Analysis
-
max time kernel
156s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12/02/2022, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
31e5c5f88b0f009ac26393610e3e7e331c44b093e179269fe07f2cd28ba3e72c.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
31e5c5f88b0f009ac26393610e3e7e331c44b093e179269fe07f2cd28ba3e72c.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
31e5c5f88b0f009ac26393610e3e7e331c44b093e179269fe07f2cd28ba3e72c.dll
-
Size
1.1MB
-
MD5
fdebe604c063574d890211020d657aeb
-
SHA1
c86e34e85af20fe5d7d0f0740ad95c58e0831538
-
SHA256
31e5c5f88b0f009ac26393610e3e7e331c44b093e179269fe07f2cd28ba3e72c
-
SHA512
3efebff4a7b994702a551788b0d26c11c173f12fcfe779f5d41529fb69106f510e65f6510ac10a3c54f7880191af82f041932ba143cbd3fc2a022617756b7d62
Score
10/10
Malware Config
Extracted
Path
C:\readme.txt
Family
conti
Ransom Note
All of your files are currently encrypted by CONTI strain.
As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly.
If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value.
To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge.
You can contact our team directly for further instructions through our website :
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
HTTPS VERSION :
https://contirecovery.ws
YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible.
---BEGIN ID---
XjezdRHFUimUr0tH8ArgmB2GSC70BzFRJYEeECCr4z5a0x6WoIRHtqlcNzOjkZOq
---END ID---
URLs
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.ws
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Program Files\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\desktop.ini regsvr32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\CloseUse.mpeg2 regsvr32.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.ini regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt regsvr32.exe File opened for modification C:\Program Files\PingComplete.asx regsvr32.exe File created C:\Program Files (x86)\readme.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\License.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt regsvr32.exe File opened for modification C:\Program Files\UnlockDeny.wps regsvr32.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax regsvr32.exe File created C:\Program Files\Java\readme.txt regsvr32.exe File created C:\Program Files\MSBuild\readme.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\descript.ion regsvr32.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF regsvr32.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc regsvr32.exe File created C:\Program Files (x86)\Reference Assemblies\readme.txt regsvr32.exe File opened for modification C:\Program Files\GroupNew.m4v regsvr32.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt regsvr32.exe File opened for modification C:\Program Files\desktop.ini regsvr32.exe File created C:\Program Files\Mozilla Firefox\readme.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt regsvr32.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\readme.txt regsvr32.exe File created C:\Program Files (x86)\Microsoft.NET\readme.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt regsvr32.exe File opened for modification C:\Program Files\FindGrant.mpp regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt regsvr32.exe File opened for modification C:\Program Files\StopShow.ps1xml regsvr32.exe File opened for modification C:\Program Files\TraceRepair.mov regsvr32.exe File created C:\Program Files (x86)\MSBuild\readme.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt regsvr32.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF regsvr32.exe File opened for modification C:\Program Files\7-Zip\History.txt regsvr32.exe File created C:\Program Files\Reference Assemblies\readme.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt regsvr32.exe File opened for modification C:\Program Files\TracePublish.gif regsvr32.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm regsvr32.exe File created C:\Program Files (x86)\Microsoft Analysis Services\readme.txt regsvr32.exe File created C:\Program Files (x86)\Microsoft Office\readme.txt regsvr32.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt regsvr32.exe File opened for modification C:\Program Files\WatchCheckpoint.001 regsvr32.exe File created C:\Program Files\Common Files\readme.txt regsvr32.exe File created C:\Program Files\Google\readme.txt regsvr32.exe File created C:\Program Files\Microsoft Games\readme.txt regsvr32.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt regsvr32.exe File opened for modification C:\Program Files\OpenSplit.tmp regsvr32.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log regsvr32.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files regsvr32.exe File opened for modification C:\Program Files\RestoreJoin.xml regsvr32.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini regsvr32.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt regsvr32.exe File created C:\Program Files\readme.txt regsvr32.exe File opened for modification C:\Program Files\ConnectMerge.rm regsvr32.exe File opened for modification C:\Program Files\ExitImport.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\readme.txt regsvr32.exe File created C:\Program Files\DVD Maker\readme.txt regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe 1500 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1192 wrote to memory of 1500 1192 regsvr32.exe 27 PID 1192 wrote to memory of 1500 1192 regsvr32.exe 27 PID 1192 wrote to memory of 1500 1192 regsvr32.exe 27 PID 1192 wrote to memory of 1500 1192 regsvr32.exe 27 PID 1192 wrote to memory of 1500 1192 regsvr32.exe 27 PID 1192 wrote to memory of 1500 1192 regsvr32.exe 27 PID 1192 wrote to memory of 1500 1192 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\31e5c5f88b0f009ac26393610e3e7e331c44b093e179269fe07f2cd28ba3e72c.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\31e5c5f88b0f009ac26393610e3e7e331c44b093e179269fe07f2cd28ba3e72c.dll2⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1500
-