Analysis
-
max time kernel
160s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 06:54
General
-
Target
578f95ed736938c95f45db89904f7292fca9519b2f0e2ed6b3200848ca737932.exe
-
Size
53KB
-
MD5
1ed24af8523f92a06bbb53405709a2d8
-
SHA1
ee1d93efc1e2f8d7e4846f9e5880dbb987702a57
-
SHA256
578f95ed736938c95f45db89904f7292fca9519b2f0e2ed6b3200848ca737932
-
SHA512
054966e0cff1a3dc37160c3d35076ab6c3759f618ce71e369726002d18deae86824e7cf48fe97b9dc38a9f887b339c97b42d760d2eb77cb760b7bae744beba52
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<head>
<meta charset="utf-8">
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background-color: #C1AB8F;
}
.bold {
font-weight: bold;
}
.xx {
border: 1px dashed #000;
background: #E3D5F1;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">Attention! All your files are encrypted.</div>
<div class="note alert">
<ul><li>Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the original key recovery is impossible! To decrypt your files you need to buy the special software -
"AOKI DECRYPTOR"
Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.</li>
<li>If you want to restore files, write us to the e-mail:
[email protected]
In subject line write "encryption" and attach your personal ID in body of your message also attach to email 3 crypted files. (files have to be less than 10 MB)</li>
<li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
</ul>
</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>����91 3C 65 34 8F B6 F2 29 1F 86 EA B2 99 40 4E 97
6D 11 88 72 CD BA C3 7F AD DF 9B 1E D2 7A 0C 2A
71 7D CD 78 AC D4 91 CF 43 99 91 F1 8B 36 7C 32
B4 C0 E2 49 1A A3 A1 46 A7 34 7F 59 49 14 01 A1
41 C6 8A 49 88 67 C6 FE 4E 98 FD 17 E9 B7 87 3A
4C EF 18 29 3A 81 D1 5B 29 38 68 D9 84 F1 1D B6
BD 8F B3 AE 23 15 F0 7C 0C 6C B1 FD 0B 2D 87 38
9B 17 DA A9 AA 44 F0 3C 03 18 DB 77 4D D4 64 0D
CC 48 04 4C B3 2F 0D 9B 4F 0C B7 D3 03 E5 36 B1
4F 76 60 B6 24 27 3C 40 A0 2C D9 FB 82 FC C5 D8
70 6B 76 E0 59 BB E5 E7 E4 14 42 D7 EC 64 4D B0
BD B4 46 70 66 CE 32 AF BA 67 F5 E5 BF 8B E4 6B
DD 15 2F 9D 0E 5A C7 76 5C AB 97 3A DD D8 2C CB
60 27 F4 4D 7C FE 25 A5 D3 F2 7C 74 9B B1 DF BF
05 87 19 93 28 02 C2 7C CF C6 1F 96 19 F0 D2 BD
D6 BF A0 CA E9 05 65 6D BC BD 54 2E 8B EE 52 F2
</pre>
</div>
</body>
</html>��������
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 9 IoCs
-
Drops file in Windows directory 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\578f95ed736938c95f45db89904f7292fca9519b2f0e2ed6b3200848ca737932.exe"C:\Users\Admin\AppData\Local\Temp\578f95ed736938c95f45db89904f7292fca9519b2f0e2ed6b3200848ca737932.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB