Analysis
-
max time kernel
182s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
11-02-2022 07:01
General
-
Target
41bc93b935b78f929edfaeeb0a94177244e5af8488de81c963ef0f7a182bad51.exe
-
Size
52KB
-
MD5
9681d4f6e0aef7cd9cc840ab8fa52bfb
-
SHA1
8800114de9b4718c8d6e9efa231487991a916ddb
-
SHA256
41bc93b935b78f929edfaeeb0a94177244e5af8488de81c963ef0f7a182bad51
-
SHA512
3f0bad219d44f5cee70e5fab170198071b0f903866cd8ee35479fd6d13e6d6ec21212d9bfca1918dfa368a3961c672a0f85dcbba55a965e061a6144eb8c1e1a7
Score
10/10
Malware Config
Extracted
Path
C:\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">����������7A CD A1 E2 00 25 0E 50 1E 2D 42 3D 4C BC C8 A7
3C F7 99 97 8F D5 8F 0F 3C 5B 13 1F FC 72 05 93
7D 0E D1 16 AD 6E 40 AB 3B 56 DC DC 56 79 99 59
3D 6F E7 6F FE 93 62 31 7C 3B A7 EB F2 FD 42 CB
67 21 2E 5B 68 F7 21 25 A7 A9 3B 1C E8 62 B2 6B
89 06 6C 39 1B 7E 2F B3 C9 C2 24 EB 01 6F 2D 3B
83 7C 21 0D E9 7A E8 75 5B A5 6C 41 15 FF A8 AD
2B 1A 26 4D 35 DB B2 53 49 42 8A 5F BA 24 F9 EF
8E 42 5E 05 72 81 2C F4 D1 01 78 ED 20 3F B6 21
A1 6C 66 A3 C9 48 E5 AB 60 6E CB 93 AF B6 49 4F
7A F9 82 BF 8C AC 76 4D 82 DB 1F 88 D9 BB AC 84
9B 4C 46 99 78 17 F8 18 26 C4 19 CF 0F B7 91 79
ED 73 F5 91 89 30 DF 1D A1 C1 CA 3F 42 A9 4F 64
51 CA 6F 0E 79 0C A7 5C 41 B9 10 31 71 5E DA 8D
A1 94 CD E2 98 75 3A E1 80 9B 53 F2 68 4E 52 8F
B7 BF EB 95 51 B0 FB 69 32 C2 9A 07 D3 EC 3B 40
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>CONTACT US FOR PRICE (BITCOIN) AND GET DECRYPTION SOFTWARE.</b><br><br>
<a href="mailto:[email protected]">[email protected]</a><br>
<a href="mailto:[email protected]">[email protected]</a> <hr>
</div>
<div class="text">
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>��������
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 11 IoCs
-
Drops file in Windows directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\41bc93b935b78f929edfaeeb0a94177244e5af8488de81c963ef0f7a182bad51.exe"C:\Users\Admin\AppData\Local\Temp\41bc93b935b78f929edfaeeb0a94177244e5af8488de81c963ef0f7a182bad51.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 01⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS