globeimposter | e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30

General

Target

e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
Size

53KB
MD5

ee18426cb426891d2cfa9a4243fec10d
SHA1

bde36108fb3636ccf58359fbbeaf6aef22438f13
SHA256

e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30
SHA512

c1b73895d17afcc6db7b70470e1ec0728687d074dd3c41dee60494dadb2e7672f32169a001d4fe3ffd4f791450bc3ad2141ed4100e9b352beae984cc92537c16

Score

10^/10

globeimposter persistence ransomware

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">��45 32 5D 3C 2B FC 19 AB 1A 78 A9 D4 84 A8 99 0E 5D 5F 90 6A 28 27 54 90 1F 57 57 70 FD 63 37 53 5B 41 19 A8 FF 26 55 4D 6B 0D 5A F9 C3 60 55 0D FA E9 10 6B 30 DE F2 E4 90 77 75 6B 3F 37 3F A6 2C 61 DE 7E 74 C1 FE C2 09 27 99 9A F9 01 BA 00 C5 7F 8E C0 5C 0B 7C 60 02 C8 D2 9A 68 25 12 C3 B2 01 7C 60 98 2E 51 71 30 70 F2 98 83 1F 79 5F 58 8C D9 2B 59 D0 F0 39 E6 56 63 84 C1 89 8C 22 D4 9D 37 B3 C5 98 51 00 47 84 4F 76 EE 08 2C BA 11 A0 89 34 1B 4C DD B1 2B E3 21 8C D7 6F 4C 1B CB 5C CA F6 84 D5 A5 94 D7 90 0E 2C 6A 69 B8 0D DE 8D E0 CB B9 AA 5B 03 1B 2B 70 29 C2 6E 68 CD 4A 2B 86 6B F7 33 76 DD B3 B6 C5 51 FB 17 D0 7E A5 7C 9D 45 C4 96 62 81 94 9E C9 AF 9A 51 40 A7 6D E2 E2 BD 98 8F B1 4D F1 F0 A0 D7 AA 7B BF 07 17 B1 BF FC 18 92 B6 61 A4 76 E6 1A B9 DE 44 37 </span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html> ��

Emails

href="[email protected]

">[email protected]

href="[email protected]">[email protected]</a>

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ResolveReceive.tiff => C:\Users\Admin\Pictures\ResolveReceive.tiff.Readinstruction	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File renamed	C:\Users\Admin\Pictures\StartResize.raw => C:\Users\Admin\Pictures\StartResize.raw.Readinstruction	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\Pictures\BlockResolve.tiff	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File renamed	C:\Users\Admin\Pictures\BlockResolve.tiff => C:\Users\Admin\Pictures\BlockResolve.tiff.Readinstruction	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File renamed	C:\Users\Admin\Pictures\FindCompress.raw => C:\Users\Admin\Pictures\FindCompress.raw.Readinstruction	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\Pictures\FormatSearch.tiff	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File renamed	C:\Users\Admin\Pictures\FormatSearch.tiff => C:\Users\Admin\Pictures\FormatSearch.tiff.Readinstruction	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveReceive.tiff	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File renamed	C:\Users\Admin\Pictures\UnregisterBlock.raw => C:\Users\Admin\Pictures\UnregisterBlock.raw.Readinstruction	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File renamed	C:\Users\Admin\Pictures\GroupTest.raw => C:\Users\Admin\Pictures\GroupTest.raw.Readinstruction	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File renamed	C:\Users\Admin\Pictures\PingExit.raw => C:\Users\Admin\Pictures\PingExit.raw.Readinstruction	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File renamed	C:\Users\Admin\Pictures\PingReceive.raw => C:\Users\Admin\Pictures\PingReceive.raw.Readinstruction	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe"	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe

Drops desktop.ini file(s) 17 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Libraries\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Public\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe

C:\Users\Admin\AppData\Local\Temp\e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe
"C:\Users\Admin\AppData\Local\Temp\e39714e9dfe3558ef02cfdc3969441f3d8b15d7c6136464e9a41251b455f4f30.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:3092

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
PID:204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads