Overview

overview

10

Static

static

3

2025-03-05...er.exe

windows7-x64

10

2025-03-05...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 21:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-05_6c360d684799cd00bb11e0331ada1027_globeimposter.exe

  • Size

    54KB

  • MD5

    6c360d684799cd00bb11e0331ada1027

  • SHA1

    be1dae6e24bf3070de9dbf55036181796e32bb28

  • SHA256

    3a6fcfcdaa2e90c617ebaf63fdf821956e890a188793b6dc88081deb31e2907f

  • SHA512

    aed13d5f3a87bcbf99b760ec8bb73b6cebeb74b6f9ec188644cb998d7a5357732388d6097dbf0849180004f26ca414b420956d63cba978742553b8da2ac57cc5

  • SSDEEP

    1536:OweytM3alnawrRIwxVSHMweio3/VuAY3:jey23alnaEIN/W/VjY3

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <style type="text/css"> body { background-color: #252525; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FFD700; background: #1C1A1B; } .letter { color: #FFD700; font-weight: 600 } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #1C1A1B; color: #F1EADA; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #F1EADA; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #1C1A1B; color: #F1EADA; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #1C1A1B; color: #E29F12; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head"><h3>Your personal ID</h3></div> <div class="identi"> <pre><span class="letter">�������������B3 ED 3D 1A 8D 24 5D 61 C3 0A C1 F5 E7 AF 94 97 B7 83 E2 A6 E2 85 24 4C F1 67 02 AC F5 A4 D0 E6 82 A0 EA 88 09 D8 20 BD E7 D7 6B 71 BD E9 CF F2 82 6A CA 34 CB 33 5F DD 0E D9 93 9E 2B 63 C2 45 98 0B 3A 94 B4 E4 9D 51 89 6D 70 B5 04 06 8C C4 81 24 55 B3 8E FA A3 DD 20 E8 56 6F CD 05 B9 A8 38 CE A0 C2 DD D9 4C D3 51 17 4C D7 B7 B9 97 1F 51 1D 10 FC 5A E8 E7 84 BC BE 83 45 E4 55 7D 73 B5 7E 12 E1 55 5E A7 41 B2 23 E9 7D AB 90 44 B4 43 42 CF CD C5 C1 E4 19 5E 07 8F AF D9 44 5A 39 94 35 B4 31 E5 9C 5D EC 38 C4 F2 55 48 EF 58 C5 FB AC 16 00 63 30 33 0B A2 73 0D 42 80 A1 BE AE 34 F5 D2 68 48 F8 8C F1 7E D6 3B 1F 9B 6D 4F 5A C6 66 F5 E6 C2 DD 91 A5 16 4C 43 56 7D 18 5B 41 DD 12 D0 80 AF 06 89 14 E2 B1 9E 92 CB 07 4B 75 D3 74 02 AC 44 59 86 74 74 1C EE C4 F1 78 66 D3 </span><p></p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input name="tabs" checked="checked" id="tab1" type="radio"> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>? Your files are encrypted! ?</h1> <h3> To decrypt, follow the instructions below. </h3> <br> <div class="text"> <!--text data --> To recover data you need decryptor.<br> To get the decryptor you should:<br> <p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br> (Or alternate mail <span class="letter">[email protected]</span>)</p><p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files<p></p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.<br> <p> <hr color="#FFD700"> <center><b><p style="color: #FFD700;">MOST IMPORTANT!!!</p></center> <center><p style="color: #FFD700;"> You can not decrypt your files cheaper than we offer you. You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE. No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center> <hr color="#FFD700"> <ul> <li>Only [email protected] can with a guarantee decrypt your files </li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> <!--text data --> </div> <!--tab--> </body></html>��������������
Emails

[email protected]</span><br>

class="letter">[email protected]</span>)</p><p>

[email protected]

[email protected]</li>
URLs

http-equiv="Content-Type"

Signatures

  • Renames multiple (9005) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 30 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-05_6c360d684799cd00bb11e0331ada1027_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-05_6c360d684799cd00bb11e0331ada1027_globeimposter.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-03-05_6c360d684799cd00bb11e0331ada1027_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-22591836-1183090055-1220658180-1000\desktop.ini
    Filesize

    1KB

    MD5

    692cca7da0f9d291d4e4e63184a40154

    SHA1

    16164a2fdcb001e71501c3e056fcf14ac074819d

    SHA256

    26e3bc58b682334fb7105b7e25c6a83410cd30494bf1a30260e4ccdff9855e31

    SHA512

    758ae2655f86b7fa4bbb218f62cdd02f83d6513c5c92528ec1fb1f7211ae0999d4b15b71ae1b36490ce34014eb77d29df162948dc376f3c9e18a43e744f54525

    Download Submit

  • C:\Users\Public\Pictures\how_to_back_files.html
    Filesize

    5KB

    MD5

    e5d280fc67cf8d0b5a3fdb425566db87

    SHA1

    37a5ca9fd4d0aea8eda427808de6103dd43b37ef

    SHA256

    ed7b8c27afdb51a4fd521923746715cba17e26097f28d3bc587c04e73e5f8f2e

    SHA512

    8f3ae4840f95fbc83138307bab4b2e7604196219c33f7146ecb3b8c094938fe6f91e76723d0aed92ae2b9016d73699581073270e08fb01883538db1fa20cfddb

    Download Submit

  • memory/828-0-0x0000000000400000-0x000000000040E400-memory.dmp

    Filesize

    57KB

    Download

  • memory/828-1651-0x0000000000400000-0x000000000040E400-memory.dmp

    Filesize

    57KB

    Download