Analysis
-
max time kernel
168s -
max time network
134s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 06:36
General
-
Target
b5533756c7630974d56d936e2bcfa87df7c466d10fbc2d8254639f47b40a3468.exe
-
Size
55KB
-
MD5
7ba9734b62015d9aab0764b39c971994
-
SHA1
e05e2c319d073989d80658fad50b230d288b3b48
-
SHA256
b5533756c7630974d56d936e2bcfa87df7c466d10fbc2d8254639f47b40a3468
-
SHA512
08db2c7492153ba7e3ab7e22f8837b040503ef92d2f163f26be30b1def949df821ee6f05a8792688a3b006967c1b21b5e12c18586c91c685c5f97cadf650a941
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>���������������67 E1 30 DE B7 37 4F 21 0A 99 79 32 E3 21 FA 1E
AE 23 15 A0 21 06 23 DD E2 F7 89 69 94 E8 B4 10
A9 50 71 CD 8A 75 B9 53 84 19 CC 10 32 16 79 8F
31 90 B6 93 A7 98 20 15 54 6E 3C 1F C5 A2 C9 F9
29 01 C3 B4 D8 E9 BC E7 00 D9 B0 56 9E F5 06 E4
D8 3F 80 FA DB 9B 44 0E A3 27 6B 72 78 7E 39 9D
22 32 CC 3D 3C E3 D9 47 B9 ED B9 37 69 90 D5 91
16 16 45 0A 10 06 08 31 0E D6 43 C9 85 F2 A1 91
B3 F8 5D F0 70 68 42 DA 9C A5 BE 94 E4 0C 0D FC
22 37 71 D0 8C 5F B0 CE A9 88 0C AE BA D2 8F 43
E5 90 6A 81 2B 6A 8C A3 E0 CD 73 47 8E 04 34 79
F9 78 22 C9 68 5A 63 25 BD 56 9E B6 CE EB 51 DA
9C 53 5D 72 FD AB A2 C6 15 F1 B5 28 50 A9 02 7D
3F 28 17 D4 DB 17 7D BE DD 51 74 15 2E 6E C3 FC
5A 94 D0 63 5C 3A D0 1D BD 74 41 B0 71 A0 E7 8E
7F A5 4C FE C2 9A 64 FB A5 58 58 53 5F 97 10 55
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>How to quickly restore all files and protect data ?</h3>
<div class="text">
<!--text data -->
<p> Write a letter with this question to <span> [email protected]</span>.</br>
We really can help, make sure of this, attach to the letter an encrypted file (less than 5mb), and specify in the letter your personal ID (look at the beginning of this document).</p>
In the response letter you will receive a decrypted file and a complete recovery instruction.</p>
Save your time, write to <span> [email protected]</span> right now.</br>
<p>
</p>
</br>
<h3><center>Attention!</center></h3>
<ul>
<li>Only [email protected] can decrypt your files</li>
<li>Attempts to self-decrypting files or run anti-virus tools will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
<li>If you have not received a response to your message for more than 12 hours, write to an alternate email address <span> [email protected]</span></li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>�����������
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5533756c7630974d56d936e2bcfa87df7c466d10fbc2d8254639f47b40a3468.exe"C:\Users\Admin\AppData\Local\Temp\b5533756c7630974d56d936e2bcfa87df7c466d10fbc2d8254639f47b40a3468.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB