Analysis
-
max time kernel
168s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 06:52
General
-
Target
5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875.exe
-
Size
55KB
-
MD5
9d18249b677fbc70d5d7280884ee4aba
-
SHA1
fce7f8dca532c5a7c442edd6803fdcabaa4218ca
-
SHA256
5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875
-
SHA512
d71f8930081e171bb53d7b187a34b4ccf58dc00a0dd1f7d4a438b1a11cb0c362d30eb9fd7ef2ba9317d86348970e79f3552435d8fc38563cf74e9a517641ba8d
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #FFFFFF;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #FFFFFFF;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #FFFFFF;
color: #000000;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #000000;
background: #000000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #FFFFFFF;
color: #000000;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #000000;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>����������4E 89 4E AE C0 15 81 D3 87 7E 76 75 1D C3 3F 65
9D 92 40 FE B6 E1 9A DB 80 F7 4A B2 3E 60 6E 8B
40 1D 1B BA 07 75 DE 89 91 C2 75 89 58 FC 3D E0
C7 8B 55 FE 9A C4 68 13 63 DC 04 27 64 8C 11 C0
60 D5 6E 09 41 63 00 BE 58 21 5E B4 C8 1A 8F 6D
A2 5A 37 36 8A D4 71 A3 49 24 04 95 6F F0 B8 AB
0F 7B CD 94 1F BB FE 03 F1 09 1B 1F 94 9C DB 05
42 E9 AF 73 0C 7A 4C B4 3B 88 9F 2F 2F E5 19 55
E5 44 02 07 21 D8 11 6B F3 E9 EA 62 B4 6F 7E 53
D6 B5 1F 43 BE 2D 49 AC EF 19 D3 4C 47 22 C5 03
5F 1D AC 1A E3 ED 30 58 40 34 4F B0 28 9F 65 1B
09 55 61 A2 31 53 A2 81 C5 22 55 25 99 A0 FD 93
9B 02 C5 25 35 EE E2 F8 96 A2 0A B2 03 BF 65 4A
17 50 E6 70 12 7C 39 1F 6F 2A 12 3B 4B 88 95 67
AD 1C EB 0F DC D4 23 1E 5C 75 24 28 E7 D1 A8 4B
C0 28 21 7A 6D 26 C0 1A DB 61 FF B5 5D E8 69 1E
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<br/>
<div class="text">
<!--text data -->
Data recovery requires a decoder.</br>
To get the decoder, you must:</br>
<p>1. Send us an emaill:<span> [email protected] </span>.</p>
In the letter include your personal identifier (written at the beginning of this document)
and the external IP address of the device on which the encrypted files are stored.</p>
2. We will send you instructions on how to pay the decryption and after payment,
you will receive a decoder.
<p>* We can decrypt one file as evidence that we have a decoder. <br/>Send 1 test file (it must be an image or a text file)
to the email address: <span> [email protected]<span>. <br/>We will provide you with a decrypted file.<p>
3.Send a copy of the letter to the second email address: <span>[email protected]<span>
<br/>
<br/>
<center>Attention!</center> <br/>
<ul>
<li>Only we can decrypt your files</li>
<li>Do not try to uninstall the program or run antivirus tools</li>
<li>Attempts to self-decode the files will lead to the loss of your data</li>
<li>If you did not receive a response from us, check the spam or try using a different email address and email us again.</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�������
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875.exe"C:\Users\Admin\AppData\Local\Temp\5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB