Overview

overview

10

Static

static

3

2025-03-05...er.exe

windows7-x64

10

2025-03-05...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 21:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter.exe

  • Size

    53KB

  • MD5

    c6a8f1bad2dd8e9c25b4f172a3d6c907

  • SHA1

    ac461efd37d5c032c5ec0f312fcd628358fc7e3b

  • SHA256

    1e72089c6aedcc8dc25edce3dcc021aa53e8f3fcf72fc3f4c98657b542f3fad8

  • SHA512

    48dfe1985c34571cd5da0e23d6ec4b28e810afed132b5fc44311ae06788d9b68ac6710188caecdc8167b72463e93f60ea28f87f4c55f0ad0a43a14e7d7c2233b

  • SSDEEP

    768:qHTzvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5f8Y:qHLeytM3alnawrRIwxVSHMweio3xp

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="on" id="tab1" /> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <hr/> <div class="text"> <!--text data --> <center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br> Without a secret key stored with us, the restoration of your files is impossible</center> <br> <center>----------------------------------------------------------</center> You will be able to restore files so: <ul><li>To contact us by e-mail: <strong> [email protected] </strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li> <li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li> <li>You pay and confirm payment.</li> <li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul> <center>---------------------------------------------------------</center> <strong>Your personal ID:</strong> <pre>������20 78 B2 8D 12 7F 78 CF 1B AF 4B 96 DA C4 54 7D AB 98 A3 0B 8D CD 12 D5 6D 13 4B D2 CC CE 17 D0 FA 87 2F BC BC 0D 06 CD 97 8F 66 30 37 40 C4 62 13 60 35 65 23 71 41 0E 68 7A D0 B6 18 44 24 46 C6 9F C7 9D FF 55 05 78 3E 7C 56 06 4A DE AE FB 61 8A 55 F2 30 67 23 67 C8 F5 84 3F 2C 3B 8E 21 7F 95 1E 44 37 CE AF DF 56 EB B7 F5 E6 D4 6A 9E 8C EF 7E E5 96 05 74 F3 1A 6F 0A 51 67 C6 73 1B 76 89 70 EC 2B 94 43 38 1E 07 C2 D3 A6 BE ED 25 1B E2 1F 6A 86 17 EC 28 93 76 B4 F5 51 03 FA D2 29 E1 66 FC 15 32 9F 0C 09 9E 4C 34 1B 37 62 7A 0E 39 F8 1D 74 B8 A0 4F EC E2 BB 90 6D D7 DC 9D C9 D0 30 A9 6F F6 58 23 56 B4 C3 4D 8A 5E F5 20 7F C3 5C F3 F2 6F 4A 53 ED 4E 1F 7E 33 51 D7 EF FF 45 BC 33 1C 9C AB DA C9 81 5C D3 58 FE A6 6A A4 13 8E CB 3E 0E 51 C5 76 31 2A F7 81 D8 9B 5B </pre> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> [email protected] </strong></li></ul> <!--text data --> </div> </div> </div> </body> </html>�����������

Signatures

  • Renames multiple (8992) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 30 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1874072718-2205492803-118941907-1000\desktop.ini
    Filesize

    1KB

    MD5

    081239c64e613cb3afe1057f94bc882f

    SHA1

    8e14e6d438f6feb9340e046c6adf2ad571110023

    SHA256

    776cb5d2d1ecac9601384135a94fa195f4962b827b6a828317a40469d9f12557

    SHA512

    3874807b0c87e98ab4d00300d2e5190366110dbedc4a80d4a5dfa3194e223532adce23812063d5407eeba7d579ea180cb46e7ac19f379d61dd72a1ac0ce9b106

    Download Submit

  • C:\Users\Public\Pictures\how_to_back_files.html
    Filesize

    4KB

    MD5

    6906099afba851eff3d32f90a682a125

    SHA1

    c017709a57fce6bbe322e1c22077de5fbeaa88e6

    SHA256

    465ac244de16c41cfcc20eb3d5325767800a9f148f20eeccafdfd39649403d4e

    SHA512

    c965d2d3716b4cd88a785b49ac9736c76eaf84d30eb343e6ed961f8cbbecf1444a5bd1a157ea9c2f2aedc5259c6a0272ee8bc405f1f4f8f829b768c74f7e0f4f

    Download Submit

  • memory/3664-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/3664-1486-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download