Analysis
-
max time kernel
151s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
09-12-2022 05:01
Static task
static1
Behavioral task
behavioral1
Sample
32bd793c65117c065f48115340d6d899.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
32bd793c65117c065f48115340d6d899.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
32bd793c65117c065f48115340d6d899.exe
-
Size
50KB
-
MD5
32bd793c65117c065f48115340d6d899
-
SHA1
be86049db96ed942e32f394c5ca55b1ce16fec77
-
SHA256
1cc3b2946bb008c7f0b18225696b2e492b627725a3f4ead9ffb6e49346ca1325
-
SHA512
3a5fe1cdc94e054b8c81b0d0fa0eef22abdcd812dfdeb00c19ac8ab7e590693d78ddeb976e32b791494d30d239f4fc319b3bd5b3ac93ef59c371d6fe03dd6dc9
-
SSDEEP
768:kivuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5Gf:5eytM3alnawrRIwxVSHMweio3Yf
Score
10/10
Malware Config
Extracted
Path
C:\readme.txt
Ransom Note
Attention!
All your files, documents, photos, databases and other important files are encrypted
The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.
The server with your decryptor is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
1. Download Tor browser - https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST2GHJLMOPR
5. and open ticket
----------------------------------------------------------------------------------------
Alternate communication channel here: https://yip.su/2QstD5
��7B 7B 20 98 32 EE 73 BB 08 65 3C 8A FD C7 DF F1
22 12 A4 74 90 EC 54 7B 66 62 F2 4C DE 28 1C 79
6F B6 F6 B6 B7 19 AD CC E8 1B 41 F4 B6 0E 6E 7A
BC 2E 96 D4 41 78 CF 3D DB 80 50 54 58 F1 69 43
A3 CA A5 96 54 38 2F 27 2F 23 9E 3E BB F5 CB D3
3C E7 67 A1 F2 B2 59 5D B0 6C 66 43 F7 04 11 34
38 54 74 BC A1 ED 1E 46 E2 F8 C2 DB B0 6E 40 EE
41 06 D4 46 FC 74 E8 D5 E8 75 45 2A AF F8 74 95
32 DF 44 E5 35 29 3A 05 7F 0E 02 41 D4 69 7B BE
DD 4C 16 28 79 A9 D6 0F 75 37 F7 8C 9C F0 C3 8F
EE 42 F3 91 06 8A 85 00 37 2F 88 85 86 7A 4F 55
ED 58 27 08 41 6E CB 37 03 B7 86 A3 40 25 F9 9E
5C F5 B5 BC CE 53 65 71 75 F5 15 5D 16 64 6F BA
D7 A0 CB FD 71 0B 53 DD 2A 54 37 5D E8 F7 DA 43
D5 1D E6 7F C5 16 B7 92 C9 43 B4 B0 30 CB 1D D4
87 57 61 E7 2C 3B 5D 54 11 A6 AB 18 0B 59 F0 49
URLs
http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST2GHJLMOPR
https://yip.su/2QstD5
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GrantFind.tif => C:\Users\Admin\Pictures\GrantFind.tif.obz 32bd793c65117c065f48115340d6d899.exe File renamed C:\Users\Admin\Pictures\LimitWait.png => C:\Users\Admin\Pictures\LimitWait.png.obz 32bd793c65117c065f48115340d6d899.exe File renamed C:\Users\Admin\Pictures\NewUnblock.raw => C:\Users\Admin\Pictures\NewUnblock.raw.obz 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Pictures\ResumeEnter.tiff 32bd793c65117c065f48115340d6d899.exe File renamed C:\Users\Admin\Pictures\UseRestore.raw => C:\Users\Admin\Pictures\UseRestore.raw.obz 32bd793c65117c065f48115340d6d899.exe File renamed C:\Users\Admin\Pictures\ResumeEnter.tiff => C:\Users\Admin\Pictures\ResumeEnter.tiff.obz 32bd793c65117c065f48115340d6d899.exe File renamed C:\Users\Admin\Pictures\CloseImport.raw => C:\Users\Admin\Pictures\CloseImport.raw.obz 32bd793c65117c065f48115340d6d899.exe File renamed C:\Users\Admin\Pictures\OutCompress.raw => C:\Users\Admin\Pictures\OutCompress.raw.obz 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Pictures\PingWatch.tiff 32bd793c65117c065f48115340d6d899.exe File renamed C:\Users\Admin\Pictures\PingWatch.tiff => C:\Users\Admin\Pictures\PingWatch.tiff.obz 32bd793c65117c065f48115340d6d899.exe File renamed C:\Users\Admin\Pictures\RemoveStep.raw => C:\Users\Admin\Pictures\RemoveStep.raw.obz 32bd793c65117c065f48115340d6d899.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 32bd793c65117c065f48115340d6d899.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\32bd793c65117c065f48115340d6d899.exe" 32bd793c65117c065f48115340d6d899.exe -
Drops desktop.ini file(s) 30 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Music\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Music\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Documents\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Links\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Videos\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\desktop.ini 32bd793c65117c065f48115340d6d899.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIcons.jpg 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\HEADING.JPG 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR32F.GIF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4B.GIF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01138_.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0168644.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01842_.GIF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFINTL.DLL 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02356_.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02439_.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialMergeLetter.dotx 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMaskSmall.bmp 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG_COL.HXT 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME24.CSS 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGREPFRM.XML 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REMOTE.CFG 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14753_.GIF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0251871.WMF 32bd793c65117c065f48115340d6d899.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\readme.txt 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ReviewRouting_Init.xsn 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143749.GIF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02075_.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1036\MSO.ACL 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_K_COL.HXK 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174635.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239967.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSCOL11.INF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00110_.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL078.XML 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105414.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149018.JPG 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.KR.XML 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR27F.GIF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21335_.GIF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107288.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00199_.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00217_.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLACCT.DLL 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR13F.GIF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285792.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02400_.WMF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115866.GIF 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\ROGERS.COM.XML 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TipsImageMask.bmp 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PAPERS.INI 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll 32bd793c65117c065f48115340d6d899.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\readme.txt 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185778.WMF 32bd793c65117c065f48115340d6d899.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\readme.txt 32bd793c65117c065f48115340d6d899.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\readme.txt 32bd793c65117c065f48115340d6d899.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\SettingsInternal.zip 32bd793c65117c065f48115340d6d899.exe