Analysis
-
max time kernel
169s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 06:36
General
-
Target
b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1.exe
-
Size
115KB
-
MD5
ea469ffdeb5e04efbc225017500f4d4c
-
SHA1
bde1e9e537081757c864d2ad50007bf1cb928849
-
SHA256
b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1
-
SHA512
487d419811a2aec7e5b3a154590d696eb7e2626f014ebea5feaa7c50bf4b0f276d860243c5bcf5e380a8f97232b5a595a6a1dc434dd55cc395389c915bcda94f
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<head>
<meta charset="windows-1251">
<title>HOW TO DECRYPT YOUR FILES</title>
<HTA:APPLICATION
ICON="UserAccountControlSettings.exe"
/>
<script language="JScript">
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #EDEDED;
}
.bold {
font-weight: bold;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">All your files have been encrypted!</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>�53 B3 D2 B0 AD D3 22 8D A8 C1 54 41 EA 14 A1 67
3C 56 26 8A 65 49 05 0E 71 AE D3 19 4E 65 02 06
87 79 68 48 B9 D4 5E 5F D1 75 79 95 DC A6 9C 1E
5E 6C 27 44 92 C1 8E 6B 2A 2C A1 6A 7F A6 AB BF
52 FB 57 44 D4 DE AE 89 E4 39 11 8E 0D C4 BB 7A
5A 8B FB 98 FC C4 6F 5E 93 03 BB 58 BE 0B 0A 15
70 C0 B2 23 34 A8 88 AB C7 0A CE 4D 1C FD B2 BA
9E 0D 00 6E 61 D1 B7 C9 92 EC 8E EF 33 92 96 82
56 EC 18 50 3E E5 5C 4A 83 1A 7C D9 38 AD 7F 24
9F 32 61 DA 44 08 1F FA BC E6 48 71 D1 DD C6 79
00 16 E8 DF E3 1B 75 DC 7C E6 57 99 E9 0A 9A 31
6E 1D 07 B5 BF EE 57 ED 87 78 6E 10 A1 3F 6A 84
92 8D DA CC 36 92 98 58 58 76 DB 9F 80 B3 81 89
2A 2C E0 F8 4D 3A E5 2B 22 25 94 1E 93 19 3D 5D
32 61 1B BE 49 70 8E EA 5B A3 8C BE 4D F5 9A B8
DD 3E D2 88 AE B4 88 5A 5D C6 E3 10 2E 58 D8 6C
</pre><!-- !!! do not change !!! -->
</div>
<div class="bold">All your files have been encrypted due to a security problem with your PC.</div>
<div class="bold">If you want to restore them, write us to the e-mail:<font color="FF0000">[email protected]</font></div>
<div class="bold">Additional Mailing Address e-mail:<font color="FF0000">[email protected]</font></div>
<div class="note info">
<div class="title">How to obtain Bitcoins</div>
<ul>
<li>The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<li><a href="https://localbitcoins.com/buy_bitcoins">https://localbitcoins.com/buy_bitcoins</a></li>
<li>Also you can find other places to buy Bitcoins and beginners guide here:
<li><a href="http://www.coindesk.com/information/how-can-i-buy-bitcoins/">http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a></li>
</ul>
</div>
<div class="note info">
<div class="title">Free decryption as guarantee</div>
<ul>
<li>Before paying you can send to us up to 1 files for free decryption. Please note that files must NOT contain valuable information and their total size must be less than 1Mb</li>
</ul>
</div>
<div class="note alert">
<div class="title">Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
</li>
</ul>
</div>
</body>
</html>�����
Emails
color="FF0000">[email protected]</font></div>
color="FF0000">[email protected]</font></div>
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1.exe"C:\Users\Admin\AppData\Local\Temp\b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB