Analysis
-
max time kernel
155s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
15-02-2022 19:51
Static task
static1
Behavioral task
behavioral1
Sample
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe
Resource
win10v2004-en-20220113
General
-
Target
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe
-
Size
195KB
-
MD5
c684ea612f487efd1f4088dc126cc83d
-
SHA1
95ad974c8e2ecd5bcb49872b86ea358ae307d32c
-
SHA256
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c
-
SHA512
d76f900a1e9ae8bfd4afe7ad1fd9dfb15b30d2873f93afb17567b2ff9e1af9444252213aded05484c51f645911819f378245b1edf4a2d12153b02672a35d8863
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
Processes:
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\bn.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\TraceSend.M2TS f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\ResetEnter.odt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\RestartAssert.ocx f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\7z.sfx f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\GroupDisconnect.aiff f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\RestoreTrace.dwfx f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Common Files\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Microsoft.NET\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\RenameSelect.7z f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DisableCompress.mht f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Microsoft Office 15\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\ExitSearch.wma f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\NewBlock.wdp f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Java\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\FindInvoke.png f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\VideoLAN\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\7-Zip\Lang\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\AddStop.cr2 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Internet Explorer\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\AssertRead.jpeg f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Microsoft Office\ThinAppXManifest.xml f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\LockBackup.pdf f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\ConvertFromReset.mht f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\MoveRedo.tif f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\AssertConnect.ppt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\BlockInstall.avi f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\History.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Microsoft Office\FileSystemMetadata.xml f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe -
Drops file in Windows directory 8 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exepid process 420 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe 420 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 4896 vssvc.exe Token: SeRestorePrivilege 4896 vssvc.exe Token: SeAuditPrivilege 4896 vssvc.exe Token: SeIncreaseQuotaPrivilege 2768 WMIC.exe Token: SeSecurityPrivilege 2768 WMIC.exe Token: SeTakeOwnershipPrivilege 2768 WMIC.exe Token: SeLoadDriverPrivilege 2768 WMIC.exe Token: SeSystemProfilePrivilege 2768 WMIC.exe Token: SeSystemtimePrivilege 2768 WMIC.exe Token: SeProfSingleProcessPrivilege 2768 WMIC.exe Token: SeIncBasePriorityPrivilege 2768 WMIC.exe Token: SeCreatePagefilePrivilege 2768 WMIC.exe Token: SeBackupPrivilege 2768 WMIC.exe Token: SeRestorePrivilege 2768 WMIC.exe Token: SeShutdownPrivilege 2768 WMIC.exe Token: SeDebugPrivilege 2768 WMIC.exe Token: SeSystemEnvironmentPrivilege 2768 WMIC.exe Token: SeRemoteShutdownPrivilege 2768 WMIC.exe Token: SeUndockPrivilege 2768 WMIC.exe Token: SeManageVolumePrivilege 2768 WMIC.exe Token: 33 2768 WMIC.exe Token: 34 2768 WMIC.exe Token: 35 2768 WMIC.exe Token: 36 2768 WMIC.exe Token: SeIncreaseQuotaPrivilege 2768 WMIC.exe Token: SeSecurityPrivilege 2768 WMIC.exe Token: SeTakeOwnershipPrivilege 2768 WMIC.exe Token: SeLoadDriverPrivilege 2768 WMIC.exe Token: SeSystemProfilePrivilege 2768 WMIC.exe Token: SeSystemtimePrivilege 2768 WMIC.exe Token: SeProfSingleProcessPrivilege 2768 WMIC.exe Token: SeIncBasePriorityPrivilege 2768 WMIC.exe Token: SeCreatePagefilePrivilege 2768 WMIC.exe Token: SeBackupPrivilege 2768 WMIC.exe Token: SeRestorePrivilege 2768 WMIC.exe Token: SeShutdownPrivilege 2768 WMIC.exe Token: SeDebugPrivilege 2768 WMIC.exe Token: SeSystemEnvironmentPrivilege 2768 WMIC.exe Token: SeRemoteShutdownPrivilege 2768 WMIC.exe Token: SeUndockPrivilege 2768 WMIC.exe Token: SeManageVolumePrivilege 2768 WMIC.exe Token: 33 2768 WMIC.exe Token: 34 2768 WMIC.exe Token: 35 2768 WMIC.exe Token: 36 2768 WMIC.exe Token: SeIncreaseQuotaPrivilege 4736 WMIC.exe Token: SeSecurityPrivilege 4736 WMIC.exe Token: SeTakeOwnershipPrivilege 4736 WMIC.exe Token: SeLoadDriverPrivilege 4736 WMIC.exe Token: SeSystemProfilePrivilege 4736 WMIC.exe Token: SeSystemtimePrivilege 4736 WMIC.exe Token: SeProfSingleProcessPrivilege 4736 WMIC.exe Token: SeIncBasePriorityPrivilege 4736 WMIC.exe Token: SeCreatePagefilePrivilege 4736 WMIC.exe Token: SeBackupPrivilege 4736 WMIC.exe Token: SeRestorePrivilege 4736 WMIC.exe Token: SeShutdownPrivilege 4736 WMIC.exe Token: SeDebugPrivilege 4736 WMIC.exe Token: SeSystemEnvironmentPrivilege 4736 WMIC.exe Token: SeRemoteShutdownPrivilege 4736 WMIC.exe Token: SeUndockPrivilege 4736 WMIC.exe Token: SeManageVolumePrivilege 4736 WMIC.exe Token: 33 4736 WMIC.exe Token: 34 4736 WMIC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.execmd.execmd.exedescription pid process target process PID 420 wrote to memory of 2332 420 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 420 wrote to memory of 2332 420 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 2332 wrote to memory of 2768 2332 cmd.exe WMIC.exe PID 2332 wrote to memory of 2768 2332 cmd.exe WMIC.exe PID 420 wrote to memory of 1960 420 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 420 wrote to memory of 1960 420 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1960 wrote to memory of 4736 1960 cmd.exe WMIC.exe PID 1960 wrote to memory of 4736 1960 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe"C:\Users\Admin\AppData\Local\Temp\f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{17C5A010-80A0-4F9A-836F-BFCB14B6316C}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{17C5A010-80A0-4F9A-836F-BFCB14B6316C}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E9B5643F-8908-41A9-879A-BF3F65E24DF9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E9B5643F-8908-41A9-879A-BF3F65E24DF9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
PID:4584
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
PID:4836