Overview

overview

10

Static

static

8fa6bba519...7b.exe

windows7_x64

10

8fa6bba519...7b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    158s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11-02-2022 06:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8fa6bba519338a198a803f014f4af89ed26575c358135b2600efc3905860e77b.exe

  • Size

    53KB

  • MD5

    6b3e0d6fd8df512f61adc41549275355

  • SHA1

    118296df204e6fd8bd2ce38951dd17ee72b44925

  • SHA256

    8fa6bba519338a198a803f014f4af89ed26575c358135b2600efc3905860e77b

  • SHA512

    66734cc83d17c3da4b4cbb17be9766d463e4e750042e44cf3ec1bda895bc1ff83e8f7c1d8872a1c4c11e0002442999c65b8a2e1d0e9e3a9f6996afc2eab97162

Score
10/10
globeimposterpersistenceransomware

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>���������������75 64 15 90 01 C1 98 BA 98 66 13 ED 19 D2 F9 12 4B 21 6E CF 30 83 0C 5D B2 FD AC 00 0D C7 82 B6 BD B1 0A AA 7F 99 84 25 F9 01 0E BC 40 10 3B 75 A0 3C 07 9C F5 A4 52 66 4E 93 20 77 A1 28 8F 81 32 02 DA 8B 09 FA 65 5A AA F2 5B D1 0E 37 84 58 FA 32 22 2C E9 E0 F5 E4 68 91 E0 B8 D9 5E 01 8E 25 9F 5E E1 CA 22 C8 A5 BE DD C8 40 A7 50 B7 ED 37 7C D4 9C 5A 7A EF 17 C3 BA 28 19 E7 BD A1 48 6F 84 48 C9 57 9D 8D 71 B9 0A 62 8A B4 7E AA 00 08 64 70 B9 A2 39 F3 08 4A 8A 5F 4D 20 C0 AC 99 35 0D BF C3 01 36 41 80 2F E2 AA 59 08 0B 45 CF B8 AE 44 1E 4A A5 E2 03 6D 3D 9A DE BD 11 C9 F7 39 A8 8E 63 8A 0D 56 90 9D 67 BF 47 97 33 C2 67 6C BB 0D 7B 90 1A 25 DE F4 CD D1 BA D4 FF C0 DD 43 59 81 FE 56 AB 55 CD 95 90 00 A7 4A 94 5F A6 B5 89 A2 3E 63 27 68 B7 99 CF 6A F0 A1 DF 50 3A </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 test image or text file <span> [email protected]</span>.</br> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <center>Attention!</center></br> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone [email protected]</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> ��������
Emails

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 13 IoCs
  • Drops file in Windows directory 8 IoCs
  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8fa6bba519338a198a803f014f4af89ed26575c358135b2600efc3905860e77b.exe
    "C:\Users\Admin\AppData\Local\Temp\8fa6bba519338a198a803f014f4af89ed26575c358135b2600efc3905860e77b.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:5080
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3488
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4360
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2160 -s 4524
      2⤵
      • Program crash
      PID:1464
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    1⤵
    • Modifies data under HKEY_USERS
    PID:2712
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
    1⤵
      PID:4812
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 444 -p 2160 -ip 2160
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:2180

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2712-135-0x000001FC00BF0000-0x000001FC00BF4000-memory.dmp

      Filesize

      16KB

      Download

    • memory/3488-130-0x0000021C67520000-0x0000021C67530000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3488-131-0x0000021C67740000-0x0000021C67750000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3488-132-0x0000021C69C60000-0x0000021C69C64000-memory.dmp

      Filesize

      16KB

      Download