Overview

overview

10

Static

static

765986adf5...6a.exe

windows7_x64

10

765986adf5...6a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    174s
  • max time network
    202s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11-02-2022 06:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a.exe

  • Size

    51KB

  • MD5

    2692c25d30fcf69479ec57f07c34dfc4

  • SHA1

    ffe82e80f65d548195afb67da3d4c592d96ca3c2

  • SHA256

    765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a

  • SHA512

    4e000993d203372fee742bec8b1b5ec938e0b0d5e9b5cad4590ef0df215f465696c64d58cfabd914f91e92f81bdb37fae092758dd0e90204b67f4b66e88d6b1c

Score
10/10
globeimposterpersistenceransomware

Malware Config

Extracted

Path

C:\Read this message.txt

Ransom Note
*** IF YOU WANT TO GET ALL YOUR FILES BACK, FOLLOW THE INSTRUCTIONS *** No files have been deleted or copied from your computer. All your files have been encrypted with a complex algorithm. All your files have been encrypted due to a security problem with your PC. Your personal key : ---BEGIN PERSONAL KEY--- �������A2 A3 71 26 B3 31 CF CB 75 D8 F9 FB 29 AF 98 C0 A7 36 34 77 DA 35 C6 9B 9E B0 4F 99 A7 43 A7 A3 89 DB 24 01 C7 A1 EF 54 ED 22 57 00 2B F9 55 DD E9 F4 C7 F7 DF D3 3B 04 FF 6C 3D AE D0 31 21 6E D9 47 EA ED BF 9B EE C9 25 DB 11 B6 34 AA D3 34 B1 0C A3 DE B5 6C FA 78 05 B9 76 53 81 4D 41 33 FB 70 AB 2C 4F 62 2D 01 46 10 24 4C BF FF 96 14 68 31 6F 8E 80 A5 DB B3 7B 86 F1 2E F6 F5 5B 0E DA 91 8F FF 88 F8 C0 30 CC E2 A5 B9 8C 6D 76 71 08 20 13 A3 7C 90 11 6E D2 31 E3 B3 74 B2 F3 C0 91 4A D5 46 79 EB 3A 14 DA 96 35 F2 4C 5F 25 A2 71 56 1A A8 33 22 A4 6C 01 F8 A6 B5 11 1C 46 86 BB 8D 19 28 4B 8C 04 4F C1 B0 3B 50 F4 FD 42 8E 92 A6 CB 97 73 85 BE 33 04 22 7F F8 B3 BD 0D 3C 3E 2A 29 26 CE 66 EE 29 87 C2 D8 C3 2D 3F 3F 2C 44 AB EF F3 85 43 D7 58 19 FB 36 44 B2 F9 BC 3A ---END PERSONAL KEY--- What to do next to restore all your files? follow the instructions below. 1. Calm down. Pull yourself together. Everything will be fine. Follow the instructions. 2. Send to the mail [email protected] And [email protected] Your personal key. It's also worth to send your internal IP address (you can find it using the service whatismyipaddress.com). 3. Wait for the answer of our operator (response time 3-6 hours). Next, you will receive further instructions for file recovery. - Free decryption of files as a guarantee! - Send us 3-5 encrypted files. - The total size of files must be less than 5 Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.). *** If you do not receive a reply within 6 hours, create an account on Gmail.com and try again. or just check your email spam. Attention !!! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 20 IoCs
  • Drops file in Windows directory 7 IoCs
  • Program crash 3 IoCs
  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a.exe
    "C:\Users\Admin\AppData\Local\Temp\765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:1040
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1048
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4256
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4256 -s 4552
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:5040
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    1⤵
    • Modifies data under HKEY_USERS
    PID:1964
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
    1⤵
      PID:3668
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 404 -p 4256 -ip 4256
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:992
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3600
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 3600 -s 3808
        2⤵
        • Program crash
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3220
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 412 -p 3600 -ip 3600
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:4020
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4024
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 4024 -s 3892
        2⤵
        • Program crash
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3900
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 408 -p 4024 -ip 4024
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:1736
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3972
    • C:\Windows\system32\werfault.exe
      werfault.exe /hc /shared Global\9ebaac1edfd24751af9ed9a67b46fafe /t 4524 /p 4024
      1⤵
        PID:704

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1048-130-0x0000028CA5B30000-0x0000028CA5B40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1048-131-0x0000028CA5B90000-0x0000028CA5BA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1048-132-0x0000028CA8880000-0x0000028CA8884000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1964-136-0x00000246305E0000-0x00000246305E4000-memory.dmp

        Filesize

        16KB

        Download