Overview

overview

10

Static

static

1

conti.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2023 11:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    conti.exe

  • Size

    178KB

  • MD5

    8d27d0c897ce21f1036bf659fc663cf2

  • SHA1

    afe3d0fb48092aeca4dcd3989a076e87fdbe69b2

  • SHA256

    139a8bb2c5537190e747d2f651b423147018fd9a9a21bb36281d4ce1c61727c1

  • SHA512

    531873e8faaf801a447f70848969865750f41fd5ff15bd8c47015e766a9bb8cc1fbb8dcae16ddbf1e4f9dbc5750af593ef8fdcf94cd1a61efa00c7790cda4374

  • SSDEEP

    3072:/gq2DKdMbv1S/n6rHBJK3V9LBSLrKa+HQXvMES/D3Yw7yZyYpEaI:/84X/19LUPMcMEw3kTI

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files (x86)\warning !!!! Readme bl00dy Gang.txt

Ransom Note
GREETINGS FROM BL00DY RANSOMWARE GANG What happened ? Your entire company network is penetrated and encrypted. All files on servers and computers locked and not usable Dont panic All files are decryptable We will recover all your files to normal What Bl00dy Gang take / steal from your company network ? We download your company important files / documents / databases/ mails / accounts We publish it to the public if you dont cooperate . What BL00DY Gang needs from YOU ? We expect nothing except appreciating our work PAY US in this way you appreciate our work How to contact the BL00DY Gang for ransom negotiations ? filedecryptionsupport@msgsafe.io Telegram hall of shame , where all company private data will be PUBLISHED?? https://t.me/bl00dy_Ransomware_Gang What Quarantees ? we are not a politically motivated group and we do not need anything other than your money. If you pay, we provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We will help protect your company from any other attacks ; we will give you tips to secure company network We always keep our promises. !!! BEWARE !!! If you have Backups and try to restore from backups . All entire company files / databases / everything will be posted online DON'T try to rename or modify encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! - Don't try because you will damage all the files Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Do not report to Police or FBI , they dont care about your business .They will tell you not to pay and you will lose all your files. Recovery Company Cannot help You . things will get rather worse . speak for yourself.
Emails

filedecryptionsupport@msgsafe.io

URLs

https://t.me/bl00dy_Ransomware_Gang

Signatures

  • Modifies extensions of user files 12 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\conti.exe
    "C:\Users\Admin\AppData\Local\Temp\conti.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D06468C0-784B-44D3-AEE1-8B78F6221555}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D06468C0-784B-44D3-AEE1-8B78F6221555}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3844
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:904
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\warning !!!! Readme bl00dy Gang.txt
    1⤵
      PID:4936
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4592

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\warning !!!! Readme bl00dy Gang.txt
        Filesize

        1KB

        MD5

        8452263586a59f3c0d48b2490bd11f97

        SHA1

        2e144eb3cec2b43b80b0771af81e81f62b49bcd9

        SHA256

        239b6e678c94a409058ed84cac9b07f5880fdea1ab18af6090825bd9d78107ac

        SHA512

        53ba3f24bed5544f5b09ef55e90fd8219fb694f9c4b5c330ffbd078307a488c3a4f33b940c7a8644f9799f8bec8624d51029b8e6950de431ce2de2c599ea2ede

        Download Submit
      • C:\Users\Public\Desktop\warning !!!! Readme bl00dy Gang.txt
        Filesize

        1KB

        MD5

        8452263586a59f3c0d48b2490bd11f97

        SHA1

        2e144eb3cec2b43b80b0771af81e81f62b49bcd9

        SHA256

        239b6e678c94a409058ed84cac9b07f5880fdea1ab18af6090825bd9d78107ac

        SHA512

        53ba3f24bed5544f5b09ef55e90fd8219fb694f9c4b5c330ffbd078307a488c3a4f33b940c7a8644f9799f8bec8624d51029b8e6950de431ce2de2c599ea2ede

        Download Submit