724d30-0541-4676-a79e-e88d37d12e34
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: August 11, 2025, 02:11:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
globeimposter
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

23977AE9C0149E4E1C052999621EC565

SHA1:

96B44062DF5D31D1668D62C2879CE42AB0FA9FDD

SHA256:

A0E749B9D7015D13733A3B79904D0A80D645D07FE6B896EFB8D2ED4420AACCA2

SSDEEP:

3072:WX2mHLDSayVQcv/MM01uJkTVL9QRUlleIB2GiXlBY9Rc6DVL:Wo/VvcZ1QYL9QRUllbdqlWW65L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)

    • GlobeImposter ransom note is found

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)

    • Renames files like ransomware

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)

    • RANSOMWARE has been detected

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 2228)

    • Application launched itself

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 2228)
      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 2384)

    • Executable content was dropped or overwritten

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)

    • Creates file in the systems drive root

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)

    • Reads the date of Windows installation

      • SearchApp.exe (PID: 512)

  • INFO

    • Checks supported languages

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 2384)
      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 2228)
      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)
      • SearchApp.exe (PID: 512)

    • Process checks computer location settings

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 2228)
      • SearchApp.exe (PID: 512)

    • Reads the computer name

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 2228)
      • SearchApp.exe (PID: 512)

    • Launching a file from a Registry key

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)

    • Reads the machine GUID from the registry

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)
      • SearchApp.exe (PID: 512)

    • Creates files or folders in the user directory

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)

    • Checks proxy server information

      • slui.exe (PID: 6856)
      • SearchApp.exe (PID: 512)

    • Reads the software policy settings

      • slui.exe (PID: 6856)
      • SearchApp.exe (PID: 512)

    • Creates files in the program directory

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)

    • Create files in a temporary directory

      • 2017-11-30-GlobeImposter-KMNVnNNppv.exe (PID: 5432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:11:30 08:48:22+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 49152
InitializedDataSize: 4096
UninitializedDataSize: 81920
EntryPoint: 0x1fe50
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2017-11-30-globeimposter-kmnvnnnppv.exe no specs 2017-11-30-globeimposter-kmnvnnnppv.exe no specs 2017-11-30-globeimposter-kmnvnnnppv.exe no specs #GLOBEIMPOSTER 2017-11-30-globeimposter-kmnvnnnppv.exe slui.exe searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
512"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ntmarta.dll
2228"C:\Users\admin\AppData\Local\Temp\2017-11-30-GlobeImposter-KMNVnNNppv.exe" C:\Users\admin\AppData\Local\Temp\2017-11-30-GlobeImposter-KMNVnNNppv.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2017-11-30-globeimposter-kmnvnnnppv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2384"C:\Users\admin\AppData\Local\Temp\2017-11-30-GlobeImposter-KMNVnNNppv.exe" -lC:\Users\admin\AppData\Local\Temp\2017-11-30-GlobeImposter-KMNVnNNppv.exe—2017-11-30-GlobeImposter-KMNVnNNppv.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2017-11-30-globeimposter-kmnvnnnppv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5432C:\Users\admin\AppData\Local\Temp\2017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\admin\AppData\Local\Temp\2017-11-30-GlobeImposter-KMNVnNNppv.exe
2017-11-30-GlobeImposter-KMNVnNNppv.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\2017-11-30-globeimposter-kmnvnnnppv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6856C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6876C:\Users\admin\AppData\Local\Temp\2017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\admin\AppData\Local\Temp\2017-11-30-GlobeImposter-KMNVnNNppv.exe—2017-11-30-GlobeImposter-KMNVnNNppv.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\2017-11-30-globeimposter-kmnvnnnppv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
48 034
Read events
47 966
Write events
67
Delete events
1

Modification events

(PID) Process:(5432) 2017-11-30-GlobeImposter-KMNVnNNppv.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:BrowserUpdateCheck
Value:
C:\Users\admin\AppData\Roaming\2017-11-30-GlobeImposter-KMNVnNNppv.exe
(PID) Process:(512) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(512) SearchApp.exeKey:\REGISTRY\A\{a0bb9590-2966-ac04-8ce2-ec065c004d6b}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
0000BF8D78AD650ADC01
(PID) Process:(512) SearchApp.exeKey:\REGISTRY\A\{a0bb9590-2966-ac04-8ce2-ec065c004d6b}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
0000BF8D78AD650ADC01
(PID) Process:(512) SearchApp.exeKey:\REGISTRY\A\{a0bb9590-2966-ac04-8ce2-ec065c004d6b}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPE
Value:
0000BF8D78AD650ADC01
(PID) Process:(512) SearchApp.exeKey:\REGISTRY\A\{a0bb9590-2966-ac04-8ce2-ec065c004d6b}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPE
Value:
4E006F006E0065000000BF8D78AD650ADC01
(PID) Process:(512) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\A1hdl50UVDh2ZbG324Nx-6fZgntcGnHOs5kHLdmaJYE\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Recognizers
Operation:writeName:DefaultTokenId
Value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN
(PID) Process:(512) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsMSACloudSearchEnabled
Value:
0
(PID) Process:(512) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsAADCloudSearchEnabled
Value:
0
(PID) Process:(512) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search
Operation:writeName:CortanaStateLastRun
Value:
0952996800000000
Executable files
21
Suspicious files
4 359
Text files
420
Unknown types
0

Dropped files

PID
Process
Filename
Type
54322017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\admin\AppData\Roaming\2017-11-30-GlobeImposter-KMNVnNNppv.exeexecutable
MD5:23977AE9C0149E4E1C052999621EC565
SHA256:A0E749B9D7015D13733A3B79904D0A80D645D07FE6B896EFB8D2ED4420AACCA2
54322017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\admin\AppData\Local\VirtualStore\Read___ME.htmlhtml
MD5:6AD198F087267C573DAAF91E8AA611BF
SHA256:FBE30974E577B27384861F3485E3A0962BFF319B61F03617ACCA4D3EEEFB3A18
54322017-11-30-GlobeImposter-KMNVnNNppv.exeC:\BOOTNXT..docbinary
MD5:B0E05B15E68AE60EB4D15128267AEA80
SHA256:CA704D3DDDD8243AD0046F8040CE71C9E5D483D7399898A8527E34D9B6918E6D
54322017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\Public\Pictures\Read___ME.htmlhtml
MD5:6AD198F087267C573DAAF91E8AA611BF
SHA256:FBE30974E577B27384861F3485E3A0962BFF319B61F03617ACCA4D3EEEFB3A18
54322017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\Public\Videos\desktop.ini..docbinary
MD5:B153C21CDB565199D3D396AAB7854CBA
SHA256:3DDF381B4672F8F0042EBAC8864FD083D7F90B1DDB81095BF2531600CFDC906A
54322017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\Public\Videos\Read___ME.htmlhtml
MD5:6AD198F087267C573DAAF91E8AA611BF
SHA256:FBE30974E577B27384861F3485E3A0962BFF319B61F03617ACCA4D3EEEFB3A18
54322017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\Public\Pictures\desktop.ini..docbinary
MD5:C39BFF279322449F3DD6E0B9ADFA26FE
SHA256:C7B2652AD335D4623F6816A7465767F2D60D73DE81ED6E393C9CCE9BD4BEE084
54322017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\Public\desktop.ini..docbinary
MD5:267B43B3DEC3E23E352EC6174A4B866E
SHA256:B789A2F95C1F77F0996E9DD6250C4448F6AA46CA82C957D5742D848152A51E77
54322017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\Public\Music\desktop.ini..docbinary
MD5:4DB66A1FD724CE901D2A16336C9EC4FF
SHA256:39DF192F8B98005AFCC1DBFA164BB49C9067AC64EEB245FEC951E05A32306696
54322017-11-30-GlobeImposter-KMNVnNNppv.exeC:\Users\Public\Music\desktop.inibinary
MD5:4DB66A1FD724CE901D2A16336C9EC4FF
SHA256:39DF192F8B98005AFCC1DBFA164BB49C9067AC64EEB245FEC951E05A32306696
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
31
DNS requests
24
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3540
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
512
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6668
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2076
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6668
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4688
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3540
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.3
  • 20.190.159.129
  • 40.126.31.69
  • 20.190.159.128
  • 20.190.159.64
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.23
  • 40.126.32.68
  • 20.190.160.132
  • 40.126.32.74
  • 20.190.160.4
  • 20.190.160.20
  • 20.190.160.66
  • 20.190.160.130
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
self.events.data.microsoft.com
  • 52.182.143.211
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2017-11-30-GlobeImposter-KMNVnNNppv.exe