Overview

overview

10

Static

static

711d0c7824...c0.exe

windows7_x64

10

711d0c7824...c0.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    166s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11-02-2022 06:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    711d0c7824828dc737a33233234b5b0d124450a6c55128ec18ca7cec64d883c0.exe

  • Size

    52KB

  • MD5

    7193e3460be793d59cfba98af8c79183

  • SHA1

    887b537e30437f19d800460a94b8beaaad8b66a5

  • SHA256

    711d0c7824828dc737a33233234b5b0d124450a6c55128ec18ca7cec64d883c0

  • SHA512

    77912f44ba49d1b9ecf33f04d05390510d29b13b5a832855165271ddf7039cb2fdabdb98e15f87eeccb4d67fef6d0470714fa4a235e310bf732d5872c0ca262a

Score
10/10
globeimposterpersistenceransomware

Malware Config

Extracted

Path

C:\How_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>���������������71 F9 A0 0A 8C D3 38 67 C5 B7 7B 70 C1 57 AA 37 3F 35 55 A5 DF CE AE 1B 40 70 8F 36 91 99 D7 61 7C D8 6B 8E 61 74 00 08 06 9D 53 89 87 5D AA 2D EA CD 17 D4 E2 14 03 BE F0 1B 46 24 52 47 3F CD AE 3F 1F FA 05 E2 70 EA 1E 8C C1 E4 70 9E 69 20 0D D4 5F D2 A1 20 93 5A 2D 90 91 B2 0E 4B C5 5C 30 14 95 9F D9 D7 04 AE BB B5 27 54 EA 39 96 F7 81 DA 16 53 8C CD 94 17 6A 9D 80 3D 12 BE AC 7F 19 AD E1 6F E6 D9 13 11 34 DE 15 53 B8 CB 81 7A B9 6D 77 01 BD 36 5A 58 5C 53 D6 40 31 70 6B 2E F5 79 13 5B 65 0F 6A 6A 39 4F 9C 6E 83 C4 65 55 AB 0F 86 81 04 57 19 B5 A8 74 E1 17 43 2E 43 B3 90 54 6E CD AA 2E 4D 1F 5F A6 4E DE 10 CE 65 4A 29 E4 BB CE FC 40 C3 B6 1A CC D3 CD BA 37 DF E5 CF B6 9A 41 F6 09 69 69 3B 0E 83 3E 4E B5 FF 35 F8 EF 62 AB 83 3C 1D 63 3A A0 F3 A7 D2 95 84 C8 </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <h3>To recover data you need decryptor..</h3> <br/> <div class="text"> <!--text data --> To receive the decryption, you need to contact us by e-mail: </br> <span>[email protected]</span> </br> or </br> <span>[email protected]</span> </br> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> �����������
Emails

<span>[email protected]</span>

<span>[email protected]</span>

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 20 IoCs
  • Drops file in Windows directory 8 IoCs
  • Program crash 2 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\711d0c7824828dc737a33233234b5b0d124450a6c55128ec18ca7cec64d883c0.exe
    "C:\Users\Admin\AppData\Local\Temp\711d0c7824828dc737a33233234b5b0d124450a6c55128ec18ca7cec64d883c0.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:2664
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3648
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3088
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3184 -s 4424
      2⤵
      • Program crash
      PID:3956
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3184 -s 4424
      2⤵
      • Program crash
      PID:4104
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    1⤵
    • Modifies data under HKEY_USERS
    PID:1432
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
    1⤵
      PID:3652
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 408 -p 3184 -ip 3184
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:2544
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4272

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1432-142-0x000002C1FCCA0000-0x000002C1FCCA4000-memory.dmp

      Filesize

      16KB

      Download

    • memory/3648-130-0x000001DF17930000-0x000001DF17940000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3648-131-0x000001DF17990000-0x000001DF179A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3648-132-0x000001DF1A690000-0x000001DF1A694000-memory.dmp

      Filesize

      16KB

      Download