Analysis
-
max time kernel
172s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
11-02-2022 06:45
General
-
Target
81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5.exe
-
Size
54KB
-
MD5
95755470bef529c0087e799f471588aa
-
SHA1
adc63f3cbf4890fea962b4b0891acccbad350668
-
SHA256
81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5
-
SHA512
f7a414c716de72c4b33910677222113931208269c2ce6c818052b1e5bf128282a47b5260497f8ec7aebfd54e219df66226f63d2ac91eb137b7eb90b5743e105e
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<body>
<div class="tabs">
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<br><center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.</br>
Without a secret key stored with us, the restoration of your files is impossible</h1></center>
<br><center>---------------------------------------------------------- </br></center>
You will be able to restore files so:
<li> to contact us by e-mail: <strong>
[email protected]
</strong></li>
You send your personal ID and 3 crypted files, up to 3 MB in size everyone.
We will decipher them, as proof that we can do this.
Also you receive the instruction where and how many it is necessary to pay.
<li> you pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li>
<center>---------------------------------------------------------</center>
<div class="note private">
<div class="title">Your personal ID:</div>
<pre>���������9C 32 2B 90 34 02 FA FB 21 D8 93 DF 28 8C D1 78
EC 5C 3B BC 55 3C F2 7F DF F2 66 4D 80 00 2C 36
E8 77 25 C6 A8 B0 48 D2 D0 0C 38 4D 65 70 AC B1
8E 0E E8 D7 22 8E 7C C3 2D 4E F7 C2 36 63 C1 FB
47 2F D7 EC FD 04 40 94 F6 DA B6 13 38 40 59 51
CA 5A 4D 55 22 BF 33 8F EC 4D C2 BB 4A 80 3D 68
57 29 D3 58 29 05 1B 0A 5A DB 92 48 70 25 F2 04
70 E5 ED 99 B7 AE C5 E4 87 E8 60 FC F3 46 BC 3D
BA 8D 0B AB 4F 2C 01 AB 6D F4 19 87 68 9E D3 F3
CD 9B 9A 39 F8 45 2F D1 11 B9 34 14 71 6B 84 C6
8E BE 05 BE 2A DF 24 6A 2F EC AB E6 FF DF 0E C8
0F 3C C4 A3 7E CA 13 07 89 FD AA E0 66 35 64 2F
D8 76 DA 2C E1 A1 58 4A 9C 5D 5C 1D 50 E7 02 AD
AF 74 2A AE FB 99 E7 89 11 45 1E 96 04 B8 E7 19
EC 28 11 CE 0C B5 68 5C 0D E3 F8 56 15 81 C5 20
E1 1F 64 4B B6 ED 81 28 2A 02 8D 90 78 BF B5 CD
</pre>
</div>
<center>----------------------------- P.S. ----------------------------------</center>
<li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li>
</body>
</html>�����������
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 9 IoCs
-
Drops file in Windows directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5.exe"C:\Users\Admin\AppData\Local\Temp\81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS