Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
11-11-2021 07:00
Static task
static1
Behavioral task
behavioral1
Sample
37410f45bab40e0d5e8e2160b480d928c975fadbe423be884678b924d66871d2.dll
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
37410f45bab40e0d5e8e2160b480d928c975fadbe423be884678b924d66871d2.dll
Resource
win10-en-20211104
General
-
Target
37410f45bab40e0d5e8e2160b480d928c975fadbe423be884678b924d66871d2.dll
-
Size
901KB
-
MD5
8371d1c15af2ffa8111deef437997d79
-
SHA1
d4b427988b2876546c2e00329ac1b9ba3905c9b8
-
SHA256
37410f45bab40e0d5e8e2160b480d928c975fadbe423be884678b924d66871d2
-
SHA512
d09c4b72f2f9219d12cb2735a835382b1fb5c4e0f8487a5b025494a7576780c893e48f713b5986d93328fe92642ca47794d1fca95cf65c1cb1835daab17db23a
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.ws
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
regsvr32.exedescription ioc process File renamed C:\Users\Admin\Pictures\WaitRedo.tif => C:\Users\Admin\Pictures\WaitRedo.tif.MUUAZ regsvr32.exe File renamed C:\Users\Admin\Pictures\CheckpointUnpublish.tif => C:\Users\Admin\Pictures\CheckpointUnpublish.tif.MUUAZ regsvr32.exe File renamed C:\Users\Admin\Pictures\InstallLock.crw => C:\Users\Admin\Pictures\InstallLock.crw.MUUAZ regsvr32.exe File renamed C:\Users\Admin\Pictures\InvokeWrite.tif => C:\Users\Admin\Pictures\InvokeWrite.tif.MUUAZ regsvr32.exe File opened for modification C:\Users\Admin\Pictures\SearchUndo.tiff regsvr32.exe File renamed C:\Users\Admin\Pictures\SearchUndo.tiff => C:\Users\Admin\Pictures\SearchUndo.tiff.MUUAZ regsvr32.exe File renamed C:\Users\Admin\Pictures\TraceCopy.png => C:\Users\Admin\Pictures\TraceCopy.png.MUUAZ regsvr32.exe -
Drops desktop.ini file(s) 46 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\EJUJZXD4\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI regsvr32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\76WFQHVB\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\CC9LYJ78\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\B30T6PBA\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Links\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Music\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini regsvr32.exe File opened for modification C:\Program Files\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Libraries\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini regsvr32.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini regsvr32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Generic.gif regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106124.WMF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00246_.WMF regsvr32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21334_.GIF regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MSTAG.TLB regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1B.BDR regsvr32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7ES.LEX regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50F.GIF regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar regsvr32.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\readme.txt regsvr32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msadox28.tlb regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF regsvr32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR21F.GIF regsvr32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Brunei regsvr32.exe File created C:\Program Files (x86)\Common Files\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MML2OMML.XSL regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01151_.WMF regsvr32.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21340_.GIF regsvr32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RCLRPT.CFG regsvr32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt regsvr32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_center.gif regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00419_.WMF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01843_.GIF regsvr32.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152556.WMF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02009_.WMF regsvr32.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\readme.txt regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01858_.WMF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REMOTES.ICO regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml regsvr32.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02261_.WMF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPrintTemplate.html regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382967.JPG regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\SUCTION.WAV regsvr32.exe File created C:\Program Files\VideoLAN\VLC\locale\el\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Classic.dotx regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00413_.WMF regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02051_.WMF regsvr32.exe File created C:\Program Files\VideoLAN\VLC\locale\de\readme.txt regsvr32.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_es.dub regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\WATERMAR.ELM regsvr32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 396 1360 WerFault.exe regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exepid process 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 396 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1360 wrote to memory of 396 1360 regsvr32.exe WerFault.exe PID 1360 wrote to memory of 396 1360 regsvr32.exe WerFault.exe PID 1360 wrote to memory of 396 1360 regsvr32.exe WerFault.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\37410f45bab40e0d5e8e2160b480d928c975fadbe423be884678b924d66871d2.dll1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1360 -s 4642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-57-0x0000000000000000-mapping.dmp
-
memory/396-59-0x0000000001D20000-0x0000000001D21000-memory.dmpFilesize
4KB
-
memory/1360-55-0x000007FEFB831000-0x000007FEFB833000-memory.dmpFilesize
8KB
-
memory/1360-56-0x00000000004D0000-0x000000000050F000-memory.dmpFilesize
252KB