Analysis
-
max time kernel
151s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-02-2022 06:51
Static task
static1
Behavioral task
behavioral1
Sample
1114.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1114.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
1114.exe
-
Size
50KB
-
MD5
fc9ca0a85e47088d25483dd47fba3244
-
SHA1
fed2e7f2818daf55a463520ec21f337fc8679246
-
SHA256
e8e6365ddaf5b0a40250eaab09bc61904ad5818c835ae2555c36ddc380c70ece
-
SHA512
a4f8f0004cbcef618f5bad7ab26b83617f5107a176c68cbae6497e7acf4a36d7f690a1c9ab459d68d2d4b3153de2939857dee4ea8706d107294fcdfb67f2127c
Score
10/10
Malware Config
Extracted
Path
C:\read_me.txt
Family
globeimposter
Ransom Note
All your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:
----------------------------------------------------------------------------------------
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://mrv44idagzu47oktcipn6tlll6nzapi6pk3u7ehsucl4hpxon45dl4yd.onion/?ST4HYJUHGFV
| 3. Create Ticket
----------------------------------------------------------------------------------------
Note! This link is available via Tor Browser only.
------------------------------------------------------------
or
http://yip.su/2QstD5
Your ID
�������������4C C5 B1 BB C4 82 73 50 13 FA 40 DD 83 A6 AE A3
F0 AA 95 32 BC 5F E5 E4 70 7E 0D B1 82 43 29 B9
9D 30 C0 5C 8F 69 D1 3E 65 0D 01 5B 78 4A 7C 1B
EF DF 09 F1 3B D5 F0 01 AE 42 34 CE C9 28 0F 13
22 8A FE 3A 64 76 2F 81 62 47 58 90 ED FB 69 72
BD CE 79 EB 6E 76 F9 38 98 70 55 B7 BB B1 68 5E
94 56 7C 63 4A CD FA C2 6E 9E 9D 16 CB C2 62 C2
52 2C A3 76 76 A6 97 4E E7 46 E2 39 FD 69 54 B9
DA 11 06 65 4B A7 28 A7 83 35 D8 35 F7 79 83 4A
A5 C5 46 9B DF 60 F9 7A E3 E4 76 16 0A 2F 79 A6
8B 24 F1 A4 B0 84 25 44 B1 4F 31 C7 7C 79 24 05
25 23 D0 FD 98 06 9F D1 03 F6 14 EB D8 B1 D4 A3
AA 05 F2 FD 42 50 07 3B 25 21 EB 1B 27 9B 8E 49
DC 0A 67 52 E6 6F 8D 77 36 F1 5A 5B E9 3D C0 3B
44 10 6A 15 77 D4 42 9C 6D D8 FB B9 58 3D E2 97
20 5D 78 CE 84 30 84 61 84 34 22 41 C3 16 DA FA
URLs
http://mrv44idagzu47oktcipn6tlll6nzapi6pk3u7ehsucl4hpxon45dl4yd.onion/?ST4HYJUHGFV
http://yip.su/2QstD5
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\UseRestart.png => C:\Users\Admin\Pictures\UseRestart.png.mrv 1114.exe File renamed C:\Users\Admin\Pictures\DebugEdit.raw => C:\Users\Admin\Pictures\DebugEdit.raw.mrv 1114.exe File renamed C:\Users\Admin\Pictures\MoveInvoke.raw => C:\Users\Admin\Pictures\MoveInvoke.raw.mrv 1114.exe File opened for modification C:\Users\Admin\Pictures\PushCompress.tiff 1114.exe File renamed C:\Users\Admin\Pictures\PushCompress.tiff => C:\Users\Admin\Pictures\PushCompress.tiff.mrv 1114.exe File renamed C:\Users\Admin\Pictures\SaveRestore.png => C:\Users\Admin\Pictures\SaveRestore.png.mrv 1114.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 1114.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\1114.exe" 1114.exe -
Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Public\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1114.exe File opened for modification C:\Program Files (x86)\desktop.ini 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 1114.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1114.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 1114.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1114.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 1114.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1114.exe File opened for modification C:\Users\Public\Videos\desktop.ini 1114.exe File opened for modification C:\Users\Public\Documents\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 1114.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 1114.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 1114.exe File opened for modification C:\Users\Public\Music\desktop.ini 1114.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 1114.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1114.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1114.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1114.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKExcel.dll 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14516_.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239955.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FRENCH.LNG 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCHKBRD.DPV 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\DELETE.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14755_.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341559.JPG 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBORDER.XML 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01163_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292270.WMF 1114.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Earthy.gif 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\header.gif 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART6.BDR 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\BG_ADOBE.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107024.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGLISH.LNG 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR28F.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00118_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02390_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01563_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianMergeFax.Dotx 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR40F.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Horizon.thmx 1114.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Right.accdt 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ENVELOPR.DLL.IDX_DLL 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14754_.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01759_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00555_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\ACT3R.SAM 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPAPERS.INI 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01035U.BMP 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR50F.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18230_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll 1114.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\read_me.txt 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR47F.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293236.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01039_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00178_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\TAG.XSL 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00255_.WMF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTIRMV.XML 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Simple.dotx 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115866.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.SharePoint.BusinessData.Administration.Client.dll 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDBAR98.POC 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_OFF.GIF 1114.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ.DLL 1114.exe