Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
11/02/2022, 06:31
General
-
Target
cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d.exe
-
Size
54KB
-
MD5
f7c69ac5f5b2f6552f19acb6e712b373
-
SHA1
8ba9ab739128c7f6630f3f65fb12ca121d72afc8
-
SHA256
cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d
-
SHA512
fb044c247c8804f469ebbecc1a8f9cc58c78fe0fb6c2d97632dd552bb156cf007342351318f7c02446da442c5b009b2c49730e1743fcbe3b65965581526debed
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<!DOCTYPE html>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #F5F5F5;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #F5F5F5;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
</head>
<body>
<div class="tabs">
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<div class="text">
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<div class="identi">
<strong>Your personal ID:</strong>
<pre>������������2D DA A6 4D 0C 33 C5 33 5B F9 C9 A8 42 01 67 CA
14 99 A0 C4 F7 F3 74 5A 1E 18 F0 AC 7A 9F F3 EC
5D C1 A8 3E 94 C9 68 0C 90 4B 16 01 A4 F1 CF BD
4E E9 28 54 6D C6 38 92 59 43 43 D2 9D 50 D6 41
1F B9 05 29 E7 D8 1F AD B7 CC 31 46 15 83 C8 B3
2A 77 2E 59 06 3F CB 4B 55 35 4B F5 CD B7 1E 6B
75 07 09 24 F8 EE DF 6C C6 C0 58 0A 1E BA 64 ED
8E 85 18 F4 A7 30 38 DF 7B 91 5E 85 DB 4C FB EC
7E CA 92 91 A5 9F 23 41 C0 BF D4 FF B3 01 B8 CB
99 CD 95 8B E3 F8 BD 5A 1D 88 BA D3 C4 46 0E F8
16 F7 77 7B 4E 1F E1 74 D8 4B 88 4D 3A 93 86 94
8F F6 D9 01 82 48 72 EA FD 1F EF 9A BF 1F 6A DE
2B 7E B4 A3 1F F4 F3 C0 21 43 F8 33 B6 D1 23 E7
1A 93 86 88 DB 13 B8 15 42 39 3B 9D 0D A0 52 A0
A8 18 F3 D3 8F F6 59 52 FC A6 28 64 A7 4B 25 FE
23 6C 21 A5 65 33 98 4B 04 ED B7 2F E5 15 D4 65
</pre>
</div>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
</div>
</div>
</div>
</body>
</html>�����
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 9 IoCs
-
Drops file in Windows directory 1 IoCs
-
Modifies data under HKEY_USERS 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d.exe"C:\Users\Admin\AppData\Local\Temp\cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS