Overview

overview

10

Static

static

70d29f6fc3...ef.exe

windows7_x64

10

70d29f6fc3...ef.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    170s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11-02-2022 06:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    70d29f6fc320559deb47a7debb9c046dcc4c48e6e6e36bc9f7adc616fa7105ef.exe

  • Size

    55KB

  • MD5

    57e0e19cfa2a57cb098965e8d2d50b78

  • SHA1

    1b0907887b46a910612ec738108f635a7c8812aa

  • SHA256

    70d29f6fc320559deb47a7debb9c046dcc4c48e6e6e36bc9f7adc616fa7105ef

  • SHA512

    e660613643fef2a57d4a8e3a4316b7b6c198e8d06d7faa8f6cb010c2c016c114b271f39ec293a39ff27eab3f4c973fd48e77e6a9e1df757ff85666b477b0eca0

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note
<html> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> <style type="text/css"> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background-color: #C1AB8F; } .bold { font-weight: bold; } .xx { border: 1px dashed #000; background: #E3D5F1; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { font-size: 30px; height: 50px; line-height: 50px; font-weight: bold; border-bottom: 10px solid #D0D0E8; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } </style> </head> <body> <div class="header">Your files are encrypted!</div> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>50 CA 0A F5 95 CA 7A 4E 6B 67 59 9F D8 6B 7E E4 8D 12 6F B9 4D B1 D7 AA A8 CE 83 6A 26 7C 95 74 0F 1E 80 D4 7D BD A2 F5 2D 14 CB 9D 51 76 7C C9 05 28 C7 6E 77 2B C1 D0 0A 0C 9F 88 09 CB 98 94 72 37 AA D4 19 39 3E BE 15 4C 19 42 49 CF E2 BC 28 39 71 D7 7D CD 1F 66 99 88 54 DA DB C8 99 09 57 9D A6 B9 85 5E 48 F7 EB 15 01 84 83 B6 86 4C F5 43 B7 F6 4E 00 AB F0 51 9E D1 9B EB 3B A5 4B 31 B4 57 7D E4 65 31 A0 5F 11 0B C4 70 5D FB 8D ED 74 A2 54 02 20 1D 67 FF 3B E7 3F 87 13 1E B5 B5 9B 6A F0 41 63 B5 2E B3 7C 82 8E 2F 59 F5 02 48 B1 D1 09 B3 8D 51 C6 B2 D2 F2 9D D2 AE 85 50 29 7C D4 EB 5D 46 3C F0 71 EA 01 73 9E B4 63 5B 2A 3A 2F 44 E9 3F 67 B3 6C 30 EF D0 A2 38 16 F4 80 BB E3 3F 11 E8 16 B2 7F 84 E8 BE 63 F1 48 48 57 D5 BE 84 1B 4F 3F 85 B3 DE BB E0 46 51 63 B3 </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div class="bold"> <div align="left">Your important documents, databases, programs, saving games, documents, network folders are encrypted for your network security problems.</div> </div> <div class="bold">No data from your computer was not stolen or removed.</div> <div class="bold">To restore your files, follow the instructions.</div> <div> <h2 align="left">How to get the automatic decryptor:</h2> <div class="bold" align="left">1) Create a Wallet and buy Bitcoins </div> <div class="note xx"> <div align="left"> </div> <div align="left"> <strong>Create Bitcoin Wallet of these sites:</strong> </div> <li><strong>https://blockchain.info/wallet</strong></li> <div align="left"> <strong>Buy BTC on one of these sites:</strong> </div> <div align="left"> <ol> <li><strong>https://localbitcoins.com</strong></li> <li><strong>https://www.coinbase.com</strong></li> <li><strong>https://www.bestchange.com</strong></li> </ol> </div> <div align="left"> </div> </div> </div> <div> </div> <div class="bold"><p>2) Contact us by email : <span class="mark">[email protected]</span>. and <span class="mark">[email protected]</span> In the letter include your personal ID (look at the beginning of this document) and ip-address of the computer on which the files are located.</p> </div> <div class="bold"> <p>3) After answering your inquiry, our operator will give you further instructions, which will be shown what to do next (the answer you get as soon as possible)</p> <div class="bold"> </div> <div><p>* To be sure in getting the decryption you can send 1-2 encrypted files to <span class="mark">[email protected]</span> In the letter include your personal ID (look at the beginning of this document).</p> </div> <div><p>** Write here on the mail for a faster response [email protected] <div class="note alert"> <div class="title">Attention!</div> <ul><li>Do not attempt to remove the program or run the anti-virus tools.</li> <li>Attempts to self-decrypting files will result in the loss of your data.</li> <li>Decoders are not compatible with other users of your data, because each user's unique encryption key.</li> <li>We are not liars or cheaters. You pay - we help.</li> </ul> </div> </body> </html>
Emails

class="mark">[email protected]</span>

class="mark">[email protected]</span>

[email protected]

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 23 IoCs
  • Drops file in Windows directory 7 IoCs
  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70d29f6fc320559deb47a7debb9c046dcc4c48e6e6e36bc9f7adc616fa7105ef.exe
    "C:\Users\Admin\AppData\Local\Temp\70d29f6fc320559deb47a7debb9c046dcc4c48e6e6e36bc9f7adc616fa7105ef.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    PID:4180
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1092
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4156
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    1⤵
    • Modifies data under HKEY_USERS
    PID:4712
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
    1⤵
      PID:4988
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:532
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 532 -s 3844
        2⤵
        • Program crash
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4972
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 412 -p 532 -ip 532
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:4848
    • C:\Windows\system32\werfault.exe
      werfault.exe /hc /shared Global\4c8f33343bb1408babbf1f6e1a238543 /t 1396 /p 532
      1⤵
        PID:4896
      • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
        C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
        1⤵
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:2112
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4744
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 4744 -s 3864
          2⤵
          • Program crash
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:4152
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 508 -p 4744 -ip 4744
        1⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Suspicious use of WriteProcessMemory
        PID:3872

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1092-131-0x0000019FE2D20000-0x0000019FE2D30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1092-130-0x0000019FE2790000-0x0000019FE27A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1092-132-0x0000019FE5410000-0x0000019FE5414000-memory.dmp

        Filesize

        16KB

        Download

      • memory/4712-142-0x000001C6EF7A0000-0x000001C6EF7A4000-memory.dmp

        Filesize

        16KB

        Download

      • memory/4744-162-0x0000020A28770000-0x0000020A28790000-memory.dmp

        Filesize

        128KB

        Download