Overview

overview

10

Static

static

3

9527cdac7f...18.exe

windows7-x64

10

9527cdac7f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 14:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9527cdac7fc502e825e6a83f601d8352_JaffaCakes118.exe
  • Size 50KB
  • Sample240604-rm4s4aae94
  • SHA256 6cf11f4d901e8c183ed473dec7673954464d4e9b4516017f53f56ebda7beafce
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Public\Videos\HOW_TO_BACK_FILES.txt

Ransom Note
  • YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��������8F FD C9 A5 6E 3C 3F 0B A5 12 47 E9 AD 21 31 DE 93 0F DC D3 FE F4 B4 A7 37 6E 62 D3 A4 A8 FB 19 94 1C F7 90 B3 31 B0 7B 94 2B FA 93 E6 04 64 4D 6F E0 16 52 4A 86 05 3E 7B 2F BD AD 30 04 E3 5B 38 2A 7A 7E FA 2C 2E B4 E7 1E ED FD 2C 48 78 11 CF 2B D1 73 50 3A AC 01 A9 1D 5C 92 C7 C6 F6 46 48 14 D4 F1 90 58 A5 4B 09 98 33 A4 E2 C3 76 E1 4E 71 66 55 74 05 63 38 A1 D2 21 63 9A EC 09 DA 60 B0 89 34 FB F9 C6 AD 8B 70 94 61 80 50 35 DA E7 E9 19 33 8A 43 62 80 81 89 B7 32 B0 AF D4 E5 84 DA E1 0A 2A FE 2B FF 43 39 CB 89 D0 73 99 C9 8C 58 BA 2B 26 44 E4 E4 01 14 C3 B9 94 7C BC 5B 03 19 03 43 23 8C CE 40 80 CD E5 20 4C F2 55 39 6B 04 2F 11 42 03 BF 43 74 6F C3 DE AE C4 C9 5F 33 0D F3 8B 2F D5 26 3C B2 AB E3 17 70 5C 08 8C EE 05 D1 83 F3 78 14 DA 57 DC EB 38 2F A3 FB 0E ������������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Renames multiple (4611) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 28 IoCs
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9527cdac7fc502e825e6a83f601d8352_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9527cdac7fc502e825e6a83f601d8352_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:636
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:544

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          HOW_TO_BACK_FILES.txt
          • Path C:\Users\Public\Videos\HOW_TO_BACK_FILES.txt
          • Size 1KB
          • SHA256 dc3c332c33e0d7f3aabddd0ef1ee0972f988151197d397c75fd2435574da37c8
          • MD5 SHA1 SHA512
          Submit Download

          memory/636-0-0x0000000000400000-0x000000000040D600-memory.dmp
          Download

          memory/636-884-0x0000000000400000-0x000000000040D600-memory.dmp
          Download