Overview

overview

10

Static

static

f11724258a...d9.exe

windows7_x64

10

f11724258a...d9.exe

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    24-11-2021 10:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.exe

  • Size

    194KB

  • MD5

    31c250609693ca7450a1d79840c51057

  • SHA1

    eca2dea03f2c5eac7bbf54e1d212f0fc61d936f8

  • SHA256

    f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9

  • SHA512

    eac254d9a4950666747fad7534c815bafcdc75b6862bb442c9a4d9b4c00aedc2e9317514b7e76f5453c4f0ca55327c88e8cec743a46ccac78fcbfa3e32700424

Score
10/10
contiransomwarespywarestealer

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.ws YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- 1XOTsYKOEFHqHwWPPYpfi6QfUEK4rHVxjLeOYfZwL4AYYuRtXTJdINrIQGMGRNVQ ---END ID---
URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.ws

Signatures

  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.exe
    "C:\Users\Admin\AppData\Local\Temp\f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2704
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{19CDF45A-AB26-4CD3-A80A-DC59EDB6A247}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{19CDF45A-AB26-4CD3-A80A-DC59EDB6A247}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3992
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:428
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\readme.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Desktop\readme.txt
    MD5

    99d61a6ea8c6d6df2b07c1885461260f

    SHA1

    0d655a6c42b758ed05f88c65a11d3d66d9a46314

    SHA256

    64ce05600e8afb96aedb3c792be8f059300952b347a178f07117aec55ccb28f9

    SHA512

    f3806833419b68c4b1c5762817096da322a6d1f7af264f2b968240d6ee69fc61c5c2e82443ce593ac2077eb8d4253581b0d0268b3df6572801b5e08bfb494150

    Download Submit
  • memory/2176-115-0x0000000000000000-mapping.dmp
    Download
  • memory/3992-116-0x0000000000000000-mapping.dmp
    Download