conti | 2452cf5c6fccf361fa27131d9b261a60253eef8b96e6e2f524c85beea6488bd0 | Triage

Sharing

General

Target

2452cf5c6fccf361fa27131d9b261a60253eef8b96e6e2f524c85beea6488bd0
Size

101KB
Sample

220306-eexctshhg6
MD5

2b24eadfb55237e39781bd1e4dd713c5
SHA1

96f8d00c2b0e2cb89c508da9fc4993edfb5a997e
SHA256

2452cf5c6fccf361fa27131d9b261a60253eef8b96e6e2f524c85beea6488bd0
SHA512

d2a0ebee63fb96acdab2aad39988e41fea597edbd5741dd0d25a422b201b9ad2173c23b358e0b7d5365d54004db924fab05c1e75dce601a58bf96384e8930606

Score

10^/10

conti ransomware

Malware Config

Targets

- Target
  
  2452cf5c6fccf361fa27131d9b261a60253eef8b96e6e2f524c85beea6488bd0
- Size
  
  101KB
- MD5
  
  2b24eadfb55237e39781bd1e4dd713c5
- SHA1
  
  96f8d00c2b0e2cb89c508da9fc4993edfb5a997e
- SHA256
  
  2452cf5c6fccf361fa27131d9b261a60253eef8b96e6e2f524c85beea6488bd0
- SHA512
  
  d2a0ebee63fb96acdab2aad39988e41fea597edbd5741dd0d25a422b201b9ad2173c23b358e0b7d5365d54004db924fab05c1e75dce601a58bf96384e8930606
Score

10^/10

conti ransomware
- Conti Ransomware
  Ransomware generally thought to be a successor to Ryuk.
  ransomware conti
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

contiransomware

behavioral2

contiransomware