Analysis
- max time kernel
164s - max time network
178s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
11/02/2022, 07:00
Static task
static1
Behavioral task
behavioral1
Sample
43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe
- Size 50KB
- Sample220211-hs2fgsdgdm
- SHA256 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7
- MD5 32a3e8753d7d8aee340e74906aad24ed
- SHA1 7c47817efce809af0d25d179d673f7dc9b413248
- SHA512 5691c1f5ea1a8ec217d9be8683eb082cfe67e8908090a41cae630d33f3a8f392d39cee01887028c7d281951cc57255954f7949fd57c1e746838736db229e141b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\HOW_TO_BACK_FILES.txt
Ransom Note
- YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��������A5 49 F6 B0 56 A1 D8 4C 2D 85 97 9A 63 3B 98 9F CD 5B BF 3D E3 4C 16 72 D8 8C 77 3D F2 CA 8E B8 A0 8F A6 49 A3 EC 38 76 88 BF 0E 9C 67 A4 8C 30 41 A5 D1 13 92 A4 D2 27 B7 D2 D6 A2 F9 DA 87 15 EB 26 DA C1 6E 4A 00 F3 22 59 29 51 B3 87 1A 4B E3 38 18 8F 2C 16 46 BF 36 D3 6D 5D 69 B9 F2 D5 9A 91 45 52 F6 B6 AE 16 01 40 B1 E3 9D 2D 23 D1 BF 07 07 62 7B 7D 9C BF F9 C5 64 28 7F F7 5F 7B BA 68 74 ED 71 B9 7F 7A 09 12 97 D0 11 C0 C9 48 77 9C D6 99 F3 D8 CD A6 3B DF 85 90 48 92 E2 DB E0 18 61 A7 8C C8 3F B6 12 C1 0F C5 DC 42 A7 4C 1F 5A 0E 56 27 CA 9E 6C 9D 9A 78 66 15 43 6C 2D 45 27 D8 5A 8B 8D 8D 7E 3E 88 C3 56 9D D4 DA 22 50 E8 AA 95 BB C2 6C D3 10 0F 27 0F 4B 5A 4B BD 41 6F 72 B8 59 CC A5 CE B5 81 D1 AB DB C7 9C 7D CF CA 57 81 EB A6 7A D1 21 66 AE 44 5A 36 5F C1 ������������
Signatures
- GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
- Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\OutCheckpoint.tiff 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File renamed C:\Users\Admin\Pictures\OutCheckpoint.tiff => C:\Users\Admin\Pictures\OutCheckpoint.tiff.Ox4444 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File renamed C:\Users\Admin\Pictures\UnlockCompare.crw => C:\Users\Admin\Pictures\UnlockCompare.crw.Ox4444 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe" 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe - Drops desktop.ini file(s) 23 IoCs
description ioc Process File opened for modification C:\Users\Public\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Public\Documents\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Public\Music\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Music\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Public\Videos\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Links\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe - Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeShutdownPrivilege 3164 svchost.exe Token: SeCreatePagefilePrivilege 3164 svchost.exe Token: SeShutdownPrivilege 3164 svchost.exe Token: SeCreatePagefilePrivilege 3164 svchost.exe Token: SeShutdownPrivilege 3164 svchost.exe Token: SeCreatePagefilePrivilege 3164 svchost.exe Token: SeSecurityPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeSecurityPrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeSecurityPrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeSecurityPrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeSecurityPrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeSecurityPrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeSecurityPrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeSecurityPrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeSecurityPrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeSecurityPrivilege 528 TiWorker.exe Token: SeBackupPrivilege 528 TiWorker.exe Token: SeRestorePrivilege 528 TiWorker.exe Token: SeSecurityPrivilege 528 TiWorker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe"C:\Users\Admin\AppData\Local\Temp\43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:528