Analysis
-
max time kernel
148s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
03-11-2021 15:00
Static task
static1
Behavioral task
behavioral1
Sample
17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
Resource
win10-en-20210920
General
-
Target
17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
-
Size
194KB
-
MD5
f05d144d8921004f1c082c88acbaefa4
-
SHA1
d8959168b7bb5b22cd146789d1c0be199320de7d
-
SHA256
17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1
-
SHA512
e18e2742889ad767804b5770be35b4dafa5f91a43a517b3d71ee29d6ed6f34dc46f2515dfd3144a51e85e05f46f7ea2b59c0851b5965411628fd9e17c4647b72
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.ws
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exedescription ioc process File renamed C:\Users\Admin\Pictures\EnterUnblock.png => C:\Users\Admin\Pictures\EnterUnblock.png.NKDCT 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File renamed C:\Users\Admin\Pictures\UnprotectRequest.raw => C:\Users\Admin\Pictures\UnprotectRequest.raw.NKDCT 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe -
Drops startup file 1 IoCs
Processes:
17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\selector.js 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyDrop32x32.gif 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\plugin.js 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-ui.jar 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\sat_logo_2x.png 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msadomd28.tlb 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\ui-strings.js 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\PREVIEW.GIF 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\SLATE.ELM 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning@3x.png 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\ui-strings.js 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete@2x.png 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Google\CrashReports\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files\Java\jre1.8.0_66\lib\applet\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\he-il\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ui-strings.js 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\SearchEmail.png 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Internet Explorer\images\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity@4x.png 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster2x.jpg 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File created C:\Program Files\VideoLAN\VLC\locale\da\readme.txt 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exepid process 4048 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe 4048 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 4312 vssvc.exe Token: SeRestorePrivilege 4312 vssvc.exe Token: SeAuditPrivilege 4312 vssvc.exe Token: SeIncreaseQuotaPrivilege 4460 WMIC.exe Token: SeSecurityPrivilege 4460 WMIC.exe Token: SeTakeOwnershipPrivilege 4460 WMIC.exe Token: SeLoadDriverPrivilege 4460 WMIC.exe Token: SeSystemProfilePrivilege 4460 WMIC.exe Token: SeSystemtimePrivilege 4460 WMIC.exe Token: SeProfSingleProcessPrivilege 4460 WMIC.exe Token: SeIncBasePriorityPrivilege 4460 WMIC.exe Token: SeCreatePagefilePrivilege 4460 WMIC.exe Token: SeBackupPrivilege 4460 WMIC.exe Token: SeRestorePrivilege 4460 WMIC.exe Token: SeShutdownPrivilege 4460 WMIC.exe Token: SeDebugPrivilege 4460 WMIC.exe Token: SeSystemEnvironmentPrivilege 4460 WMIC.exe Token: SeRemoteShutdownPrivilege 4460 WMIC.exe Token: SeUndockPrivilege 4460 WMIC.exe Token: SeManageVolumePrivilege 4460 WMIC.exe Token: 33 4460 WMIC.exe Token: 34 4460 WMIC.exe Token: 35 4460 WMIC.exe Token: 36 4460 WMIC.exe Token: SeIncreaseQuotaPrivilege 4460 WMIC.exe Token: SeSecurityPrivilege 4460 WMIC.exe Token: SeTakeOwnershipPrivilege 4460 WMIC.exe Token: SeLoadDriverPrivilege 4460 WMIC.exe Token: SeSystemProfilePrivilege 4460 WMIC.exe Token: SeSystemtimePrivilege 4460 WMIC.exe Token: SeProfSingleProcessPrivilege 4460 WMIC.exe Token: SeIncBasePriorityPrivilege 4460 WMIC.exe Token: SeCreatePagefilePrivilege 4460 WMIC.exe Token: SeBackupPrivilege 4460 WMIC.exe Token: SeRestorePrivilege 4460 WMIC.exe Token: SeShutdownPrivilege 4460 WMIC.exe Token: SeDebugPrivilege 4460 WMIC.exe Token: SeSystemEnvironmentPrivilege 4460 WMIC.exe Token: SeRemoteShutdownPrivilege 4460 WMIC.exe Token: SeUndockPrivilege 4460 WMIC.exe Token: SeManageVolumePrivilege 4460 WMIC.exe Token: 33 4460 WMIC.exe Token: 34 4460 WMIC.exe Token: 35 4460 WMIC.exe Token: 36 4460 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.execmd.exedescription pid process target process PID 4048 wrote to memory of 4580 4048 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe cmd.exe PID 4048 wrote to memory of 4580 4048 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe cmd.exe PID 4580 wrote to memory of 4460 4580 cmd.exe WMIC.exe PID 4580 wrote to memory of 4460 4580 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe"C:\Users\Admin\AppData\Local\Temp\17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken