Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24/01/2022, 06:28
Static task
static1
Behavioral task
behavioral1
Sample
034580c52732e52a382f4d550c34f09c.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
034580c52732e52a382f4d550c34f09c.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
034580c52732e52a382f4d550c34f09c.exe
-
Size
884KB
-
MD5
034580c52732e52a382f4d550c34f09c
-
SHA1
bd4f5d3d0ca9d9d80f001666435f5d88006e75b8
-
SHA256
185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430
-
SHA512
300f9215a323e87d808791381bfc6e56d5fdfd8c0dcf9ceb19474e30e67557951d501da4a7a6cfdd5992450dc17bdd37144f342ab5ec9f7ec0f449e703c79074
Score
10/10
Malware Config
Extracted
Path
C:\read-me.txt
Family
globeimposter
Ransom Note
All your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:
----------------------------------------------------------------------------------------
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
| 3. Create Ticket
----------------------------------------------------------------------------------------
Note! This link is available via Tor Browser only.
------------------------------------------------------------
or
http://helpqvrg3cc5mvb3.onion/
Your ID
���24 89 9E FD 27 38 B5 08 29 18 01 5A 8B CE AC 1B
DE CC F0 F8 AB F2 37 CA 2E 20 A6 4D 94 8E 68 3C
70 FD 1A 21 AF 65 EF 97 33 E3 71 1C 85 BB A8 38
0C 2F 11 F6 EA A4 1B 83 0B 88 7B BA 2A 4C 36 05
7E 84 13 59 DD CB 4E 68 30 61 7A 61 F1 3B DB C9
B8 78 A7 1B 5A DD 1E B8 CF 7C 0A 4A D4 60 CF 8D
FA 5E 48 2B 2F 6F 83 8C 99 99 76 69 E5 F1 CE 4D
59 D3 23 95 A0 EE 7A FB 3E 28 8D CD 54 B2 76 B7
14 E2 42 45 EA 9A F8 62 FC 45 7E BD CE C7 75 3D
81 CD 0C 7B 16 35 28 67 A0 17 3B 2F 79 AF B2 B2
A3 04 2D 29 6E 39 49 50 3B B1 61 A8 9E 53 B0 B0
AC E6 2C E3 AD 14 1B B5 F8 BF C6 3B FC C1 79 A5
23 26 8F EB CA FE 48 02 35 D2 7B 7F 89 0F EC AD
D6 9D B5 F9 9C 9B 42 18 3B 12 48 4E A9 56 FD EF
9B 9C 9E 66 D1 0F 8A E2 6E 39 A8 C6 7B 35 18 86
BE C1 97 11 D6 6F AE EC 5D 2A 06 16 CA FC BC F6
URLs
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
http://helpqvrg3cc5mvb3.onion/
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\NewConnect.png => C:\Users\Admin\Pictures\NewConnect.png.xls extrac32.exe File renamed C:\Users\Admin\Pictures\RequestCopy.png => C:\Users\Admin\Pictures\RequestCopy.png.xls extrac32.exe File renamed C:\Users\Admin\Pictures\SyncRead.raw => C:\Users\Admin\Pictures\SyncRead.raw.xls extrac32.exe File renamed C:\Users\Admin\Pictures\ExpandUnpublish.tif => C:\Users\Admin\Pictures\ExpandUnpublish.tif.xls extrac32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce extrac32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\extrac32.exe" extrac32.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini extrac32.exe File opened for modification C:\Users\Public\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Desktop\desktop.ini extrac32.exe File opened for modification C:\Program Files (x86)\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Libraries\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Downloads\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Documents\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Music\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Music\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Links\desktop.ini extrac32.exe File opened for modification C:\Users\Public\Videos\desktop.ini extrac32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini extrac32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1088 set thread context of 1876 1088 034580c52732e52a382f4d550c34f09c.exe 27 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialReport.dotx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Top.accdt extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ContactPicker.dll extrac32.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\read-me.txt extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SettingsInternal.zip extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Issues.accdt extrac32.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBCONV.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Right.accdt extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\OrielFax.Dotx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Graph.exe.manifest extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OARTCONV.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialLetter.dotx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Pitchbook.potx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ProjectStatusReport.potx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Events.accdt extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.ICO extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityReport.Dotx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPOLK.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCFU.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPSLAX.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSClientManifest.man extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONPPTAddin.dll extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST32.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\LoanAmortization.xltx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBTRAP.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll extrac32.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\read-me.txt extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveLetter.dotx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\bdcmetadata.xsd extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SOCIALCONNECTOR.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieLetter.dotx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\PersonalMonthlyBudget.xltx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDCAT.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PEOPLEDATAHANDLER.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyMergeLetter.dotx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSCOL11.PPD extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_fr.dub extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanReport.Dotx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SAEXT.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfoInternal.zip extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\1100.accdt extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHLTS.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OFFXML.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyReport.dotx extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PTXT9.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\WidescreenPresentation.potx extrac32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\read-me.txt extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDSF.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceqp35.dll extrac32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA000A.DLL extrac32.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1088 034580c52732e52a382f4d550c34f09c.exe 1088 034580c52732e52a382f4d550c34f09c.exe 1088 034580c52732e52a382f4d550c34f09c.exe 1088 034580c52732e52a382f4d550c34f09c.exe 1088 034580c52732e52a382f4d550c34f09c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1876 extrac32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1088 034580c52732e52a382f4d550c34f09c.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1876 1088 034580c52732e52a382f4d550c34f09c.exe 27 PID 1088 wrote to memory of 1876 1088 034580c52732e52a382f4d550c34f09c.exe 27 PID 1088 wrote to memory of 1876 1088 034580c52732e52a382f4d550c34f09c.exe 27 PID 1088 wrote to memory of 1876 1088 034580c52732e52a382f4d550c34f09c.exe 27 PID 1088 wrote to memory of 1876 1088 034580c52732e52a382f4d550c34f09c.exe 27 PID 1088 wrote to memory of 1876 1088 034580c52732e52a382f4d550c34f09c.exe 27 PID 1088 wrote to memory of 1876 1088 034580c52732e52a382f4d550c34f09c.exe 27 PID 1088 wrote to memory of 1876 1088 034580c52732e52a382f4d550c34f09c.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\034580c52732e52a382f4d550c34f09c.exe"C:\Users\Admin\AppData\Local\Temp\034580c52732e52a382f4d550c34f09c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\extrac32.exe"C:\Windows\SysWOW64\extrac32.exe"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
PID:1876
-