Overview

overview

10

Static

static

aaead4f485...86.exe

windows7_x64

10

aaead4f485...86.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aaead4f48553f6c12bc082fba8d16111ee87c90d8dcfe7983b53170fc3507886

  • Size

    51KB

  • Sample

    220211-hemp6sbhd5

  • MD5

    62294093ab058b11ae6aa2a62a660ca5

  • SHA1

    da4c40e4d349a1fa3a98ec144810e64a1a87f220

  • SHA256

    aaead4f48553f6c12bc082fba8d16111ee87c90d8dcfe7983b53170fc3507886

  • SHA512

    4f2bf7a71a7670d6e9ed8733b4a0b19551fdd44ff6469f5dad455ae23dc0848bfb67a5d381a8edf8b765178024e63b4eff1a4f53090d86cf91f09a4e48d2d68a

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\HOW_RECOVER.html

Ransom Note
<html> <style type="text/css"> h1,h2, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div><h3>Your personal ID</h3></div> <h2> <pre>69 D5 22 40 A3 A0 14 9E E6 D8 6E 67 B1 E5 54 D0 92 C4 1E 57 F6 04 81 08 72 15 70 26 06 CE E7 54 B6 98 43 45 68 C0 BA F8 3D D1 4A 00 5E CB 89 D0 F0 91 5F 7A 19 F3 BA AE 5B 8B E2 A7 2E D8 5B C1 63 66 5D CF 83 BE CA D1 0D 50 F5 DE F8 6D 2C 08 88 E6 FC F2 9A AF AF 32 ED E4 BC 81 98 3F AA B3 09 8D 8D E0 A1 06 2A 22 64 57 E2 CF D5 53 B1 1F 3B 7A 6E 36 74 59 83 D4 98 BB 19 C1 3D AC 8C FD 07 58 E4 6B F3 5D 7E 6D 65 30 67 B4 39 35 69 30 91 FF 61 E5 DE 11 F4 A0 9E 36 E5 D5 DF 09 9F F4 51 AA 50 85 2F B1 68 DF 94 FE 41 38 47 38 E9 70 84 1A A9 7A 1F A2 0B F5 04 87 D5 D2 8D 8C 21 3C D2 5F 36 3C B5 FE D0 6E C8 92 A8 F2 98 AA 04 BA 67 D1 A3 D9 89 DD AD 19 C3 12 D6 D8 96 F4 A5 7C DB 6F 25 65 77 01 4C 0D 71 52 D9 55 22 2F 2D 66 FC 56 26 50 83 0B C9 64 1C 6C 93 60 B7 EF 02 9A </pre><!--!!!--> </h2> </p> <h1>Your files are encrypted!</h1> <hr/> <h3> To decrypt, follow the instructions below. </h3> <br/> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br> <p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected], will decrypt your files.</p></center> <hr color=red> <ul> <li>Only <a href = "mailto: [email protected]">[email protected]</a> can decrypt your files</li> <li>Do not trust anyone besides <a href = "mailto: [email protected]">[email protected]</a></li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> </body> </html>�����������

Extracted

Path

C:\HOW_RECOVER.html

Ransom Note
<html> <style type="text/css"> h1,h2, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div><h3>Your personal ID</h3></div> <h2> <pre>28 4B 92 0D 4A F1 83 F8 9E 32 43 CC 18 B2 29 16 2A 02 6C 89 F2 F7 FF B5 C4 D3 91 90 1C CC A6 3A B3 19 7E FB A0 11 DA F8 27 36 E3 B3 99 24 72 37 AB DE 4F 59 29 D5 D2 17 29 CB 49 57 FE 42 7E C0 3F F7 01 F4 54 C9 9D C1 EC 93 65 14 6A 30 7C 0A 4E B3 15 11 51 E2 86 70 1A 0C 5B D2 55 DA 19 D5 D5 3E F4 AD 57 C7 E0 27 56 D7 58 9A 63 5D C3 D9 78 51 89 E5 F6 89 53 47 DB 5A 05 53 60 A0 42 A8 13 D7 26 B2 C5 E9 42 C2 C8 B9 F8 BA FB 29 92 EF 9E CF 88 D2 5F 10 A8 FA F3 FF 93 1E B2 AD 18 2C DC 1F 22 EC F3 C5 17 65 97 2B 89 D5 63 45 56 FC 49 19 92 2A 16 68 CB 08 42 A2 37 EE EA C8 54 17 83 CD 46 F7 20 DF F1 9D 8A DD 4B 4D E9 A3 B1 A4 BD 5E 2D 86 93 B1 6E 66 5B 04 1A C9 7A 00 2E E8 93 29 14 AE CC E6 6A E4 E5 C1 EA 28 C2 61 94 AB CC 9A E6 75 58 AE 38 0C A0 71 02 A1 55 9D 9E ED </pre><!--!!!--> </h2> </p> <h1>Your files are encrypted!</h1> <hr/> <h3> To decrypt, follow the instructions below. </h3> <br/> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br> <p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected], will decrypt your files.</p></center> <hr color=red> <ul> <li>Only <a href = "mailto: [email protected]">[email protected]</a> can decrypt your files</li> <li>Do not trust anyone besides <a href = "mailto: [email protected]">[email protected]</a></li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> </body> </html>�����������

Targets

    • Target

      aaead4f48553f6c12bc082fba8d16111ee87c90d8dcfe7983b53170fc3507886

    • Size

      51KB

    • MD5

      62294093ab058b11ae6aa2a62a660ca5

    • SHA1

      da4c40e4d349a1fa3a98ec144810e64a1a87f220

    • SHA256

      aaead4f48553f6c12bc082fba8d16111ee87c90d8dcfe7983b53170fc3507886

    • SHA512

      4f2bf7a71a7670d6e9ed8733b4a0b19551fdd44ff6469f5dad455ae23dc0848bfb67a5d381a8edf8b765178024e63b4eff1a4f53090d86cf91f09a4e48d2d68a

    Score
    10/10
    globeimposterpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks