Analysis
-
max time kernel
169s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 06:26
General
-
Target
e3f1b651f2d708acda198e395abb5192c460c730615042e623ed70df9d40f41a.exe
-
Size
53KB
-
MD5
13fc356382c25d7fcec959e12e65e335
-
SHA1
d94e093e33355ea735083f5042cb6efb17c0987d
-
SHA256
e3f1b651f2d708acda198e395abb5192c460c730615042e623ed70df9d40f41a
-
SHA512
688342e8400aa6512e8d0720f6a7cd5372c63e7a1280a55101be1f5d45d058507dae9a619cf83da3ddb7dc1c873f95ff2ceaa81348bd87f0e6f40719ff036b75
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<head>
<meta charset="utf-8">
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background-color: #C1AB8F;
}
.bold {
font-weight: bold;
}
.xx {
border: 1px dashed #000;
background: #E3D5F1;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">Attention! All your files are encrypted.</div>
<div class="note alert">
<ul><li>Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the original key recovery is impossible! To decrypt your files you need to buy the special software -
"YASUDA DECRYPTOR"
Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.</li>
<li>If you want to restore files, write us to the e-mail:
[email protected]
In subject line write "encryption" and attach your personal ID in body of your message also attach to email 3 crypted files. (files have to be less than 10 MB)</li>
<li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
</ul>
</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>���������������D9 EC 0B D7 91 29 2F 11 64 3C 76 E3 61 C8 89 92
6E 4D BB 4B C5 8A 77 DA 07 8E 6A 92 5C 08 9A E3
C5 37 5A 92 17 08 AF F6 FB 06 C5 0B 7B FD 42 A3
AF 30 7B DF 82 C7 04 D6 78 73 E3 99 44 3C 1F E4
5B 51 F2 64 E4 B9 8E E9 B4 E6 56 7A 4A 4F 00 FE
E2 82 1D 95 7D EC 68 FA 50 F6 A3 80 95 6B 97 63
B8 4A FA FA 05 D4 A3 B1 B1 3F 26 06 D5 58 E9 43
29 2D A6 30 74 25 D8 5E 36 9A AE 8C FF 56 30 1D
05 D3 DF D9 D9 7D 2F F2 75 EB 14 81 26 8F 73 A0
42 BB 17 AA AF EF B9 DE C9 45 D7 43 F0 DB 0B 27
AA 10 B0 D4 61 C6 67 60 07 69 8D 5E C6 50 9E EB
03 92 B0 FC D4 25 B5 A6 AA 20 AE 53 3E 23 12 67
59 61 F4 E3 30 65 49 DF F2 1A 7C 83 D1 B9 DD EE
45 10 DD D9 4C D5 4E E2 DF 60 1F 8F A3 83 7D 71
13 D9 F7 AC 64 A9 67 67 7D 45 13 11 64 39 0D 0D
33 C1 A2 C0 78 A6 79 18 EF 4A DB 95 00 48 85 30
</pre>
</div>
</body>
</html>��������
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 9 IoCs
-
Drops file in Windows directory 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3f1b651f2d708acda198e395abb5192c460c730615042e623ed70df9d40f41a.exe"C:\Users\Admin\AppData\Local\Temp\e3f1b651f2d708acda198e395abb5192c460c730615042e623ed70df9d40f41a.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB