Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 08:02
Static task
static1
Behavioral task
behavioral1
Sample
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe
-
Size
195KB
-
MD5
9656b98b10d645f1850030f461acdf7b
-
SHA1
f2253855fa2d400c92f819c6ffec73281ec7232f
-
SHA256
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e
-
SHA512
17016e6d348761865c2c5fa82b94c94604cd819dc4ce0dad5ba2800e16d070eeb7ba261a68d37d4530adacdb955e0bfac42019ac432b1a22b60488f6387a1021
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
Processes:
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exedescription ioc process File created C:\Program Files\Common Files\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\MoveUnregister.fon 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\LimitCompress.jpg 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\UnprotectLimit.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\EnableLock.wvx 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\PingExit.gif 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\MountSave.dib 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\GrantUnprotect.mp2 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\SubmitExit.temp 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\SuspendEnter.vsdm 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\VideoLAN\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Common Files\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\RenameBlock.mov 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\License.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\Java\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\MSBuild\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\CheckpointClose.vsdm 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\SearchConvert.ttc 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\SwitchCompare.vbs 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\CloseResolve.wmf 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\LockSelect.pub 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\Microsoft Office\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\ThinAppXManifest.xml 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\StartConnect.bmp 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\FileSystemMetadata.xml 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\UnprotectPush.pcx 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\Mozilla Firefox\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exepid process 3524 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe 3524 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 4152 vssvc.exe Token: SeRestorePrivilege 4152 vssvc.exe Token: SeAuditPrivilege 4152 vssvc.exe Token: SeIncreaseQuotaPrivilege 3540 WMIC.exe Token: SeSecurityPrivilege 3540 WMIC.exe Token: SeTakeOwnershipPrivilege 3540 WMIC.exe Token: SeLoadDriverPrivilege 3540 WMIC.exe Token: SeSystemProfilePrivilege 3540 WMIC.exe Token: SeSystemtimePrivilege 3540 WMIC.exe Token: SeProfSingleProcessPrivilege 3540 WMIC.exe Token: SeIncBasePriorityPrivilege 3540 WMIC.exe Token: SeCreatePagefilePrivilege 3540 WMIC.exe Token: SeBackupPrivilege 3540 WMIC.exe Token: SeRestorePrivilege 3540 WMIC.exe Token: SeShutdownPrivilege 3540 WMIC.exe Token: SeDebugPrivilege 3540 WMIC.exe Token: SeSystemEnvironmentPrivilege 3540 WMIC.exe Token: SeRemoteShutdownPrivilege 3540 WMIC.exe Token: SeUndockPrivilege 3540 WMIC.exe Token: SeManageVolumePrivilege 3540 WMIC.exe Token: 33 3540 WMIC.exe Token: 34 3540 WMIC.exe Token: 35 3540 WMIC.exe Token: 36 3540 WMIC.exe Token: SeIncreaseQuotaPrivilege 3540 WMIC.exe Token: SeSecurityPrivilege 3540 WMIC.exe Token: SeTakeOwnershipPrivilege 3540 WMIC.exe Token: SeLoadDriverPrivilege 3540 WMIC.exe Token: SeSystemProfilePrivilege 3540 WMIC.exe Token: SeSystemtimePrivilege 3540 WMIC.exe Token: SeProfSingleProcessPrivilege 3540 WMIC.exe Token: SeIncBasePriorityPrivilege 3540 WMIC.exe Token: SeCreatePagefilePrivilege 3540 WMIC.exe Token: SeBackupPrivilege 3540 WMIC.exe Token: SeRestorePrivilege 3540 WMIC.exe Token: SeShutdownPrivilege 3540 WMIC.exe Token: SeDebugPrivilege 3540 WMIC.exe Token: SeSystemEnvironmentPrivilege 3540 WMIC.exe Token: SeRemoteShutdownPrivilege 3540 WMIC.exe Token: SeUndockPrivilege 3540 WMIC.exe Token: SeManageVolumePrivilege 3540 WMIC.exe Token: 33 3540 WMIC.exe Token: 34 3540 WMIC.exe Token: 35 3540 WMIC.exe Token: 36 3540 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.execmd.exedescription pid process target process PID 3524 wrote to memory of 3552 3524 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 3524 wrote to memory of 3552 3524 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 3552 wrote to memory of 3540 3552 cmd.exe WMIC.exe PID 3552 wrote to memory of 3540 3552 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken