Overview

overview

10

Static

static

1ce8a939b3...e9.exe

windows7_x64

10

1ce8a939b3...e9.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    08-05-2022 09:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1ce8a939b3e7d84c59c12dc9e1091532f4336dac533847b6533b01d9dcf494e9.exe

  • Size

    190KB

  • MD5

    2dc5a4338d438ea4e78878cff4cfe2cf

  • SHA1

    cfdd6e3a69b12d43af94cb0441db3e1ef93f74f8

  • SHA256

    1ce8a939b3e7d84c59c12dc9e1091532f4336dac533847b6533b01d9dcf494e9

  • SHA512

    32a8d6f2fa1e472aefa8cc41cb59b5b67e84d336ca35c5b1f5d2a2ad2eae5a7ba1cbfba17f75261b0220a5d896b72bb4b95c5c86a6c8bda4b9bf50463f2222fc

Score
10/10
contiransomware

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.top/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- FQ6C1V320lsGoEpDS1i4SFkTzLnOQ9vSXpwMwYdsE7CL2myTZeHVHuuqtzHQGOpB ---END ID---
URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.top/

Signatures

  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops desktop.ini file(s) 27 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ce8a939b3e7d84c59c12dc9e1091532f4336dac533847b6533b01d9dcf494e9.exe
    "C:\Users\Admin\AppData\Local\Temp\1ce8a939b3e7d84c59c12dc9e1091532f4336dac533847b6533b01d9dcf494e9.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0CB52C57-F33E-48C3-965E-DB7A91603164}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0CB52C57-F33E-48C3-965E-DB7A91603164}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4520
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4820
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    • Suspicious use of FindShellTrayWindow
    PID:2192
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
    1⤵
      PID:5084

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\readme.txt
      Filesize

      866B

      MD5

      78a15c814df271551d3e0d882a7caae6

      SHA1

      65a43e6eac21105afaf62f534bc066c8f460122d

      SHA256

      c5543d9ed561efd53666d18ce7e6fcc8bc500c8e90ee873aae1ea8615ca0405b

      SHA512

      9cca3a336d30b324eeab100d87f812e5ff2459de1177f9b4fab7513b8f1de2d0d01521f01c539b497ee498a095a807c47ff816b775b3d8095f7d7fc673dba269

      Download Submit