Overview

overview

10

Static

static

ae64ba5c25...01.exe

windows7_x64

10

ae64ba5c25...01.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    172s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11-02-2022 06:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae64ba5c25b93f7805cd77cd57c26d1deab6f55f1ab72fdc386b0de0dad7d301.exe

  • Size

    53KB

  • MD5

    1a81ce4881fe121c09c194ac182f4243

  • SHA1

    3db705c85f76ea61336f0359277d3bc412832658

  • SHA256

    ae64ba5c25b93f7805cd77cd57c26d1deab6f55f1ab72fdc386b0de0dad7d301

  • SHA512

    1c7b1ee612b3ae65548973b79e02f786e87d8c1bb744b4deeaa7d0bfb9ba8e7a64cffa9bee3b38ae21fb17cb05df5a3100b3b82026aaa0d6230ecd1d6661c854

Score
10/10
globeimposterpersistenceransomware

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">����������2E EB 5A 24 DF 4A C6 C6 A1 1E 5A A7 E5 9C 20 DA 26 38 FB 97 BB 49 E0 77 AB FF 3E 3E 9C 6B A1 6C CA 22 AB E7 B9 2B CA 23 CB 93 F4 A2 11 AC 66 90 B4 3F 86 6A 58 90 06 0A B2 4F 7C 83 C0 2A 34 16 43 EE 6C 4F 13 2B D5 EF 8F 55 92 F3 FF 05 DB 03 6E D7 19 2A EB D4 29 7A 38 E0 DA D3 03 FD C7 95 AF 33 D6 43 10 49 83 23 DB C9 14 17 B9 A2 6F EA 32 31 27 15 1D 06 E2 D4 E3 67 34 47 3D 5A 49 65 4F 63 E7 C1 66 A1 87 5C FE 59 30 A4 B8 CA 28 2A 0A DC 1B 3D 74 AE CB 0B 1B 04 2B A1 83 DF F3 57 CF 9D 41 80 A2 5F 6A D3 3C 68 F1 D9 12 15 5A 3C CE 64 59 21 87 0C 10 AD D0 97 D0 B0 C9 48 30 4A 7C BD F2 90 30 0C 48 3C E8 C7 AB AF E1 31 8E 40 23 EB 70 70 9C 68 94 0F 55 86 65 9F 5C 07 95 3B 66 FA 6B E7 B5 9A 4E 2F 2B CB 44 A7 0F 9E B2 AD 55 FD 1C 8F 5C 6C 7A 7F 73 2C A2 C1 0A 78 D9 83 </span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion </a><br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected]">[email protected] </a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> ������������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 17 IoCs
  • Drops file in Windows directory 6 IoCs
  • Program crash 3 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 59 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae64ba5c25b93f7805cd77cd57c26d1deab6f55f1ab72fdc386b0de0dad7d301.exe
    "C:\Users\Admin\AppData\Local\Temp\ae64ba5c25b93f7805cd77cd57c26d1deab6f55f1ab72fdc386b0de0dad7d301.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:4880
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4488
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2056 -s 4556
      2⤵
      • Program crash
      PID:1376
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    1⤵
    • Modifies data under HKEY_USERS
    PID:3996
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
    1⤵
      PID:3936
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 188 -p 2056 -ip 2056
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      PID:1304
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1892
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 1892 -s 3888
        2⤵
        • Program crash
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2364
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 480 -p 1892 -ip 1892
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:548
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2308
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2308 -s 3836
        2⤵
        • Program crash
        PID:3772
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 516 -p 2308 -ip 2308
      1⤵
        PID:220

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3996-142-0x0000018282270000-0x0000018282274000-memory.dmp

        Filesize

        16KB

        Download

      • memory/4488-130-0x0000018CF4590000-0x0000018CF45A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4488-131-0x0000018CF4C20000-0x0000018CF4C30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4488-132-0x0000018CF7310000-0x0000018CF7314000-memory.dmp

        Filesize

        16KB

        Download