Analysis
-
max time kernel
178s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
11-02-2022 06:38
General
-
Target
ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe
-
Size
55KB
-
MD5
b89f0f1f9397ece683ae76d9cfa02973
-
SHA1
1bdb10e24abf15bd1c8e74a95321acb0ca22ea52
-
SHA256
ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a
-
SHA512
a24840da73a223d359cb9f39aba77f8d21ca67b13e5242dd81c69be2a7617c6d749a317d1ce3de24d357e4a31053fc7ba059dce0f71ee2e6b1f810abadd77816
Score
10/10
Malware Config
Extracted
Path
C:\HOW_TO_BACK_FILES.html
Ransom Note
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css">
body {
background-color: #252525;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 5px;
color: #FF0000;
background: #1C1A1B;
}
.letter {
color: #FF0000;
font-weight: 600
}
.tabs1 .identi {
margin-left: 0px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #1C1A1B;
color: #F1EADA;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #F1EADA;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #1C1A1B;
color: #F1EADA;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top:0;
background: #1C1A1B;
color: #E29F12;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head"><h3>Your personal ID</h3></div>
<div class="identi">
<pre><span class="letter">9B 4C 02 B0 72 A2 DC 5B B3 AA 9E BF F3 9A 2D F1
BB 39 F3 E5 F4 B3 3B 8A 45 5E DE 44 7F 47 07 58
39 D6 12 21 0C E4 F4 76 D6 F0 5F 37 BC 79 5C 2F
5C BC EB 60 5D BC 3B D6 37 5E F9 9F FC 8D 3A 41
BD 16 08 A8 FB BC 95 60 07 12 49 BB BD D9 B6 14
18 EE C1 80 B4 9F CE 02 7D 70 A1 8C A9 25 83 41
B8 94 88 9F 57 DA 3F 01 C2 C6 63 60 83 9C 15 79
68 93 5F 64 C2 49 6D 4D C2 8E E7 B9 2B DD C5 6D
85 89 2A 0C AA 46 CE 04 51 EC A6 BB 80 2B BC F0
23 FA 4E 13 33 6D 84 6C 64 E9 73 6F EE 60 2D 5E
FA 63 AE A8 A4 CC EB 2A 73 95 27 1E F1 DD AE AA
05 C0 0E B6 39 97 06 2A 54 0A 8E 1A D9 3F AB 85
88 99 D3 68 9D C6 79 B9 D8 0E 47 5C 6C 61 6D 90
D7 AD 75 44 49 10 45 A6 5E E4 B0 00 18 33 1A 16
9C CF CC 89 21 9E A0 2E B0 14 28 21 C9 E6 82 CF
23 2E 26 73 DA ED 66 C6 ED 05 65 25 2C DC 02 5C
</span><p></p>
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input name="tabs" checked="checked" id="tab1" type="radio">
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☣ Your files are encrypted! ☣</h1>
<h3> To decrypt, follow the instructions below. </h3>
<br>
<div class="text">
<!--text data -->
To recover data you need decryptor.<br>
To get the decryptor you should:<br>
<p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br>
(Or alternate mail <span class="letter"> [email protected]</span>)</p><p>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files<p></p>
After we send you instruction how to pay for decrypt and
after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we
have the decoder.<br>
<p>
<hr color="#FF0000">
<center><b><p style="color: #FF0000;">MOST IMPORTANT!!!</p></center>
<center><p style="color: #FF0000;"> You can not decrypt your files cheaper than we offer you.
You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE.
No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center>
<hr color="#FF0000">
<ul>
<li>Only [email protected] can with a guarantee decrypt your files </li>
<li>Do not trust anyone besides [email protected]</li>
<li>Antivirus programs can delete this document and you can not contact us later.</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
<!--tab-->
</body></html>
Emails
URLs
http-equiv="Content-Type"
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 9 IoCs
-
Drops file in Windows directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Kills process with taskkill 1 IoCs
-
Modifies data under HKEY_USERS 45 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe"C:\Users\Admin\AppData\Local\Temp\ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /PID 26602⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS