Analysis
-
max time kernel
133s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 17:20
Static task
static1
Behavioral task
behavioral1
Sample
2f76c2801b2bac498e94d68e99117c5367af97e0.dll
Resource
win10-en-20211208
General
-
Target
2f76c2801b2bac498e94d68e99117c5367af97e0.dll
-
Size
678KB
-
MD5
7ff8505ce55eaf44baf843d3683c5e39
-
SHA1
2f76c2801b2bac498e94d68e99117c5367af97e0
-
SHA256
5e54dfc50c22a8cd92c5d05598bbafc75b999b93224d900017b892a4d9f22077
-
SHA512
bf51272fcf62d9ed3d33718cb1fb707794680b65ea9dcd22f5b5cb28441e7b2423d6bfe43407b2adf4556a88058b5fbc757da6e961d57d34003f15548d2628f0
Malware Config
Extracted
C:\readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/8LijJVnUPEWEaSDvo6Ho56xzmhj8AwiSqncJYX3Hhd3hLoOajUpUdvIF4GHP69AP
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
regsvr32.exedescription ioc process File renamed C:\Users\Admin\Pictures\SuspendStep.png => C:\Users\Admin\Pictures\SuspendStep.png.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\UnprotectProtect.crw => C:\Users\Admin\Pictures\UnprotectProtect.crw.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\MergeRename.tif => C:\Users\Admin\Pictures\MergeRename.tif.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\PopResolve.raw => C:\Users\Admin\Pictures\PopResolve.raw.SACUR regsvr32.exe File opened for modification C:\Users\Admin\Pictures\ClearClose.tiff regsvr32.exe File renamed C:\Users\Admin\Pictures\ClearClose.tiff => C:\Users\Admin\Pictures\ClearClose.tiff.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\GetProtect.crw => C:\Users\Admin\Pictures\GetProtect.crw.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\OptimizeCopy.png => C:\Users\Admin\Pictures\OptimizeCopy.png.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\RequestMeasure.crw => C:\Users\Admin\Pictures\RequestMeasure.crw.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\ResumeUnprotect.raw => C:\Users\Admin\Pictures\ResumeUnprotect.raw.SACUR regsvr32.exe File opened for modification C:\Users\Admin\Pictures\CheckpointUndo.tiff regsvr32.exe File renamed C:\Users\Admin\Pictures\CheckpointUndo.tiff => C:\Users\Admin\Pictures\CheckpointUndo.tiff.SACUR regsvr32.exe -
Drops startup file 1 IoCs
Processes:
regsvr32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt regsvr32.exe -
Drops desktop.ini file(s) 32 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Links\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini regsvr32.exe File opened for modification C:\Program Files\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini regsvr32.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Documents\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI regsvr32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Libraries\desktop.ini regsvr32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\PlayStore_icon.svg regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms regsvr32.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\readme.txt regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\trdtv2r41.xsl regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\info.png regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\ui-strings.js regsvr32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\readme.txt regsvr32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\readme.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\Xusage.txt regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] regsvr32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\readme.txt regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansRegular.ttf regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar regsvr32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\ui-strings.js regsvr32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\readme.txt regsvr32.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\en-GB.pak regsvr32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reminders_18.svg regsvr32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\readme.txt regsvr32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\readme.txt regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar regsvr32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\readme.txt regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\editvideoimage.png regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\ui-strings.js regsvr32.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.dtd regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\RIPPLE.INF regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\hscroll-thumb.png regsvr32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\readme.txt regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\ui-strings.js regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms regsvr32.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\readme.txt regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\OWSHLP10.CHM regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ui-strings.js regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png regsvr32.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\readme.txt regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\ui-strings.js regsvr32.exe File created C:\Program Files\Common Files\System\msadc\readme.txt regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\end_review.gif regsvr32.exe -
Drops file in Windows directory 4 IoCs
Processes:
regsvr32.exeShellExperienceHost.exesvchost.exedescription ioc process File opened for modification C:\Windows\win.ini regsvr32.exe File created C:\Windows\rescache\_merged\4183903823\97717462.pri ShellExperienceHost.exe File created C:\Windows\rescache\_merged\4032412167\2701812693.pri ShellExperienceHost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3392 2696 WerFault.exe regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exepid process 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe 2696 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3392 WerFault.exe Token: SeBackupPrivilege 3392 WerFault.exe Token: SeDebugPrivilege 3392 WerFault.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 1236 ShellExperienceHost.exe 1236 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2628 wrote to memory of 2696 2628 regsvr32.exe regsvr32.exe PID 2628 wrote to memory of 2696 2628 regsvr32.exe regsvr32.exe PID 2628 wrote to memory of 2696 2628 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2f76c2801b2bac498e94d68e99117c5367af97e0.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2f76c2801b2bac498e94d68e99117c5367af97e0.dll2⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2696 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 20043⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
PID:1140
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:844