Overview

overview

10

Static

static

491682e499...c7.exe

windows7_x64

10

491682e499...c7.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    185s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11-02-2022 06:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe

  • Size

    50KB

  • MD5

    656ee1e1c5e105e256835db00b7c6e2d

  • SHA1

    6f5340a175ea4b285787b38575a0073cd30af79f

  • SHA256

    491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7

  • SHA512

    30f22b2fd87e8fee932fc435762d210afb5cec1b694782f874d893da230f838e45e633999a1cc503b68816ca5f811d06685f2c050bf7a2da68eb23bfcbe74806

Score
10/10
globeimposterpersistenceransomware

Malware Config

Extracted

Path

C:\HOW_TO_BACK_FILES.txt

Ransom Note
YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��������2E FD 7A 10 2F 53 E1 36 C0 86 B3 EA A4 6B C8 A6 1E 53 8A 79 5B C3 F6 44 1F BD 6C 59 43 8D B3 8D 8D 5E 54 7F F0 C7 E2 B4 A6 D7 97 78 50 7B 65 23 77 B8 7E FC 63 08 B7 C0 78 92 59 1A 36 DD 8D DF 6D 61 23 2C 12 73 A5 E5 8C 38 76 2F F8 2E 72 90 A9 03 C8 C4 1D 75 1E 1D CE 52 42 F4 F2 74 35 5E 8C 15 FC 6C 3A DE 7D 1B 1F B1 E7 16 4F 21 C6 CA CF F1 C7 A2 C5 E4 33 AF 11 9E 51 11 E9 77 BE 54 CE F3 3D 5D 0B BF 20 8A 97 98 32 A4 ED 23 BC 14 EF 7F 3B E3 19 30 87 DB 31 D2 7F 89 B2 19 58 BF D9 14 E3 84 29 12 D1 2D CF 1E 70 E8 74 D4 28 D5 D3 42 0A 64 6D 65 5C 73 A2 0F 7E 2B C6 C8 84 6B 5A EC F7 E5 60 8F 51 9C BF 2B BA 6F D0 E9 66 45 D8 83 7A 3E B6 A5 49 BC 40 47 59 10 A6 E9 7D 66 C7 EA 9C 44 7C 0D 12 44 44 56 F3 7F 87 67 09 0F CD 89 10 68 D5 0F 9B C5 A5 26 17 76 C7 12 E8 AA ������������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 13 IoCs
  • Drops file in Windows directory 6 IoCs
  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe
    "C:\Users\Admin\AppData\Local\Temp\491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:2584
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4376
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3040 -s 4520
      2⤵
      • Program crash
      PID:4352
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    1⤵
    • Modifies data under HKEY_USERS
    PID:2520
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
    1⤵
      PID:4432
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 408 -p 3040 -ip 3040
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:4968
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3560
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 520 -p 3560 -ip 3560
      1⤵
        PID:640

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2520-144-0x0000025147410000-0x0000025147414000-memory.dmp

        Filesize

        16KB

        Download

      • memory/4376-132-0x00000244B57B0000-0x00000244B57C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4376-133-0x00000244B5FE0000-0x00000244B5FF0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4376-134-0x00000244B8510000-0x00000244B8514000-memory.dmp

        Filesize

        16KB

        Download