Analysis
-
max time kernel
75s -
max time network
39s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-09-2021 19:35
Static task
static1
Behavioral task
behavioral1
Sample
4b2358bac7fac727d1587365e2d91660b1ed44d1be95c6ff8c61e2cb9e747f19.bin.sample.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
4b2358bac7fac727d1587365e2d91660b1ed44d1be95c6ff8c61e2cb9e747f19.bin.sample.dll
Resource
win10-en-20210920
General
-
Target
4b2358bac7fac727d1587365e2d91660b1ed44d1be95c6ff8c61e2cb9e747f19.bin.sample.dll
-
Size
230KB
-
MD5
ae1397fc1412a7d64c649dd6d9903bf7
-
SHA1
d729ace39e2bf9010b0af00309a9cf6f471c6685
-
SHA256
4b2358bac7fac727d1587365e2d91660b1ed44d1be95c6ff8c61e2cb9e747f19
-
SHA512
44c6b48c91fe5e0c58e587ded40f1bd1820a04b2a8e6b4ce9e3a2dd443d2fd96713c14e84d3b8bdc79a54a655e83d2e1aaa229fed8f5c58c4d879708236fcb96
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
regsvr32.exedescription ioc process File renamed C:\Users\Admin\Pictures\ConnectUnprotect.png => C:\Users\Admin\Pictures\ConnectUnprotect.png.EEXPL regsvr32.exe File renamed C:\Users\Admin\Pictures\EnterEdit.tif => C:\Users\Admin\Pictures\EnterEdit.tif.EEXPL regsvr32.exe File renamed C:\Users\Admin\Pictures\JoinClear.png => C:\Users\Admin\Pictures\JoinClear.png.EEXPL regsvr32.exe File renamed C:\Users\Admin\Pictures\JoinInitialize.png => C:\Users\Admin\Pictures\JoinInitialize.png.EEXPL regsvr32.exe -
Drops desktop.ini file(s) 46 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Links\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini regsvr32.exe File opened for modification C:\Program Files\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini regsvr32.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Libraries\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\desktop.ini regsvr32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPUNCT.DPV regsvr32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3 regsvr32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Maroon.css regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts.css regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01084_.WMF regsvr32.exe File created C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\readme.txt regsvr32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png regsvr32.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18217_.WMF regsvr32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt regsvr32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar regsvr32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6 regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02752U.BMP regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153305.WMF regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Groove.gif regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsImageTemplate.html regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105230.WMF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Angles.xml regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\ij regsvr32.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\readme.txt regsvr32.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_OFF.GIF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\TAB_OFF.GIF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Thatch.thmx regsvr32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099147.JPG regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285792.WMF regsvr32.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\readme.txt regsvr32.exe File created C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\ISO690Nmerical.XSL regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png regsvr32.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\readme.txt regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista regsvr32.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\readme.txt regsvr32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c regsvr32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02218_.GIF regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png regsvr32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF regsvr32.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImages.jpg regsvr32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0332364.WMF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLYER98.POC regsvr32.exe File created C:\Program Files\Java\jre7\lib\zi\readme.txt regsvr32.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384895.JPG regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\RTF_BOLD.GIF regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200521.WMF regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exepid process 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe 1400 regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4b2358bac7fac727d1587365e2d91660b1ed44d1be95c6ff8c61e2cb9e747f19.bin.sample.dll1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1400-53-0x000007FEFC271000-0x000007FEFC273000-memory.dmpFilesize
8KB