Analysis
-
max time kernel
161s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 06:50
General
-
Target
66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f.exe
-
Size
55KB
-
MD5
c7d02bf2230853298ebccd17f5fd54a2
-
SHA1
4b737abe273228c2d7a2656aa12f1ea591b3f10e
-
SHA256
66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f
-
SHA512
2d24f156faa09d622360b5a0e549eb7d8400d7004ea8febb88b3aa54bcf9c4a628e846bc99c9740aa30ec956dfed33b4f314ecb8f8f41eb898fc244fe9fb857e
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>���������������A4 EE 7E 7C 9C 21 6F 69 F9 52 CE D4 44 76 4F F2
3D 0F 24 A0 07 EC CB 47 11 96 B0 F8 7B AC EB F0
C4 C0 79 22 6B E2 60 A4 EC BF D0 87 BF 0C CA BC
69 E9 37 01 BB C8 08 71 A3 E6 62 EA 1F D3 9B B5
D1 A5 81 9E 16 4A 83 96 31 8B FB 33 A8 78 14 9C
2F 07 21 3E 28 A0 5D DA 07 E7 68 A9 09 AD 71 58
86 53 5E D5 A6 FB 38 A3 7D 23 34 B8 58 70 6C 21
F6 FF 9C DC 5A DF F6 A0 A1 85 AB B4 7D 4E A1 9D
F6 87 FD 30 A2 BF 24 2F FF C7 58 A0 76 E0 BE D0
03 1C 37 37 81 5A 4B 0F F1 D8 CA 86 70 32 DB F0
58 EA D4 D5 10 75 65 6C 8E 95 66 E9 83 6D 05 7F
16 7D 29 13 F0 91 D2 DF 4A FB 39 8C D3 38 57 A4
88 C7 CB A9 D6 A8 24 F4 EB FC 84 BC 80 37 86 04
C2 F2 6F 8B 68 23 47 14 06 24 CC 3B CD 8A FC 86
9A BE 61 59 1B DF F5 45 28 3E D2 89 3C 30 83 05
DE 7E BF 90 B1 40 9C 19 9C 05 9F 6A 2D F9 90 C4
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>How to quickly restore all files and protect data ?</h3>
<div class="text">
<!--text data -->
<p> Write a letter with this question to <span> [email protected]</span>.</br>
We really can help, make sure of this, attach to the letter an encrypted file (less than 5mb), and specify in the letter your personal ID (look at the beginning of this document).</p>
In the response letter you will receive a decrypted file and a complete recovery instruction.</p>
Save your time, write to <span> [email protected]</span> right now.</br>
<p>
</p>
</br>
<h3><center>Attention!</center></h3>
<ul>
<li>In one week all encrypted files will be destroyed.</li>
<li>Only [email protected] can decrypt your files</li>
<li>Attempts to self-decrypting files or run anti-virus tools will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
<li>If you have not received a response to your message for more than 12 hours, write to an alternate email address <span>[email protected]</span></li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�����������
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f.exe"C:\Users\Admin\AppData\Local\Temp\66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB