Analysis
-
max time kernel
166s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 06:43
General
-
Target
8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe
-
Size
54KB
-
MD5
b5204963231f9bddba42e611c9f09400
-
SHA1
018166da7dce248f8a9104fa4a5f2dc20038c0e7
-
SHA256
8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711
-
SHA512
ec9de09cc2b83e4446d6954f8e220296b70ca3a0fb5b1e7ee01e949199dc0276413550c5adfd01ff0dd4ede7ad0bb1b24948831610a502acb35096609598eecd
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>���������������DA C2 95 43 95 AD 6C 55 B5 E5 30 3A 60 F2 CF AE
DF EC 08 7E 43 3E D2 0E A5 A5 3C 22 46 FE 01 04
80 FB FB 81 4E F6 B2 13 C3 21 70 B1 34 51 3E 48
1B 0F 44 4E 82 E2 10 73 92 8B F4 C3 F7 64 E1 F7
BB 8C F9 79 B7 D5 DB 58 F8 A8 8E 0A 26 3E 33 CA
A8 6F 35 0D BE 83 D1 56 A5 C1 36 05 23 22 3B CC
D2 CF 4A 9B E1 7C B7 DA 3B A8 B7 AC C9 65 FD D3
19 D0 0B F0 7B 0F 60 CA 0F 10 49 90 EE 9F DB 3F
A9 2D 5B C5 E8 51 9F ED F9 F1 6D AD 16 8F E0 95
59 28 E7 84 B6 F6 41 6C 75 01 11 F7 02 1D F2 27
8A CC 0E C4 07 8E C5 55 5C 0B 89 92 90 D3 35 76
C2 42 9B 50 3E 82 53 2C 7C 71 5B 8F E5 80 24 90
D5 82 49 B8 4F 56 48 7B B7 51 94 6B A8 C0 26 F0
B9 B7 9D 7F 1A 0B 39 DC E7 BF B0 FD E3 F3 6E BA
08 8A D2 52 EC 0E 21 2D DD 4E 3A 57 D1 4A 22 33
2E E7 A0 1C 47 07 C3 BA 7A 23 6C 1F 61 A6 95 A4
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>All your important data has been encrypted.
</h3>Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files
.
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
·Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked).
Send a email from your new email address to: [email protected] with your personal ID.
· In response, we will send you further instructions on decrypting your files.
<center>Attention!</center></br>
<ul>
· It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.
· check the folder "Spam" when waiting for an email from us.WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.
· If we do not respond to your message for more than 12 hours, write to the backup email : [email protected]
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 21 IoCs
-
Drops file in Windows directory 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe"C:\Users\Admin\AppData\Local\Temp\8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB