General

  • Target

    765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a

  • Size

    51KB

  • Sample

    220211-hknvesdfdr

  • MD5

    2692c25d30fcf69479ec57f07c34dfc4

  • SHA1

    ffe82e80f65d548195afb67da3d4c592d96ca3c2

  • SHA256

    765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a

  • SHA512

    4e000993d203372fee742bec8b1b5ec938e0b0d5e9b5cad4590ef0df215f465696c64d58cfabd914f91e92f81bdb37fae092758dd0e90204b67f4b66e88d6b1c

Malware Config

Extracted

Path

C:\Read this message.txt

Ransom Note
*** IF YOU WANT TO GET ALL YOUR FILES BACK, FOLLOW THE INSTRUCTIONS *** No files have been deleted or copied from your computer. All your files have been encrypted with a complex algorithm. All your files have been encrypted due to a security problem with your PC. Your personal key : ---BEGIN PERSONAL KEY--- �������A4 19 6B 23 72 6F AF E4 4F 83 22 7D 6D 9B 06 F2 AF A6 68 0C CD C6 20 4A 6D A0 62 C8 94 CD F0 E6 09 4E 19 6D EF B5 D4 D5 07 99 7D B5 BC D6 4D E9 BB 67 43 99 CD C2 B7 D6 12 2D 70 1A B2 E7 A2 C3 77 73 58 CC AC 78 EA F9 33 F1 75 B8 5C 2C E2 73 7A 28 A9 C5 16 20 14 61 0B 7A D6 F2 24 10 71 1D A7 82 2C 24 4C CB 9D 61 AF 40 0C 09 E9 2A 1A 82 60 E8 ED AC 2B 95 66 A5 B5 FF 65 EE 14 AD 51 D9 46 ED A6 8A 49 0F 41 91 84 1B 90 18 E4 E8 A3 A4 6C 1A 06 54 48 94 69 5B B4 EF 19 72 43 38 8C C0 C7 0A 0A 73 55 D0 FE D9 F5 8A 54 F1 10 15 BD 5D 47 7F BC D0 4A 1B 5D FF 57 04 56 DE 00 D2 3B BF C7 C3 1F 89 5F 9F 7D 1C 5A 03 38 FE 57 19 CF A7 F1 89 11 27 50 94 51 9D 89 82 CC FB 97 AB 0D 79 30 DD BC 03 73 27 FA 73 08 80 F8 73 69 BE 08 A6 F1 D1 98 F2 F6 71 ED 08 3C A2 97 DD 8A 24 45 04 ---END PERSONAL KEY--- What to do next to restore all your files? follow the instructions below. 1. Calm down. Pull yourself together. Everything will be fine. Follow the instructions. 2. Send to the mail [email protected] And [email protected] Your personal key. It's also worth to send your internal IP address (you can find it using the service whatismyipaddress.com). 3. Wait for the answer of our operator (response time 3-6 hours). Next, you will receive further instructions for file recovery. - Free decryption of files as a guarantee! - Send us 3-5 encrypted files. - The total size of files must be less than 5 Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.). *** If you do not receive a reply within 6 hours, create an account on Gmail.com and try again. or just check your email spam. Attention !!! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Extracted

Path

C:\Read this message.txt

Ransom Note
*** IF YOU WANT TO GET ALL YOUR FILES BACK, FOLLOW THE INSTRUCTIONS *** No files have been deleted or copied from your computer. All your files have been encrypted with a complex algorithm. All your files have been encrypted due to a security problem with your PC. Your personal key : ---BEGIN PERSONAL KEY--- �������A2 A3 71 26 B3 31 CF CB 75 D8 F9 FB 29 AF 98 C0 A7 36 34 77 DA 35 C6 9B 9E B0 4F 99 A7 43 A7 A3 89 DB 24 01 C7 A1 EF 54 ED 22 57 00 2B F9 55 DD E9 F4 C7 F7 DF D3 3B 04 FF 6C 3D AE D0 31 21 6E D9 47 EA ED BF 9B EE C9 25 DB 11 B6 34 AA D3 34 B1 0C A3 DE B5 6C FA 78 05 B9 76 53 81 4D 41 33 FB 70 AB 2C 4F 62 2D 01 46 10 24 4C BF FF 96 14 68 31 6F 8E 80 A5 DB B3 7B 86 F1 2E F6 F5 5B 0E DA 91 8F FF 88 F8 C0 30 CC E2 A5 B9 8C 6D 76 71 08 20 13 A3 7C 90 11 6E D2 31 E3 B3 74 B2 F3 C0 91 4A D5 46 79 EB 3A 14 DA 96 35 F2 4C 5F 25 A2 71 56 1A A8 33 22 A4 6C 01 F8 A6 B5 11 1C 46 86 BB 8D 19 28 4B 8C 04 4F C1 B0 3B 50 F4 FD 42 8E 92 A6 CB 97 73 85 BE 33 04 22 7F F8 B3 BD 0D 3C 3E 2A 29 26 CE 66 EE 29 87 C2 D8 C3 2D 3F 3F 2C 44 AB EF F3 85 43 D7 58 19 FB 36 44 B2 F9 BC 3A ---END PERSONAL KEY--- What to do next to restore all your files? follow the instructions below. 1. Calm down. Pull yourself together. Everything will be fine. Follow the instructions. 2. Send to the mail [email protected] And [email protected] Your personal key. It's also worth to send your internal IP address (you can find it using the service whatismyipaddress.com). 3. Wait for the answer of our operator (response time 3-6 hours). Next, you will receive further instructions for file recovery. - Free decryption of files as a guarantee! - Send us 3-5 encrypted files. - The total size of files must be less than 5 Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.). *** If you do not receive a reply within 6 hours, create an account on Gmail.com and try again. or just check your email spam. Attention !!! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target

      765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a

    • Size

      51KB

    • MD5

      2692c25d30fcf69479ec57f07c34dfc4

    • SHA1

      ffe82e80f65d548195afb67da3d4c592d96ca3c2

    • SHA256

      765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a

    • SHA512

      4e000993d203372fee742bec8b1b5ec938e0b0d5e9b5cad4590ef0df215f465696c64d58cfabd914f91e92f81bdb37fae092758dd0e90204b67f4b66e88d6b1c

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks