Overview

overview

10

Static

static

060ed35d06...0b.exe

windows7_x64

10

060ed35d06...0b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    164s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11-02-2022 07:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe

  • Size

    54KB

  • MD5

    86de4891b15f1e5288809ad893ff83d3

  • SHA1

    b67fffd9e2f076b2990e41f4e7bd57036f9e558c

  • SHA256

    060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b

  • SHA512

    cb96daa8d0c76ffc43f5ec477d33f6b8544d248ba3f07ad7c09517e4694cdd14a63136102e69a06740d9b234be6533524630f3caf952c26c2c869090fde4c70c

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <style type="text/css"> body { background-color: #252525; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FFD700; background: #1C1A1B; } .letter { color: #FFD700; font-weight: 600 } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #1C1A1B; color: #F1EADA; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #F1EADA; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #1C1A1B; color: #F1EADA; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #1C1A1B; color: #E29F12; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head"><h3>Your personal ID</h3></div> <div class="identi"> <pre><span class="letter">�������������BF F3 97 13 DE D4 D1 A8 C6 C7 75 A7 92 8A 4D D3 5F EE 0C CD 2A 07 BB F4 11 4E 1A 14 5C EA DE 57 DB 91 09 73 9F 83 6F E4 0E 91 B2 8A EB 95 AB FA B4 19 04 82 DF 09 F2 26 68 B3 C4 68 34 66 A6 C3 9B 5F 4D E2 A5 0A 0E 00 64 8C 3A 93 87 4E 2F C5 18 54 D2 9D B3 D6 DD 5A 0E 2F EE 9F 0B 0A 4C AD AC BE 04 56 66 73 5E 28 1C 09 8A 26 30 B4 87 BC 14 A6 E1 5F 79 CC 1D 8F 4D 7A E5 BD D5 97 C7 70 32 89 59 39 96 3F C3 9C 50 C4 29 3D B9 35 99 BF EB 7A 46 2D F5 54 77 51 57 0C 4E 52 0F CC CE DD 2E 7A 34 BF 4D E4 17 19 B6 E2 07 80 FF E4 6F 06 1B 18 C8 2D 3B B2 8A EC B3 F8 8A E4 AC 9C 00 F0 3D 9E 2F 59 D5 22 AD 1A 3E E2 14 BF 2B 13 12 9F AC 68 DD 2D 4C A3 90 31 BA 5F D4 AF D6 46 59 83 28 05 66 86 A3 0B 7A 24 FF 93 E9 BE 7D E3 1D B9 B5 7A 2B 04 99 E3 C7 1F 4F 5B 62 25 8C 39 C1 56 </span><p></p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input name="tabs" checked="checked" id="tab1" type="radio"> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>? Your files are encrypted! ?</h1> <h3> To decrypt, follow the instructions below. </h3> <br> <div class="text"> <!--text data --> To recover data you need decryptor.<br> To get the decryptor you should:<br> <p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br> (Or alternate mail <span class="letter">[email protected]</span>)</p><p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files<p></p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.<br> <p> <hr color="#FFD700"> <center><b><p style="color: #FFD700;">MOST IMPORTANT!!!</p></center> <center><p style="color: #FFD700;"> You can not decrypt your files cheaper than we offer you. You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE. No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center> <hr color="#FFD700"> <ul> <li>Only [email protected] can with a guarantee decrypt your files </li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> <!--text data --> </div> <!--tab--> </body></html>��������
Emails

[email protected]</span><br>

class="letter">[email protected]</span>)</p><p>

[email protected]

[email protected]</li>
URLs

http-equiv="Content-Type"

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 23 IoCs
  • Drops file in Windows directory 8 IoCs
  • Program crash 5 IoCs
  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 18 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
    "C:\Users\Admin\AppData\Local\Temp\060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:4536
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1972
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4348
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4348 -s 4532
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2292
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    1⤵
    • Modifies data under HKEY_USERS
    PID:1312
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 420 -p 4348 -ip 4348
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:1388
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2288
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1536
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1536 -s 4244
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:3676
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 480 -p 1536 -ip 1536
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:3740
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4424
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4424 -s 3884
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:4960
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 504 -p 4424 -ip 4424
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:4864
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4880
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4880 -s 3960
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:396
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 428 -p 4880 -ip 4880
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:3988
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3276
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3276 -s 3884
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      PID:1652
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 540 -p 3276 -ip 3276
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:4280

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1312-136-0x000002455ED70000-0x000002455ED74000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1972-130-0x000001D16D380000-0x000001D16D390000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1972-132-0x000001D170100000-0x000001D170104000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1972-131-0x000001D16DA20000-0x000001D16DA30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4424-164-0x0000021780500000-0x0000021780600000-memory.dmp

    Filesize

    1024KB

    Download