Overview
overview
10Static
static
8b26138a0e...e7.exe
windows7_x64
108b26138a0e...e7.exe
windows10_x64
10afc65cb796...ce.dll
windows7_x64
10afc65cb796...ce.dll
windows10_x64
10b909f69f36...a9.dll
windows7_x64
10b909f69f36...a9.dll
windows10_x64
10c57d20e273...7b.exe
windows7_x64
10c57d20e273...7b.exe
windows10_x64
10Analysis
-
max time kernel
156s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 04:24
Static task
static1
Behavioral task
behavioral1
Sample
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
b909f69f36244617ab5fc0c2d80466daf4eea3c0e85aab5060ca7f1a122758a9.dll
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
b909f69f36244617ab5fc0c2d80466daf4eea3c0e85aab5060ca7f1a122758a9.dll
Resource
win10-en-20211208
Behavioral task
behavioral7
Sample
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
Resource
win10-en-20211208
General
-
Target
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
-
Size
741KB
-
MD5
ecddcd31562620ef7b2547b98e27c29e
-
SHA1
e39bffe4dd0c9427c4a9e93f8040dd816aecba5c
-
SHA256
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce
-
SHA512
ee3727e828982ad4c6ae33ed2fca23ebf3c9135471d1922a3c15d6bdcd489bf528af4d2911239444666d2e341a9ab6782eec6c357ac2f64f14b1d5bad741fe4f
Malware Config
Extracted
C:\readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/6gWoBbavBj4ezI9TljI0sgPxGfyUWuUCPVqXxUShAFvPm8CG3fFzPBsjBr10Wliv
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
regsvr32.exedescription ioc process File renamed C:\Users\Admin\Pictures\ShowUninstall.png => C:\Users\Admin\Pictures\ShowUninstall.png.TOSQG regsvr32.exe File renamed C:\Users\Admin\Pictures\StartUnblock.tif => C:\Users\Admin\Pictures\StartUnblock.tif.TOSQG regsvr32.exe File renamed C:\Users\Admin\Pictures\StepExport.raw => C:\Users\Admin\Pictures\StepExport.raw.TOSQG regsvr32.exe File renamed C:\Users\Admin\Pictures\UnlockExit.crw => C:\Users\Admin\Pictures\UnlockExit.crw.TOSQG regsvr32.exe -
Drops desktop.ini file(s) 25 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Users\Admin\Favorites\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Links\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Videos\desktop.ini regsvr32.exe File opened for modification C:\Program Files\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Libraries\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini regsvr32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\7-Zip\descript.ion regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.VBS regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4 regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.catalog regsvr32.exe File created C:\Program Files\7-Zip\Lang\readme.txt regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini regsvr32.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL regsvr32.exe File opened for modification C:\Program Files\ReadStep.inf regsvr32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms regsvr32.exe File created C:\Program Files\VideoLAN\VLC\locale\readme.txt regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exepid process 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe 3412 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2752 wrote to memory of 3412 2752 regsvr32.exe regsvr32.exe PID 2752 wrote to memory of 3412 2752 regsvr32.exe regsvr32.exe PID 2752 wrote to memory of 3412 2752 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll2⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3412