Analysis
-
max time kernel
161s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
11-02-2022 06:58
General
-
Target
48afe1124e7d7336f9361e3b51059e61f163b6ca03e79719e54ea6d61673c459.exe
-
Size
55KB
-
MD5
9016b5425b6ad4a5e99d5cce74b2e0ba
-
SHA1
a102e519b1c3e04cc6bd342fa65e958820c764c4
-
SHA256
48afe1124e7d7336f9361e3b51059e61f163b6ca03e79719e54ea6d61673c459
-
SHA512
9b3ba3957e286e7e4288bf6dd5a04f314d30854c293052bd770543f3fd8913682f433a94bf7290a238cfd70cce3aa98bbd95817053d70a733bbbd512dc15b220
Score
10/10
Malware Config
Extracted
Path
C:\restore_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>�������������82 BB 77 DE BA 03 03 18 62 F6 D9 1B CB BC C8 8A
2B CE 1E CE F0 49 A3 15 70 70 F5 B8 46 C5 CF F8
7A 4D 53 3D B8 96 82 85 0C 9D BB 36 47 F8 D5 88
38 92 0F 58 63 26 02 A6 ED E5 9A 52 DD 3E CF 73
B3 75 FC 44 C2 C6 1E B5 89 74 E5 8D 87 8F D3 7A
A3 54 53 D9 22 D6 89 57 65 AF 79 5C 0B A6 49 29
0B C8 A7 DA 33 F7 77 32 6F EB 2D 1F 54 32 27 D1
02 76 9E FD 32 1A AB 5D F4 2D 1E 1B 8A E6 D5 17
E2 24 D5 DC FB 6B 92 F9 95 8F D4 4E 4F 19 4F B8
28 CC 9C C4 2A 88 11 35 86 37 9F BD 5F 4F B6 4B
8B 7A DB 7A 09 31 83 A8 94 B6 89 81 C5 18 E1 A8
C3 8D 10 D4 DE 95 9F E0 69 A6 29 74 29 B2 98 CA
BB 89 54 F5 C8 4E 27 FD 46 46 0D 2B D8 40 FC 36
32 D0 5B E3 DF 30 ED BA 60 D0 83 B0 C3 9F 5E E8
34 FE EF B1 5E E6 C7 08 D4 2A 3E E0 02 D4 80 71
C4 36 CF 7A 31 5E 00 63 10 4A 48 C5 83 93 E9 5F
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>How to restore all files ?</h3>
<div class="text">
<!--text data -->
<p> Write a letter with this question to <span> [email protected]</span>.</br>
We really can help, make sure of this, attach to the letter an encrypted file (less than 5mb), in the letter include your personal ID (look at the beginning of this document).</p>
In the response letter you will receive a decrypted file and a complete recovery instruction.</p>
Save your time, write to <span> [email protected]</span> right now.</br>
<p>
</p>
</br>
<h3><center>Attention!</center></h3>
<ul>
<li>Only [email protected] can decrypt your files</li>
<li>Attempts to self-decrypting files or run anti-virus tools will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
<li>If you have not received a response to your message for more than 12 hours, write to an alternate email address <span>[email protected]</span></li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�����
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 21 IoCs
-
Drops file in Windows directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 47 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\48afe1124e7d7336f9361e3b51059e61f163b6ca03e79719e54ea6d61673c459.exe"C:\Users\Admin\AppData\Local\Temp\48afe1124e7d7336f9361e3b51059e61f163b6ca03e79719e54ea6d61673c459.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS