Overview

overview

10

Static

static

d956ecb29f...b4.exe

windows7_x64

10

d956ecb29f...b4.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    156s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    11-02-2022 06:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d956ecb29ffd5d6c99186bbdee7db287720d971507e849a5b84039e675802ab4.exe

  • Size

    53KB

  • MD5

    7405fa894b5d3aead8d6c7e4ff914ea3

  • SHA1

    3ef1a74aec0f727fe18c788779bde541f9b266d4

  • SHA256

    d956ecb29ffd5d6c99186bbdee7db287720d971507e849a5b84039e675802ab4

  • SHA512

    96dee1c2b4659aa4eaba81c3fe7677ca1ddb12055f7a0894bb8008fbc7f70c48cf144cc84c232ffebb7b7f7166d7b113a3db39d6c15b338228f80780343ee222

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Read_Me.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>���������������27 5B 66 60 A3 6B EC 40 94 14 46 C8 A6 47 49 03 CA E7 7C 4A 4C BB 50 8A A0 0D B7 BA E8 8D A4 1B 52 6D 2F AD 3D 47 DC 9E F1 F2 7D E4 31 84 66 9B F5 53 39 51 BE 78 5E 76 20 B1 F0 05 15 91 7F 78 A4 3B A3 4C 81 D4 C0 C8 E5 C1 20 64 EF 71 D0 5A B6 F3 38 AC CE 09 62 FE 33 29 32 FF 9D 4E C0 4C BD FE 93 50 A7 51 0E BE A0 65 8D BC 09 FB 3D 23 49 05 59 7D DE 7F 09 C5 BF 32 A8 9D 01 13 8E 67 A3 88 F6 4F 03 2F 9D 16 87 1C 01 20 35 D9 B4 DA 12 FA 51 B0 13 9D 6E D3 6C 60 B3 B7 9C 99 EC 01 75 14 70 D8 60 B6 F4 48 70 13 CA 09 29 08 93 73 0D B4 A2 FD 8A DB 88 34 9E 61 98 BB 2F FC 49 F9 25 99 A9 06 A8 30 BA 19 EE 7E 02 A5 3A 87 6C F9 0E 73 C3 44 98 14 BA 6D B7 F6 25 BB 18 E5 C6 88 B9 92 FD A0 98 69 E8 FC BD 94 FB CF 76 C5 1A 72 0B E7 70 36 E6 E3 3D 27 A6 8E 00 49 A8 96 2C B0 </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; File recovery instructions! &#9760;</h1> <hr/> <br/> <div class="text"> <!--text data --> All your files have received a secret permission.</br> To remove this permission and restore all data you need:</br> <p>Send 1 image or text file (less than 10mb) to mail <span>[email protected]</span>.</br> In the message include your personal ID (look at the beginning of this document).</p> In the response message we will send the recovered file and further instructions for recovery.</p> </br> <center>Attention!</center></br> <ul> <li>If you have not received a response to your message more than 12 hours, write to an alternate email address <span>[email protected]</span></li> <li>Attempts to run the anti-virus tools will result in the loss of your data</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user has a unique key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>���������������
Emails

<span>[email protected]</span>.</br>

<span>[email protected]</span></li>

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d956ecb29ffd5d6c99186bbdee7db287720d971507e849a5b84039e675802ab4.exe
    "C:\Users\Admin\AppData\Local\Temp\d956ecb29ffd5d6c99186bbdee7db287720d971507e849a5b84039e675802ab4.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:948

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/948-54-0x0000000076C91000-0x0000000076C93000-memory.dmp

    Filesize

    8KB

    Download