Analysis
-
max time kernel
152s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
11-12-2021 01:22
Static task
static1
Behavioral task
behavioral1
Sample
d24c1c9f8c5abd584f6e120c9c2e4cca.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d24c1c9f8c5abd584f6e120c9c2e4cca.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
d24c1c9f8c5abd584f6e120c9c2e4cca.exe
-
Size
320KB
-
MD5
d24c1c9f8c5abd584f6e120c9c2e4cca
-
SHA1
77c65eff3bdbb9c3b42cc0fc3285577cd999167a
-
SHA256
38df9f7ee6504ebae134f8f446caaa0cf9f7c2c258f51023bc7eddd68e5aad12
-
SHA512
57370b7970c9bd4fa713f95a1799c8cdcb4857a4962357f1004a18b85ba8856af1273b0f9ef9aaffe54b7cb6cb8e71d60aebcd460caf789de5f9a3607e46eaea
Score
10/10
Malware Config
Extracted
Path
C:\read-me.txt
Family
globeimposter
Ransom Note
All your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:
----------------------------------------------------------------------------------------
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
| 3. Create Ticket
----------------------------------------------------------------------------------------
Note! This link is available via Tor Browser only.
------------------------------------------------------------
or
http://helpqvrg3cc5mvb3.onion/
Your ID
���41 FB 81 20 8E 54 E3 84 36 EA AB 04 A5 8C 95 0C
9B FD E6 55 5A 66 29 8A 1C FE 78 45 46 CD 13 41
14 AF 41 26 6E 5E DF D2 7C B1 17 C9 ED FB F1 69
36 B4 82 6F A0 D2 7C 93 D0 E6 2D 6C 03 80 61 DD
43 B0 4F 2F DC 06 F4 17 88 E4 0C CF C5 68 9D 7D
9B 40 EF 78 7B 8B B4 E0 BA E6 B4 9D 55 DB 7B D3
A8 FA AF 23 00 03 5A F9 16 F6 51 C4 32 4D 50 23
27 A2 4A 70 8F 86 80 F3 BB 51 9D B5 BF F4 A4 86
C2 9B E3 F3 A5 FE 19 83 E6 A8 48 10 F2 07 29 97
A9 E5 D2 63 8E 8D 86 1E 5E 61 52 47 7D 1B 5D 0A
14 71 AC 9B 58 26 2B AF C5 96 14 B8 A4 47 83 82
AE 84 84 F3 13 E2 1D D3 67 17 5E BD 68 C9 3E 93
54 4B 76 45 D3 EC 3D 48 90 39 E4 FB E3 90 89 37
4A 03 F8 8C BB 98 33 4A FA CA 9A 99 40 B4 A5 53
C3 93 89 42 AA 57 1F B5 C7 38 C4 3B 06 5A 38 64
F9 99 CE 8C AE DF 0C 8D 39 C3 A1 7B A2 BD F7 AE
URLs
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
http://helpqvrg3cc5mvb3.onion/
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ConvertFromWatch.tif => C:\Users\Admin\Pictures\ConvertFromWatch.tif.xls AppLaunch.exe File renamed C:\Users\Admin\Pictures\ConvertUndo.raw => C:\Users\Admin\Pictures\ConvertUndo.raw.xls AppLaunch.exe File renamed C:\Users\Admin\Pictures\GetConvert.raw => C:\Users\Admin\Pictures\GetConvert.raw.xls AppLaunch.exe File renamed C:\Users\Admin\Pictures\ClearUnblock.tif => C:\Users\Admin\Pictures\ClearUnblock.tif.xls AppLaunch.exe File opened for modification C:\Users\Admin\Pictures\ExitDisable.tiff AppLaunch.exe File renamed C:\Users\Admin\Pictures\ExitDisable.tiff => C:\Users\Admin\Pictures\ExitDisable.tiff.xls AppLaunch.exe File renamed C:\Users\Admin\Pictures\RevokeShow.crw => C:\Users\Admin\Pictures\RevokeShow.crw.xls AppLaunch.exe File renamed C:\Users\Admin\Pictures\UnblockRead.crw => C:\Users\Admin\Pictures\UnblockRead.crw.xls AppLaunch.exe File renamed C:\Users\Admin\Pictures\UnregisterUninstall.raw => C:\Users\Admin\Pictures\UnregisterUninstall.raw.xls AppLaunch.exe -
Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification C:\Users\Public\Pictures\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini AppLaunch.exe File opened for modification C:\Users\Public\Videos\desktop.ini AppLaunch.exe File opened for modification C:\Users\Public\Downloads\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Links\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Documents\desktop.ini AppLaunch.exe File opened for modification C:\Users\Public\desktop.ini AppLaunch.exe File opened for modification C:\Users\Public\Libraries\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Searches\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Music\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini AppLaunch.exe File opened for modification C:\Users\Public\Music\desktop.ini AppLaunch.exe File opened for modification C:\Users\Public\Documents\desktop.ini AppLaunch.exe File opened for modification C:\Users\Public\Desktop\desktop.ini AppLaunch.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini AppLaunch.exe File opened for modification C:\Users\Admin\Videos\desktop.ini AppLaunch.exe File opened for modification C:\Program Files (x86)\desktop.ini AppLaunch.exe File opened for modification C:\Program Files\desktop.ini AppLaunch.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3988 set thread context of 3652 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe 69 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\dj_16x11.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-200.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\FreeCell\Goal_6.jpg AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_JA-JP.respack AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\WideTile.scale-125.png AppLaunch.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\SLINTL.DLL AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\en_get.svg AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_contrast-white.png AppLaunch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\read-me.txt AppLaunch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-300.png AppLaunch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\read-me.txt AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\models\es-ES.PhoneNumber.model AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-400.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-96_altform-unplated.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\tj_16x11.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\mask\11h.png AppLaunch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\read-me.txt AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.Vui.dll AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-40.png AppLaunch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll AppLaunch.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_ur.dll AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview-hover.svg AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\common\Well-Played_Unearned_small.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\toast.scale-150.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\11.png AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\AddressBook2x.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\AppxSignature.p7x AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\bm_60x42.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-150.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125.png AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api AppLaunch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll AppLaunch.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler64.exe AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-16_contrast-white.png AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\ui-strings.js AppLaunch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\read-me.txt AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_thumbnailview_18.svg AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js AppLaunch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons.png AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluCCFilesEmpty_180x180.svg AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Compare_R_RHP.aapp AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Zoom_in.png AppLaunch.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\read-me.txt AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\ui-strings.js AppLaunch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\read-me.txt AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-200.png AppLaunch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.FileUtils.dll AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockLargeTile.scale-100.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\resources.pri AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-24_altform-unplated.png AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Adobe.Reader.Dependencies.manifest AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-disabled_32.svg AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Resources\TopicPage\Images\playbutton-rollover.png AppLaunch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\read-me.txt AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\animations\OneNoteFRE_SaveAutomatically_LTR_Tablet.mp4 AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-125.png AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-256.png AppLaunch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll AppLaunch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe AppLaunch.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js AppLaunch.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96_altform-unplated.png AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3652 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3988 wrote to memory of 3652 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe 69 PID 3988 wrote to memory of 3652 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe 69 PID 3988 wrote to memory of 3652 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe 69 PID 3988 wrote to memory of 3652 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe 69 PID 3988 wrote to memory of 3652 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe 69 PID 3988 wrote to memory of 3652 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe 69 PID 3988 wrote to memory of 3652 3988 d24c1c9f8c5abd584f6e120c9c2e4cca.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\d24c1c9f8c5abd584f6e120c9c2e4cca.exe"C:\Users\Admin\AppData\Local\Temp\d24c1c9f8c5abd584f6e120c9c2e4cca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
PID:3652
-