Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11/02/2022, 06:31
General
-
Target
cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d.exe
-
Size
54KB
-
MD5
f7c69ac5f5b2f6552f19acb6e712b373
-
SHA1
8ba9ab739128c7f6630f3f65fb12ca121d72afc8
-
SHA256
cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d
-
SHA512
fb044c247c8804f469ebbecc1a8f9cc58c78fe0fb6c2d97632dd552bb156cf007342351318f7c02446da442c5b009b2c49730e1743fcbe3b65965581526debed
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<!DOCTYPE html>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #F5F5F5;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #F5F5F5;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
</head>
<body>
<div class="tabs">
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<div class="text">
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<div class="identi">
<strong>Your personal ID:</strong>
<pre>������������23 66 7A B6 B3 C2 AA FB 67 2C 97 91 D4 EE AC C3
4D 8C 6F 28 13 81 FD D2 42 B2 9F 1F 45 91 7D 7B
3F FB 8A 95 1F BF 06 0D E5 CB BA F8 45 75 28 1C
BD 12 8F 61 D1 8E 40 08 57 DE 25 88 B0 AF 70 6B
4C 67 C8 63 95 6D 88 6B 40 F1 9E 83 53 F0 FB E4
45 B4 9C 2A E8 5C 0A 26 3F CA 6B E1 F2 D6 3D F5
BC D7 7D 12 BC BC 1E B0 76 8E D7 3B D0 DD 87 E6
58 27 A2 51 D5 41 5F 7F 6E 61 2D 52 93 FD 49 94
AD 37 E7 2C 26 88 B5 CD B9 25 06 AD 93 47 53 D2
FB 5A EC 2E 8B F3 37 74 E4 EE 0F B5 FA 68 3C 6E
84 B7 52 CB 30 0E E3 52 97 16 69 BE F3 DB 2A F4
0A 81 89 75 08 47 94 61 0A 7B 56 69 01 DF EC B0
52 30 06 44 BE 98 1A 14 BB 26 AB 64 6A B5 F5 6C
4D 00 17 E1 61 8A 2F 65 4B B2 19 3C 2D 50 0B B5
B3 31 C4 03 8F 5E 3A 7F 8C 7B 63 6B DB 87 7C A9
0B 24 DC C1 EC 25 7B FD 3E DF 0D 96 BF 9E 38 2D
</pre>
</div>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
</div>
</div>
</div>
</body>
</html>�����
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d.exe"C:\Users\Admin\AppData\Local\Temp\cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB