Analysis
-
max time kernel
164s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
08-12-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe
Resource
win10-en-20211208
General
-
Target
c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe
-
Size
195KB
-
MD5
8ee4f79d2528c93dfa1cd731ca9d9135
-
SHA1
7b90e3fdb90847ec1459aeb51daafe2063febe77
-
SHA256
c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1
-
SHA512
572471afb4a2c8b6aa910acf3b4aef0b4125484304067bb0f24126fd70d05d702fcfb06d3436ac2ff9d61287122d19796e3f6ac58698ca2ccb5b0d84f95de62c
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
Processes:
c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exedescription ioc process File created C:\Program Files\Microsoft Office 15\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\CopySwitch.3gp2 c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files\Microsoft Office\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files\Mozilla Firefox\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files (x86)\Microsoft.NET\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\7z.sfx c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files (x86)\Google\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files\Common Files\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\SelectRestore.jpg c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files\Java\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files (x86)\Common Files\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\SubmitStep.iso c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\descript.ion c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files\Uninstall Information\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\RestartSet.csv c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\NewBlock.xsl c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\UninstallRepair.mid c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\ThinAppXManifest.xml c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files\7-Zip\Lang\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\DismountWrite.otf c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files (x86)\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\SaveUninstall.mpeg c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\PopStep.gif c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\License.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\AssertInitialize.dib c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File created C:\Program Files (x86)\MSBuild\readme.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\MountReceive.search-ms c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe File opened for modification C:\Program Files\GetDeny.vstm c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exepid process 2784 c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe 2784 c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 3972 vssvc.exe Token: SeRestorePrivilege 3972 vssvc.exe Token: SeAuditPrivilege 3972 vssvc.exe Token: SeIncreaseQuotaPrivilege 1036 WMIC.exe Token: SeSecurityPrivilege 1036 WMIC.exe Token: SeTakeOwnershipPrivilege 1036 WMIC.exe Token: SeLoadDriverPrivilege 1036 WMIC.exe Token: SeSystemProfilePrivilege 1036 WMIC.exe Token: SeSystemtimePrivilege 1036 WMIC.exe Token: SeProfSingleProcessPrivilege 1036 WMIC.exe Token: SeIncBasePriorityPrivilege 1036 WMIC.exe Token: SeCreatePagefilePrivilege 1036 WMIC.exe Token: SeBackupPrivilege 1036 WMIC.exe Token: SeRestorePrivilege 1036 WMIC.exe Token: SeShutdownPrivilege 1036 WMIC.exe Token: SeDebugPrivilege 1036 WMIC.exe Token: SeSystemEnvironmentPrivilege 1036 WMIC.exe Token: SeRemoteShutdownPrivilege 1036 WMIC.exe Token: SeUndockPrivilege 1036 WMIC.exe Token: SeManageVolumePrivilege 1036 WMIC.exe Token: 33 1036 WMIC.exe Token: 34 1036 WMIC.exe Token: 35 1036 WMIC.exe Token: 36 1036 WMIC.exe Token: SeIncreaseQuotaPrivilege 1036 WMIC.exe Token: SeSecurityPrivilege 1036 WMIC.exe Token: SeTakeOwnershipPrivilege 1036 WMIC.exe Token: SeLoadDriverPrivilege 1036 WMIC.exe Token: SeSystemProfilePrivilege 1036 WMIC.exe Token: SeSystemtimePrivilege 1036 WMIC.exe Token: SeProfSingleProcessPrivilege 1036 WMIC.exe Token: SeIncBasePriorityPrivilege 1036 WMIC.exe Token: SeCreatePagefilePrivilege 1036 WMIC.exe Token: SeBackupPrivilege 1036 WMIC.exe Token: SeRestorePrivilege 1036 WMIC.exe Token: SeShutdownPrivilege 1036 WMIC.exe Token: SeDebugPrivilege 1036 WMIC.exe Token: SeSystemEnvironmentPrivilege 1036 WMIC.exe Token: SeRemoteShutdownPrivilege 1036 WMIC.exe Token: SeUndockPrivilege 1036 WMIC.exe Token: SeManageVolumePrivilege 1036 WMIC.exe Token: 33 1036 WMIC.exe Token: 34 1036 WMIC.exe Token: 35 1036 WMIC.exe Token: 36 1036 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.execmd.exedescription pid process target process PID 2784 wrote to memory of 3500 2784 c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe cmd.exe PID 2784 wrote to memory of 3500 2784 c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe cmd.exe PID 3500 wrote to memory of 1036 3500 cmd.exe WMIC.exe PID 3500 wrote to memory of 1036 3500 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\c49584e33e2fa854cc80114ff467f862260afe79199ccbe4d96b7542a3cd87d1.bin.sample.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B662981-1382-4EE1-B62A-610BFEE02635}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B662981-1382-4EE1-B62A-610BFEE02635}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken