Analysis
-
max time kernel
170s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 06:39
General
-
Target
aaead4f48553f6c12bc082fba8d16111ee87c90d8dcfe7983b53170fc3507886.exe
-
Size
51KB
-
MD5
62294093ab058b11ae6aa2a62a660ca5
-
SHA1
da4c40e4d349a1fa3a98ec144810e64a1a87f220
-
SHA256
aaead4f48553f6c12bc082fba8d16111ee87c90d8dcfe7983b53170fc3507886
-
SHA512
4f2bf7a71a7670d6e9ed8733b4a0b19551fdd44ff6469f5dad455ae23dc0848bfb67a5d381a8edf8b765178024e63b4eff1a4f53090d86cf91f09a4e48d2d68a
Score
10/10
Malware Config
Extracted
Path
C:\HOW_RECOVER.html
Ransom Note
<html>
<style type="text/css">
h1,h2, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div><h3>Your personal ID</h3></div>
<h2>
<pre>69 D5 22 40 A3 A0 14 9E E6 D8 6E 67 B1 E5 54 D0
92 C4 1E 57 F6 04 81 08 72 15 70 26 06 CE E7 54
B6 98 43 45 68 C0 BA F8 3D D1 4A 00 5E CB 89 D0
F0 91 5F 7A 19 F3 BA AE 5B 8B E2 A7 2E D8 5B C1
63 66 5D CF 83 BE CA D1 0D 50 F5 DE F8 6D 2C 08
88 E6 FC F2 9A AF AF 32 ED E4 BC 81 98 3F AA B3
09 8D 8D E0 A1 06 2A 22 64 57 E2 CF D5 53 B1 1F
3B 7A 6E 36 74 59 83 D4 98 BB 19 C1 3D AC 8C FD
07 58 E4 6B F3 5D 7E 6D 65 30 67 B4 39 35 69 30
91 FF 61 E5 DE 11 F4 A0 9E 36 E5 D5 DF 09 9F F4
51 AA 50 85 2F B1 68 DF 94 FE 41 38 47 38 E9 70
84 1A A9 7A 1F A2 0B F5 04 87 D5 D2 8D 8C 21 3C
D2 5F 36 3C B5 FE D0 6E C8 92 A8 F2 98 AA 04 BA
67 D1 A3 D9 89 DD AD 19 C3 12 D6 D8 96 F4 A5 7C
DB 6F 25 65 77 01 4C 0D 71 52 D9 55 22 2F 2D 66
FC 56 26 50 83 0B C9 64 1C 6C 93 60 B7 EF 02 9A
</pre><!--!!!-->
</h2>
</p>
<h1>Your files are encrypted!</h1>
<hr/>
<h3> To decrypt, follow the instructions below. </h3>
<br/>
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
<p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br>
<p>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files</p>
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have the decoder.</br>
<hr color=red>
<center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center>
<center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services.
No one, except [email protected], will decrypt your files.</p></center>
<hr color=red>
<ul>
<li>Only <a href = "mailto: [email protected]">[email protected]</a> can decrypt your files</li>
<li>Do not trust anyone besides <a href = "mailto: [email protected]">[email protected]</a></li>
<li>Antivirus programs can delete this document and you can not contact us later.</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
</body>
</html>�����������
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaead4f48553f6c12bc082fba8d16111ee87c90d8dcfe7983b53170fc3507886.exe"C:\Users\Admin\AppData\Local\Temp\aaead4f48553f6c12bc082fba8d16111ee87c90d8dcfe7983b53170fc3507886.exe"1⤵
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB