Overview

overview

10

Static

static

MFC_Stub.exe

windows7_x64

10

MFC_Stub.exe

windows10_x64

10

Analysis

  • max time kernel
    96s
  • max time network
    72s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    01-11-2021 09:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MFC_Stub.exe

  • Size

    639KB

  • MD5

    24095d5f0fb8533c72508fbecd40b516

  • SHA1

    8203863af49219e132241d0ce4b4cee0d66c7fed

  • SHA256

    41c56e92efd01a553d0faf39ccb440c7e84d32531335c262572d6a01bf7f70c8

  • SHA512

    0e22c86923d439d54f917320b0f6f4602d3f6c0ac1aa3f702e48a55f24e3cbf198fce3c989d37e525e2eba9afe8a0eb60e3c15b2af662ee7fece7557a2f594b7

Score
10/10
contiransomwarespywarestealer

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.ws YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- P9naBpvFModYOUO6KOdT1qyyFZuneeqjUZoYykxu8avGxV1rxugIPn13Yg1147un ---END ID---
URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.ws

Signatures

  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MFC_Stub.exe
    "C:\Users\Admin\AppData\Local\Temp\MFC_Stub.exe"
    1⤵
    • Drops startup file
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4628
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4496
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4376
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\readme.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:1340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Desktop\readme.txt
    MD5

    b04d96037907659b3408a42999d962b6

    SHA1

    60c94ca67e26125d077eba8f9aa95a992bb5270f

    SHA256

    a021523cfba50d5d80b983b663fafae79882d3321747a7df2eb7408f6520bd07

    SHA512

    cec34e60291499f3be4bc39be91d353f024b900d3ac33b579e6cac7280fd91bcbfd0d7817a1b77668bd8b864c00c14f9922e8091d595fd3d0cae3472b0ee7be2

    Download Submit
  • memory/4264-115-0x00000000013A0000-0x00000000013D4000-memory.dmp
    Filesize

    208KB

    Download
  • memory/4496-117-0x0000000000000000-mapping.dmp
    Download
  • memory/4628-116-0x0000000000000000-mapping.dmp
    Download