Analysis
-
max time kernel
152s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 01:31
Static task
static1
Behavioral task
behavioral1
Sample
_ing_.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
_ing_.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
how_to_back_files.html
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
how_to_back_files.html
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
_ing_.exe
-
Size
53KB
-
MD5
b9a84d52093a20975d44418e9eaec631
-
SHA1
fa464b36590d93a4ec6d9f63817dd931dd1a9ac8
-
SHA256
e0e0c26b78f258324345886b83c8a0b6bf6b8ccdf5412c5dfdc10141932090ab
-
SHA512
ad7d95c59b17586f1214ad9f1696de153d0cd6e2b375efa3f93057b6ed07aba1048f71238dfb59b29b1a47fdd7eca4d846cdb00fce901d5526d2c33c1448b96d
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Don't worry, you can return all your files!<br>
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.<br>
The only method of recovering files is to purchase decrypt tool and unique key for you.<br>
This software will decrypt all your encrypted files.</center>
<br>
<center>----------------------------------------------------------</center>
To start the recovery process:
<ul><li>Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked).
<li>Send a email from your new email address to: <strong>
[email protected]
</strong> with your personal ID.</li>
<li>In response, we will send you further instructions on decrypting your files.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>������������3A ED 54 CC AD A2 0B 42 E3 64 E1 09 D5 F6 61 C5
C7 2B 85 CF 02 28 A0 B9 7E F4 D1 FA CA 18 06 54
3F 48 D3 C6 38 11 A6 08 10 3D D9 AD 2D 02 9D 43
3A AF C1 2F 79 8C E0 4B A2 BC 4B F9 D2 9C 81 3C
67 70 47 CD A4 DC DD F0 8E EA 4E 31 37 1F 33 8F
06 D4 10 F1 47 8E E9 74 DD 9A 9C 30 1C 92 67 28
12 5A 04 C7 FE 6B 28 41 12 C4 84 CA 68 DE 93 32
E3 7A 47 EA 96 F9 78 77 35 46 95 DC AF ED 95 78
EF 11 E2 81 BC AF E0 16 CD 6B F1 4B 88 F4 9D C3
7E D2 F3 6D 60 6E 41 86 B8 BA 0D F7 F9 86 56 EE
81 6A 28 1E 24 3B 7A D9 A4 16 3F E3 BE 0E AB 59
2A 2A 68 A2 E0 BE F5 DC CA E3 F5 A9 B9 95 A7 8D
B0 02 B1 FB 8E B6 2E 2C A9 BE E3 A8 93 C1 FA EA
C3 1A 39 1F 39 91 A1 97 59 74 7B C3 EF 2D 79 3B
D3 46 19 46 72 69 74 64 6D EB 21 29 37 2E D5 E8
2C E6 75 9F B8 0E 1E 36 3F 26 F0 00 E9 10 7F 17
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>Check the folder "Spam" when waiting for an email from us.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li>
<li>-----------</li>
<li>Q: Did not receive an answer?</li>
<li>A: Check the SPAM folder.</li>
<li>Q: My spam folder is empty, what should I do?</li>
<li>A: Register email box to protonmail.com or cock.li and do the steps above.</li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>��������
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
_ing_.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce _ing_.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\_ing_.exe" _ing_.exe -
Drops desktop.ini file(s) 27 IoCs
Processes:
_ing_.exedescription ioc Process File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Documents\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Videos\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Documents\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Downloads\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Desktop\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Music\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Links\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini _ing_.exe File opened for modification C:\Program Files (x86)\desktop.ini _ing_.exe File opened for modification C:\Users\Public\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Pictures\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Libraries\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Searches\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Music\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini _ing_.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Videos\desktop.ini _ing_.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini _ing_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
_ing_.exedescription ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialResume.dotx _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanMergeFax.Dotx _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBCONV.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Top.accdt _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MAPISHELL.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7cm_en.dub _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7.dll _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Form.zip _ing_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\how_to_back_files.html _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSTYLE.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GFX.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\OriginFax.Dotx _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7ge.kic _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST32.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianMergeLetter.Dotx _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\SalesReport.xltx _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.HTM _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.GIF _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\JFONT.DAT _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessData.dll _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OSPP.VBS _ing_.exe File created C:\Program Files (x86)\how_to_back_files.html _ing_.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\how_to_back_files.html _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mspub.exe.manifest _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Pitchbook.potx _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Details.accdt _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKPowerPoint.dll _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLMIME.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\LoginForm.zip _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FiveRules.potx _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DBGHELP.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCFU.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORES.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSSUPP.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe _ing_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\how_to_back_files.html _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielLetter.Dotx _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.HTM _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\msproof7.dll _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OFFOWC.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyMergeLetter.dotx _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPEDITOR.DLL _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPIRM.XML _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\oisctrl.dll _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.HTM _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSClient.Msg.dll _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSAEXP30.DLL _ing_.exe File opened for modification C:\Program Files (x86)\desktop.ini _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\VSTAProjectUI.dll _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\powerpnt.exe.manifest _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.GIF _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVZIP.DIC _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRMV.XML _ing_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE _ing_.exe