globeimposter | 88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103

General

Target

88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
Size

54KB
MD5

c188fc3143de66291fe70d953b0276d2
SHA1

49797f941b565ee1cd6c5a894ed63a8763943aa4
SHA256

88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103
SHA512

986c05862e907254a5bc308582df447fca471e48a9e9120171fb95d9310ca46f295b219b01f1278595d299a0febe4b8fd20188bffdf20e630e23d98f4ce6a4b0

Score

10^/10

globeimposter persistence ransomware

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #303030; } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��0C 5E 4E FC 63 D4 D2 CA F4 60 45 D7 57 20 7E 84 B9 CF CE 1F 30 65 38 39 26 62 3C 24 DB F9 0A CA 7E 83 89 6B FD 3D 47 B2 9F 12 9C F3 E3 E0 BB 53 2D A4 8A F4 2F 9F D6 33 FB 0E 7F 82 A1 A7 2B A7 97 0E 4F B5 2B F5 38 DD 99 25 8A 69 88 FC DA 4D A5 02 88 5D 44 23 22 64 58 DA 00 79 7E 41 7A 3C 81 B6 BC 83 A4 9D AF F9 C6 A6 25 FF 2B 62 B7 A8 B2 67 EA A5 CD ED 01 59 B4 99 8F BF A8 08 46 8D BA E1 41 F0 B8 49 28 3B EF C5 B4 26 12 E6 4A 58 29 35 69 49 49 7F CD D6 F8 9B 8C DB F1 05 BB 29 9C 9E 62 A6 F6 D6 45 18 26 24 BD 65 24 37 6C F2 17 24 97 4A 32 1C 4D 32 3F 72 B3 99 E2 AD A6 C3 D8 87 E7 8B 42 22 30 16 F9 52 C7 77 DF D3 E7 25 74 B3 A9 D7 FB DA F2 CC ED C1 90 9A FE B1 89 49 4F 35 10 D5 83 4B 84 B5 1A 5A AE BF C5 FE CC 5C 3C CB FB AC F7 D5 84 27 BA 3E 04 39 B5 43 04 BF </pre> </div> </div>  <div class="tabs">  <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>☣ Your files are encrypted! ☣</h1> <hr/> <h3> &#11015 To decrypt, follow the instructions below. &#11015 </h3> <br/> <div class="text">  To recover data you need decrypt tool.</br> To get the decrypt tool you should:</br> <p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br> (Or alternate mail <font color="FF0000"> [email protected] </font>)<p> In the letter include your personal ID (look at the beginning of this document). Send me this ID in your first email to me</p> We will give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt tool and after payment you will receive a decrypt tool and instructions how to use it We can decrypt few files in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected], will decrypt your files.</p></center> <hr color=red> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul>  </div> </div> </div>  </ul>  </div> </div>  </div> </div> </body> </html>

Emails

[email protected]

[email protected]</li>

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\RestorePop.raw => C:\Users\Admin\Pictures\RestorePop.raw.DREAM	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File renamed	C:\Users\Admin\Pictures\BlockRedo.raw => C:\Users\Admin\Pictures\BlockRedo.raw.DREAM	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File renamed	C:\Users\Admin\Pictures\ClearSuspend.tif => C:\Users\Admin\Pictures\ClearSuspend.tif.DREAM	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File renamed	C:\Users\Admin\Pictures\DenyConnect.tif => C:\Users\Admin\Pictures\DenyConnect.tif.DREAM	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File renamed	C:\Users\Admin\Pictures\NewInstall.tif => C:\Users\Admin\Pictures\NewInstall.tif.DREAM	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File renamed	C:\Users\Admin\Pictures\PublishStop.tif => C:\Users\Admin\Pictures\PublishStop.tif.DREAM	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File renamed	C:\Users\Admin\Pictures\RemoveApprove.crw => C:\Users\Admin\Pictures\RemoveApprove.crw.DREAM	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe"	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe

Drops desktop.ini file(s) 15 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Public\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1304	svchost.exe
Token: SeCreatePagefilePrivilege	1304	svchost.exe
Token: SeShutdownPrivilege	1304	svchost.exe
Token: SeCreatePagefilePrivilege	1304	svchost.exe
Token: SeShutdownPrivilege	1304	svchost.exe
Token: SeCreatePagefilePrivilege	1304	svchost.exe
Token: SeSecurityPrivilege	2220	TiWorker.exe
Token: SeRestorePrivilege	2220	TiWorker.exe
Token: SeBackupPrivilege	2220	TiWorker.exe

C:\Users\Admin\AppData\Local\Temp\88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe
"C:\Users\Admin\AppData\Local\Temp\88559d339589c7f3dc0d51cc03cc5fb892436ab35570c6035782da0204789103.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-131-0x000001CA279E0000-0x000001CA279F0000-memory.dmp

Filesize
64KB

Download
memory/1304-130-0x000001CA27180000-0x000001CA27190000-memory.dmp

Filesize
64KB

Download
memory/1304-132-0x000001CA29F00000-0x000001CA29F04000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing