Analysis

  • max time kernel
    164s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11-02-2022 07:14

General

  • Target

    060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe

  • Size

    54KB

  • MD5

    86de4891b15f1e5288809ad893ff83d3

  • SHA1

    b67fffd9e2f076b2990e41f4e7bd57036f9e558c

  • SHA256

    060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b

  • SHA512

    cb96daa8d0c76ffc43f5ec477d33f6b8544d248ba3f07ad7c09517e4694cdd14a63136102e69a06740d9b234be6533524630f3caf952c26c2c869090fde4c70c

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <style type="text/css"> body { background-color: #252525; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FFD700; background: #1C1A1B; } .letter { color: #FFD700; font-weight: 600 } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #1C1A1B; color: #F1EADA; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #F1EADA; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #1C1A1B; color: #F1EADA; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #1C1A1B; color: #E29F12; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head"><h3>Your personal ID</h3></div> <div class="identi"> <pre><span class="letter">�������������BF F3 97 13 DE D4 D1 A8 C6 C7 75 A7 92 8A 4D D3 5F EE 0C CD 2A 07 BB F4 11 4E 1A 14 5C EA DE 57 DB 91 09 73 9F 83 6F E4 0E 91 B2 8A EB 95 AB FA B4 19 04 82 DF 09 F2 26 68 B3 C4 68 34 66 A6 C3 9B 5F 4D E2 A5 0A 0E 00 64 8C 3A 93 87 4E 2F C5 18 54 D2 9D B3 D6 DD 5A 0E 2F EE 9F 0B 0A 4C AD AC BE 04 56 66 73 5E 28 1C 09 8A 26 30 B4 87 BC 14 A6 E1 5F 79 CC 1D 8F 4D 7A E5 BD D5 97 C7 70 32 89 59 39 96 3F C3 9C 50 C4 29 3D B9 35 99 BF EB 7A 46 2D F5 54 77 51 57 0C 4E 52 0F CC CE DD 2E 7A 34 BF 4D E4 17 19 B6 E2 07 80 FF E4 6F 06 1B 18 C8 2D 3B B2 8A EC B3 F8 8A E4 AC 9C 00 F0 3D 9E 2F 59 D5 22 AD 1A 3E E2 14 BF 2B 13 12 9F AC 68 DD 2D 4C A3 90 31 BA 5F D4 AF D6 46 59 83 28 05 66 86 A3 0B 7A 24 FF 93 E9 BE 7D E3 1D B9 B5 7A 2B 04 99 E3 C7 1F 4F 5B 62 25 8C 39 C1 56 </span><p></p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input name="tabs" checked="checked" id="tab1" type="radio"> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>? Your files are encrypted! ?</h1> <h3> To decrypt, follow the instructions below. </h3> <br> <div class="text"> <!--text data --> To recover data you need decryptor.<br> To get the decryptor you should:<br> <p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br> (Or alternate mail <span class="letter">[email protected]</span>)</p><p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files<p></p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.<br> <p> <hr color="#FFD700"> <center><b><p style="color: #FFD700;">MOST IMPORTANT!!!</p></center> <center><p style="color: #FFD700;"> You can not decrypt your files cheaper than we offer you. You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE. No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center> <hr color="#FFD700"> <ul> <li>Only [email protected] can with a guarantee decrypt your files </li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> <!--text data --> </div> <!--tab--> </body></html>��������
Emails

[email protected]</span><br>

class="letter">[email protected]</span>)</p><p>

[email protected]

[email protected]</li>

URLs

http-equiv="Content-Type"

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

  • Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 23 IoCs
  • Drops file in Windows directory 8 IoCs
  • Program crash 5 IoCs
  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 18 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
    "C:\Users\Admin\AppData\Local\Temp\060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:4536
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1972
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4348
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4348 -s 4532
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2292
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    1⤵
    • Modifies data under HKEY_USERS
    PID:1312
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 420 -p 4348 -ip 4348
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:1388
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2288
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1536
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1536 -s 4244
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:3676
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 480 -p 1536 -ip 1536
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:3740
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4424
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4424 -s 3884
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:4960
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 504 -p 4424 -ip 4424
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:4864
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4880
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4880 -s 3960
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:396
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 428 -p 4880 -ip 4880
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:3988
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3276
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3276 -s 3884
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      PID:1652
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 540 -p 3276 -ip 3276
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:4280

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ad264abb-df4c-4877-9012-f500265c5c51}\Apps.ft

    MD5

    5dc7c685f78dcf159dcf969090688b5e

    SHA1

    36154b5ada14d2331ef0e369ef688edcc455e2dd

    SHA256

    50caf3a9f4a9337de01b82a2c2de6732a19c6d6c5c69e77c181bbf07a7c50254

    SHA512

    cb25ea7882770502e2625c14d9621c5f0bac99f2bad59cd325aded4c910aba1c112ec173e03123ebfd60dbe5558d73d1616b2d342620f874a7f97aa09cddc94b

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ad264abb-df4c-4877-9012-f500265c5c51}\Apps.index

    MD5

    df753fba91757c2bcfd17ff736b51770

    SHA1

    af24ed3aa4187b045a39586601bcd9b041060249

    SHA256

    997f1a4992609df8fc4fd9e3f9bb315f0ff8339fa7b27813d39977ddb84ce307

    SHA512

    fcb54c348ccb3cb2f941663cd4294f4bf0630cebb85a09efc6202f21201e7beebd4583f2d1ce5838a0fee5bcf1e4773952d9e8f3ab722c18189dda93b0c5e176

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache132890382830401256.txt

    MD5

    284047b820bb63374114d72707839d53

    SHA1

    9469b4b936fca0df40b805b2f4712c1f6af73aef

    SHA256

    21252f386747af89a5e7593dca48eccc66908b9cd95796ef641f79640a2d4771

    SHA512

    7cadcea59b2d374d06ff259001a43cd1d60cc9b1bae9fd7e5d64759942fa0934cd11303dbf0cfc6712cc79fa68199a3da3cf0febae16823b136b5d00708120de

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F

    MD5

    9c6832d00a42c7b402ffe4e80eb7ba70

    SHA1

    6fe7005327d1454bddc1b07dcc0e764d8b672da5

    SHA256

    27df51409220ffadc995c144c7cfddd0305bc7f8fbde95c22a7cb86868bba1b7

    SHA512

    67c67f9c84878bd451ce48ea6cae93d4d3c812dfe0d440e5baaab4449f0bbbc91037024be00d009098166cae76f1f1880c232378e86eb1b3cf4b54365a6e80a4

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F

    MD5

    7e553c78190eeb77ee936acd7c762bc2

    SHA1

    d4c07aa2d9a525310c46ec852e1787b2c72db54a

    SHA256

    10da1ff5fe39f7f6ab32d50660a4271a3d2c515d48fb2b84c8851af688376daa

    SHA512

    80c0a29ede8a1586902baa9fe74308088f1eef318914936319f9fdee6e96013dae9477805bf85d01f46a3163360c226351084e3f4e112980d3989dcc078dd8a7

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ZL5QLBD\www.bing[1].xml

    MD5

    01c099bc767fefd0f92ef60db3e4c074

    SHA1

    d6930ffeda6f0f268b11ecfccd3d086a76171732

    SHA256

    64e2d3998d69a8869ae1622f95f51d21e70625c71ec0eddb39402fbac34b221d

    SHA512

    f0b1f728e5980d757534662c002eea6f2fc9c14e7a6b667fcf39376b52f1bec52f36823dd3c6fbfea62cedb18340a7b9f8ae15a7dc6e135b591feea9d66c64d3

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ZL5QLBD\www.bing[1].xml

    MD5

    7ca3bf662e8c25e8cdb50453ab30d44b

    SHA1

    175f1de0a865584647d309801c597a1c94ebb5f9

    SHA256

    ed0a49c3174a9db10490aedc6d2aa785da644ce13ff24dfd40fec551c0d9b350

    SHA512

    90e16f3a4a414d276a1233ec25844a2ca8e6b64e54c168c812795dac3c53c75324bcf6bfe59fee7ddb6ffc2eea2ecee9e5db28ebccf774ab6fc7d919fff3a663

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ZL5QLBD\www.bing[1].xml

    MD5

    24a0ec00afb936024834923aa0096aac

    SHA1

    e863d1613664620d05c910d3efe90972e0c04eb5

    SHA256

    8bba3d307e737c9cc4692fdcd9a5df8d362dffbcd18ac94089a3272b78e64e98

    SHA512

    4de523c73b6e863a5cdc44f70346abd27416d303505c839bcf84f2639faf6c04c130430ecb2ce292aca1737a3fbb75a516c3ea7e4a5a9aadae9b4195cc9f17ee

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ZL5QLBD\www.bing[1].xml

    MD5

    c1ddea3ef6bbef3e7060a1a9ad89e4c5

    SHA1

    35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

    SHA256

    b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

    SHA512

    6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

  • memory/1312-136-0x000002455ED70000-0x000002455ED74000-memory.dmp

    Filesize

    16KB

  • memory/1972-130-0x000001D16D380000-0x000001D16D390000-memory.dmp

    Filesize

    64KB

  • memory/1972-132-0x000001D170100000-0x000001D170104000-memory.dmp

    Filesize

    16KB

  • memory/1972-131-0x000001D16DA20000-0x000001D16DA30000-memory.dmp

    Filesize

    64KB

  • memory/4424-164-0x0000021780500000-0x0000021780600000-memory.dmp

    Filesize

    1024KB