Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 09:51
Static task
static1
Behavioral task
behavioral1
Sample
fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe
-
Size
195KB
-
MD5
912f6ba823937d9f1f3b0cef3f5c4986
-
SHA1
42ab240af3bded9cabe5338ac812b81d39862726
-
SHA256
fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864
-
SHA512
1338386cb15ad88ee9505bfc71388bc46d70c7fb1d5ce1312dd2cbe156f99b6ef2b8c1ca3a7f9ab95d0670892a1e340a51df995adc60f617cd90c173e7ab83f2
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
Processes:
fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\lv.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\CompareClose.raw fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\UseRemove.au3 fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files\Uninstall Information\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\CheckpointRevoke.css fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\FileSystemMetadata.xml fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files (x86)\Microsoft.NET\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\SubmitResize.css fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files (x86)\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files\Microsoft Office 15\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files\Reference Assemblies\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\InstallProtect.wmx fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\TestDisable.dwg fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files (x86)\MSBuild\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\WatchStart.emf fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\ThinAppXManifest.xml fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\StepHide.xltm fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\AppXManifest.xml fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\ConvertClear.reg fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\SendUninstall.wm fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\UpdateWait.mhtml fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files\MSBuild\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\ApproveStart.contact fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\WaitRestart.3g2 fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files\Google\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files\Mozilla Firefox\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\UndoClose.DVR-MS fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\descript.ion fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\DenyBlock.xlsm fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\ImportMount.wdp fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File created C:\Program Files\Microsoft Office\readme.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\CompleteSend.wmx fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\OpenClear.mhtml fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\RestartUndo.edrwx fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe File opened for modification C:\Program Files\7-Zip\History.txt fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exepid process 2056 fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe 2056 fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 2676 vssvc.exe Token: SeRestorePrivilege 2676 vssvc.exe Token: SeAuditPrivilege 2676 vssvc.exe Token: SeIncreaseQuotaPrivilege 2356 WMIC.exe Token: SeSecurityPrivilege 2356 WMIC.exe Token: SeTakeOwnershipPrivilege 2356 WMIC.exe Token: SeLoadDriverPrivilege 2356 WMIC.exe Token: SeSystemProfilePrivilege 2356 WMIC.exe Token: SeSystemtimePrivilege 2356 WMIC.exe Token: SeProfSingleProcessPrivilege 2356 WMIC.exe Token: SeIncBasePriorityPrivilege 2356 WMIC.exe Token: SeCreatePagefilePrivilege 2356 WMIC.exe Token: SeBackupPrivilege 2356 WMIC.exe Token: SeRestorePrivilege 2356 WMIC.exe Token: SeShutdownPrivilege 2356 WMIC.exe Token: SeDebugPrivilege 2356 WMIC.exe Token: SeSystemEnvironmentPrivilege 2356 WMIC.exe Token: SeRemoteShutdownPrivilege 2356 WMIC.exe Token: SeUndockPrivilege 2356 WMIC.exe Token: SeManageVolumePrivilege 2356 WMIC.exe Token: 33 2356 WMIC.exe Token: 34 2356 WMIC.exe Token: 35 2356 WMIC.exe Token: 36 2356 WMIC.exe Token: SeIncreaseQuotaPrivilege 2356 WMIC.exe Token: SeSecurityPrivilege 2356 WMIC.exe Token: SeTakeOwnershipPrivilege 2356 WMIC.exe Token: SeLoadDriverPrivilege 2356 WMIC.exe Token: SeSystemProfilePrivilege 2356 WMIC.exe Token: SeSystemtimePrivilege 2356 WMIC.exe Token: SeProfSingleProcessPrivilege 2356 WMIC.exe Token: SeIncBasePriorityPrivilege 2356 WMIC.exe Token: SeCreatePagefilePrivilege 2356 WMIC.exe Token: SeBackupPrivilege 2356 WMIC.exe Token: SeRestorePrivilege 2356 WMIC.exe Token: SeShutdownPrivilege 2356 WMIC.exe Token: SeDebugPrivilege 2356 WMIC.exe Token: SeSystemEnvironmentPrivilege 2356 WMIC.exe Token: SeRemoteShutdownPrivilege 2356 WMIC.exe Token: SeUndockPrivilege 2356 WMIC.exe Token: SeManageVolumePrivilege 2356 WMIC.exe Token: 33 2356 WMIC.exe Token: 34 2356 WMIC.exe Token: 35 2356 WMIC.exe Token: 36 2356 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.execmd.exedescription pid process target process PID 2056 wrote to memory of 1920 2056 fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe cmd.exe PID 2056 wrote to memory of 1920 2056 fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe cmd.exe PID 1920 wrote to memory of 2356 1920 cmd.exe WMIC.exe PID 1920 wrote to memory of 2356 1920 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.bin.sample.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken