Analysis
- max time kernel
150s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
01/07/2022, 01:31
General
- Target _ing_.exe
- Size 53KB
- Sample220701-bxc55aedcr
- SHA256 e0e0c26b78f258324345886b83c8a0b6bf6b8ccdf5412c5dfdc10141932090ab
Score
10/10
Malware Config
Extracted
Path
-
C:\how_to_back_files.html
Ransom Note
- <html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="on" id="tab1" /> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <hr/> <div class="text"> <!--text data --> <center>Don't worry, you can return all your files!<br> All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.<br> The only method of recovering files is to purchase decrypt tool and unique key for you.<br> This software will decrypt all your encrypted files.</center> <br> <center>----------------------------------------------------------</center> To start the recovery process: <ul><li>Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked). <li>Send a email from your new email address to: <strong> [email protected] </strong> with your personal ID.</li> <li>In response, we will send you further instructions on decrypting your files.</li></ul> <center>---------------------------------------------------------</center> <strong>Your personal ID:</strong> <pre>������������81 53 61 1B 1E B6 51 A1 E8 C1 73 43 E3 91 91 F6 59 6C 74 10 04 13 FB 64 DF 8B 39 2E BC FC 4A 4D 20 09 67 17 DF 7B C7 16 11 B9 FD C5 69 5F 1A BF 41 E2 C9 CC 62 CA 22 6D AF 41 63 1C 63 2B 90 48 C1 B5 4E D6 00 B3 1F CA 18 27 BC D8 4F 17 F2 D3 FA E3 EF 9D BF E7 38 E9 B2 F6 F3 60 1E 38 67 AB C6 CE 86 4B DA B3 EB 85 25 02 4A 58 19 35 66 4D 42 DF 6F CA 3E 25 45 E1 3F E1 87 1C 30 B3 0E 5D F2 C3 05 36 41 12 09 F5 CE 34 99 6E 46 51 8E 2F 5E FD A6 A5 1E 56 56 D6 39 10 FD 04 45 BA CA 66 35 4D 38 AF DF 36 06 61 08 DC D2 EB A4 37 D6 7E 3B 8A B0 07 66 29 0E E1 E8 83 28 9C 1F 7B 8E F3 11 CB DA 68 56 89 E7 B4 9D 9C 64 05 0F 2B 2C C4 52 11 46 0A 14 3A A2 45 BB C6 96 60 EB F1 1F 9A 9B 0E 2A 1F FE EC 4E A5 B8 9E D8 8F 3F 88 4C 17 5A 8C BC C0 58 CF A4 97 DA E3 B6 C0 5D 7B 0A 4F </pre> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>Check the folder "Spam" when waiting for an email from us.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> [email protected] </strong></li> <li>-----------</li> <li>Q: Did not receive an answer?</li> <li>A: Check the SPAM folder.</li> <li>Q: My spam folder is empty, what should I do?</li> <li>A: Register email box to protonmail.com or cock.li and do the steps above.</li></ul> <!--text data --> </div> </div> </div> </body> </html>��������
Signatures
- GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
- Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_ing_.exe"C:\Users\Admin\AppData\Local\Temp\_ing_.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1600-130-0x0000000000400000-0x000000000040E200-memory.dmp
memory/1600-131-0x0000000000400000-0x000000000040E200-memory.dmp