Overview

overview

10

Static

static

61a17892a4...4b.exe

windows7_x64

10

61a17892a4...4b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    53s
  • platform
    windows7_x64
  • resource
    win7-20220331-en
  • submitted
    29-03-2022 20:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    61a17892a491b33ce44c7c62950bdc7a4e5e14defa0e53e41d4ebdaf2ebac04b.exe

  • Size

    310KB

  • MD5

    bafabf22676cb0516d39a29e4b1f6bba

  • SHA1

    901d0dd5488f9d76021ea94c75c77b17e55ced4a

  • SHA256

    61a17892a491b33ce44c7c62950bdc7a4e5e14defa0e53e41d4ebdaf2ebac04b

  • SHA512

    e5f696a0d142cc201de54898557fac38778e8ce5e9969b3d8666bf8a5e8331b3bada65a6de17ce16a5a4cff533ccffbff09d5d949d3f2ae6db5bc632619d209b

Score
10/10
contidaveransomware

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our email [email protected] Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion HTTPS VERSION : contirecovery.best YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- r1m0powNo66txhNNT8jbLjxSeYwak8M9MWeYiUHeWKV1wjW46XyPao2FejwARuCT ---END ID---
URLs

http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion

https://contirecovery.best

Signatures

  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti
  • Dave packer 1 IoCs

    Detects executable using a packer named 'Dave' by the community, based on a string at the end.

    dave
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops desktop.ini file(s) 38 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61a17892a491b33ce44c7c62950bdc7a4e5e14defa0e53e41d4ebdaf2ebac04b.exe
    "C:\Users\Admin\AppData\Local\Temp\61a17892a491b33ce44c7c62950bdc7a4e5e14defa0e53e41d4ebdaf2ebac04b.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ADAE1393-DF90-4092-A904-A24381147848}'" delete
      2⤵
        PID:1800
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ADAE1393-DF90-4092-A904-A24381147848}'" delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:848
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D07965EF-6A2A-4F04-A796-0DDF2758DD9A}'" delete
        2⤵
          PID:1620
          • C:\Windows\System32\wbem\WMIC.exe
            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D07965EF-6A2A-4F04-A796-0DDF2758DD9A}'" delete
            3⤵
              PID:1060
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{257AA580-846B-4DF3-AF3D-EB71DAE11085}'" delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1916
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{257AA580-846B-4DF3-AF3D-EB71DAE11085}'" delete
              3⤵
                PID:812
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7B92F43E-539D-4471-B92B-6FE4F217D625}'" delete
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1328
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{90D8A32C-BB30-46D2-9415-F9CB20BF00AE}'" delete
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1728
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{90D8A32C-BB30-46D2-9415-F9CB20BF00AE}'" delete
                3⤵
                  PID:1936
              • C:\Windows\system32\cmd.exe
                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{479D3C64-906D-4805-A5AF-8BB47A9EC2BD}'" delete
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:924
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{479D3C64-906D-4805-A5AF-8BB47A9EC2BD}'" delete
                  3⤵
                    PID:2024
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4F878F1-5869-41F5-A8E2-B9652BF639B3}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1348
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{52F310AE-9E84-49A7-9BEA-BEB4FC07BDE9}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1600
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{55970A64-43E7-4AB4-9648-191BF48CDCF6}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:532
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{63EA98CA-1312-4816-922E-5F1E5A35E8F4}'" delete
                  2⤵
                    PID:1568
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{398D8D55-DE4F-44DB-A0A6-8BE33BEACE95}'" delete
                    2⤵
                      PID:2020
                      • C:\Windows\System32\wbem\WMIC.exe
                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{398D8D55-DE4F-44DB-A0A6-8BE33BEACE95}'" delete
                        3⤵
                          PID:1676
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9E0586DD-8F2B-450B-A15E-C5BBE1DA3079}'" delete
                        2⤵
                          PID:556
                        • C:\Windows\system32\cmd.exe
                          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{79D961E6-6071-4930-9E21-4F8327BE781F}'" delete
                          2⤵
                            PID:1232
                          • C:\Windows\system32\cmd.exe
                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DA0B5B71-925D-4F27-91FE-A1A7C09CFA98}'" delete
                            2⤵
                              PID:1240
                            • C:\Windows\system32\cmd.exe
                              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4255D44-FF7B-4B34-9B08-C7A299744356}'" delete
                              2⤵
                                PID:1548
                              • C:\Windows\system32\cmd.exe
                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{19C372D6-A6E9-4F6B-90B0-8FD1ED6A431E}'" delete
                                2⤵
                                  PID:1776
                                • C:\Windows\system32\cmd.exe
                                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{24EE15D5-EDED-4F0F-ADB0-362B3BE5DC24}'" delete
                                  2⤵
                                    PID:336
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1BB765B6-A1C3-4995-975A-E692C4BD3DE6}'" delete
                                    2⤵
                                      PID:1056
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1720
                                  • C:\Windows\System32\wbem\WMIC.exe
                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7B92F43E-539D-4471-B92B-6FE4F217D625}'" delete
                                    1⤵
                                      PID:1612
                                    • C:\Windows\System32\wbem\WMIC.exe
                                      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4F878F1-5869-41F5-A8E2-B9652BF639B3}'" delete
                                      1⤵
                                        PID:616
                                      • C:\Windows\System32\wbem\WMIC.exe
                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{52F310AE-9E84-49A7-9BEA-BEB4FC07BDE9}'" delete
                                        1⤵
                                          PID:1604
                                        • C:\Windows\system32\conhost.exe
                                          \??\C:\Windows\system32\conhost.exe "-631703864-168158157513274622-20073343892146584834-1098223633524736765-315338834"
                                          1⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1800
                                        • C:\Windows\System32\wbem\WMIC.exe
                                          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{55970A64-43E7-4AB4-9648-191BF48CDCF6}'" delete
                                          1⤵
                                            PID:760
                                          • C:\Windows\System32\wbem\WMIC.exe
                                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{63EA98CA-1312-4816-922E-5F1E5A35E8F4}'" delete
                                            1⤵
                                              PID:1156
                                            • C:\Windows\System32\wbem\WMIC.exe
                                              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9E0586DD-8F2B-450B-A15E-C5BBE1DA3079}'" delete
                                              1⤵
                                                PID:272
                                              • C:\Windows\System32\wbem\WMIC.exe
                                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{79D961E6-6071-4930-9E21-4F8327BE781F}'" delete
                                                1⤵
                                                  PID:564
                                                • C:\Windows\System32\wbem\WMIC.exe
                                                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DA0B5B71-925D-4F27-91FE-A1A7C09CFA98}'" delete
                                                  1⤵
                                                    PID:1700
                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4255D44-FF7B-4B34-9B08-C7A299744356}'" delete
                                                    1⤵
                                                      PID:1580
                                                    • C:\Windows\system32\conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe "-764163926-1969676294490145870193189922233219-2091619224-693783902-908184904"
                                                      1⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1620
                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{19C372D6-A6E9-4F6B-90B0-8FD1ED6A431E}'" delete
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1060
                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{24EE15D5-EDED-4F0F-ADB0-362B3BE5DC24}'" delete
                                                      1⤵
                                                        PID:1388
                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1BB765B6-A1C3-4995-975A-E692C4BD3DE6}'" delete
                                                        1⤵
                                                          PID:1108
                                                        • C:\Windows\system32\DllHost.exe
                                                          C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                          1⤵
                                                            PID:1936

                                                          Network

                                                          MITRE ATT&CK Matrix

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • memory/1796-54-0x00000000002F0000-0x0000000000325000-memory.dmp

                                                            Filesize

                                                            212KB

                                                            Download

                                                          • memory/1796-64-0x00000000002B0000-0x00000000002E3000-memory.dmp

                                                            Filesize

                                                            204KB

                                                            Download

                                                          • memory/1796-63-0x0000000075721000-0x0000000075723000-memory.dmp

                                                            Filesize

                                                            8KB

                                                            Download

                                                          • memory/1796-58-0x0000000000360000-0x0000000000395000-memory.dmp

                                                            Filesize

                                                            212KB

                                                            Download