Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-12-2021 08:09
General
-
Target
e3f6878bcafe2463f6028956f44a6e74.exe
-
Size
1.2MB
-
MD5
e3f6878bcafe2463f6028956f44a6e74
-
SHA1
99373d51d3975bbdea8664cdd8ab48240cfe3e44
-
SHA256
37ff5b1492fe4e1083bdc87df3524d4ac7b5b604e71dfca3730a6527d3bb7d2a
-
SHA512
2dca531b8f9dd52d1fa29c910bde579d397bae65355544d9c7eeeb88f533fcc0713fa298fc52a2e44c839a332f38f5a712bf8453bd46b84fd17ed648816431b7
Score
10/10
Malware Config
Extracted
Path
C:\read-me.txt
Family
globeimposter
Ransom Note
All your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:
----------------------------------------------------------------------------------------
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
| 3. Create Ticket
----------------------------------------------------------------------------------------
Note! This link is available via Tor Browser only.
------------------------------------------------------------
or
http://helpqvrg3cc5mvb3.onion/
Your ID
���A1 23 1A A0 DA 6A 4E 3C BB 53 2A B6 30 DA A5 AE
05 D9 DE 56 93 2A 7E 28 3C 32 1B CF EF 9D DA 4F
F0 79 7E 87 8C 85 C4 2B DA 11 AE 4A 69 AC B7 3F
2E 98 2D 76 08 95 42 2E 6F 42 9B CD 38 47 2E 25
83 EF 89 7D 60 06 35 E6 93 5F 32 A6 2D 32 15 84
CF 98 31 B4 B6 73 1F CF E4 ED 37 70 7D 41 B0 3B
14 8C C4 13 E7 F6 E2 C8 8B 9B D3 AB 9E 66 A5 F0
A3 EB 9D C2 C6 E0 A9 69 4E E1 72 06 08 95 52 E8
DB 1D 85 EB 33 74 F7 F3 9A EE AF 98 90 B4 62 E0
FF DE 6D 77 17 3B 16 4B 1C 6F 0A B5 62 4D C9 61
FF 0D A0 19 E3 DB 38 AE 04 0D 3B 8B 31 4B B4 96
15 F5 CE B1 E3 E8 13 D6 B1 45 8A 8D 23 06 5C 3D
D3 E9 12 AB 88 6C CD 4C F2 A2 25 E3 97 78 A3 39
EB 34 9F D2 6A C6 FB DD DB CA FF 23 4C E9 C4 09
6C 42 47 F2 94 09 9E EF 8F 7C 4B AA 35 3C E5 2D
AA 27 0A 3B CB 99 4F 9C 4F CB AF CC CB 5A 23 4A
URLs
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
http://helpqvrg3cc5mvb3.onion/
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 36 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3f6878bcafe2463f6028956f44a6e74.exe"C:\Users\Admin\AppData\Local\Temp\e3f6878bcafe2463f6028956f44a6e74.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
8KB
-
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
1.5MB
-
Filesize
108KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
648KB
-
Filesize
12KB