Analysis
- max time kernel
170s - max time network
178s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
11/02/2022, 06:52
General
- Target 5efffde4b6f82ee79f7fe14d3bd879a9e82d22d14865ef9b30ece56e5acf85fb.exe
- Size 55KB
- Sample220211-hm64sacab9
- SHA256 5efffde4b6f82ee79f7fe14d3bd879a9e82d22d14865ef9b30ece56e5acf85fb
Score
10/10
Malware Config
Extracted
Path
-
C:\how_to_back_files.html
Ransom Note
- <html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #303030; } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��5D 14 6E 98 5A 01 2C 94 A3 B8 BE 7C 2E 29 D1 97 81 37 9B 86 53 76 39 4E 34 8A AD A1 7A 4F 37 B5 64 F2 37 F6 3D 91 59 C1 42 33 2C 47 42 64 5C C4 24 7E B5 B7 73 65 CA E1 9E 5B 62 3C C4 B1 57 5F 9B 86 F0 1C 93 DE 2C 53 64 D5 ED 3C C2 E9 DE 4E 35 31 97 95 35 98 A0 86 97 2A 1D 8F 88 49 77 33 EC 41 2A AF 9C 5C EB D2 DF AA D9 4E 2B 66 26 5B 28 83 7D C8 E2 05 77 2D 3E 21 4A 7D DE E1 D0 4D D0 30 7B 96 0C 60 6B AB A2 20 A0 05 89 7C CB DA 7E 37 4D 39 D0 09 5E A4 D2 F5 4B 8F C0 22 F9 10 83 43 44 34 7D 2C 4A 45 7A 1A 2F 72 9F FC F8 7A A1 47 D4 F6 AE E8 14 64 D6 75 90 04 E3 EF EA 8C 5A 48 46 59 A3 34 48 F7 DD BF 11 1C F5 A8 D7 4C B3 AD 41 BB 89 FA 4A 58 5A EB 55 85 BE 77 9C 41 74 27 21 A5 E8 C3 C8 60 2E 97 87 48 34 A9 B0 22 8F 5F E5 11 50 25 EA A3 C6 BB F7 47 A7 E2 CA E9 </p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>☣ Your files are encrypted! ☣</h1> <hr/> <h3> ⬇ To decrypt, follow the instructions below. ⬇ </h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br> (Or alternate mail <font color="FF0000"> [email protected] </font>)<p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected], will decrypt your files.</p></center> <hr color=red> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> �������������
Emails
Signatures
- GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 9 IoCs
- Drops file in Windows directory 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5efffde4b6f82ee79f7fe14d3bd879a9e82d22d14865ef9b30ece56e5acf85fb.exe"C:\Users\Admin\AppData\Local\Temp\5efffde4b6f82ee79f7fe14d3bd879a9e82d22d14865ef9b30ece56e5acf85fb.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1952-133-0x0000019A59560000-0x0000019A59570000-memory.dmp
memory/1952-134-0x0000019A59B20000-0x0000019A59B30000-memory.dmp
memory/1952-135-0x0000019A5C190000-0x0000019A5C194000-memory.dmp