Analysis
-
max time kernel
40s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2024 18:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Conti.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
300 seconds
General
-
Target
Conti.exe
-
Size
185KB
-
MD5
7076f9674bc42536d1e0e2ca80d1e4f6
-
SHA1
854485ee63e5a399fffe150f04cd038d6a5490ef
-
SHA256
ebeca2df24a55c629cf0ce0d4b703ed632819d8ac101b1b930ec666760036124
-
SHA512
71c507108cc0c8b5609076672bd0b64a42c015995fe7220aa97e273c1754e63271edb06b284f4fc01b71a4751c1bcac0f572339e94ff0fd538dc0250caa9181a
-
SSDEEP
3072:+qS7gtGIeq8KxrvRp1MImcZeuLaxugfCJsOlq8WkJK0BOog/Tt3onM9kHpOBae4f:zS7gtyuzFxm16axugfqlMw5g5BkOdSlr
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\R3ADM3.txt
Family
conti
Ransom Note
All of your files are currently encrypted by CONTI ransomware.
If you try to use any additional recovery software - the files might be damaged or lost.
To make sure that we REALLY CAN recover data - we offer you to decrypt samples.
You can contact us for further instructions through our website :
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
HTTPS VERSION :
https://contirecovery.info
YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP.
---BEGIN ID---
V8gTskvaU8gGgzzk0qC2sM90noCXm1AgvCkADBk9JhxwjahEd2MSBLQ5sgBZOEkq
---END ID---
URLs
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.info
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (7313) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\R3ADM3.txt Conti.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
description ioc Process File opened for modification C:\Users\Public\Pictures\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Music\desktop.ini Conti.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Conti.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Conti.exe File opened for modification C:\Program Files\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Conti.exe File opened for modification C:\Users\Public\Music\desktop.ini Conti.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Conti.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Conti.exe File opened for modification C:\Users\Public\Documents\desktop.ini Conti.exe File opened for modification C:\Users\Public\Libraries\desktop.ini Conti.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Conti.exe File opened for modification C:\Program Files (x86)\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Conti.exe File opened for modification C:\Users\Public\Videos\desktop.ini Conti.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Conti.exe File opened for modification C:\Users\Public\desktop.ini Conti.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Links\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Conti.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Conti.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini Conti.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md Conti.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\te.pak.DATA Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\ui-strings.js Conti.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\R3ADM3.txt Conti.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar Conti.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\en-US\R3ADM3.txt Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms Conti.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\R3ADM3.txt Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_link_18.svg Conti.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\R3ADM3.txt Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms Conti.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\R3ADM3.txt Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reminders_18.svg Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\ui-strings.js Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\ui-strings.js Conti.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\R3ADM3.txt Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\RIPPLE.INF Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBCN6.CHM Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\ui-strings.js Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\ui-strings.js Conti.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\R3ADM3.txt Conti.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\R3ADM3.txt Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\ui-strings.js Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms Conti.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\eu.pak Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\organize_poster.jpg Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FRSCRIPT.TTF Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTCORSVA.TTF Conti.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ja.pak Conti.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\R3ADM3.txt Conti.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Edge.dat.DATA Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql90.xsl Conti.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\R3ADM3.txt Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms Conti.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrome.7z Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\selector.js Conti.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\R3ADM3.txt Conti.exe File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc Conti.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo Conti.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\R3ADM3.txt Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg Conti.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.17\R3ADM3.txt Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\ui-strings.js Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql2000.xsl Conti.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\R3ADM3.txt Conti.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\meta-index Conti.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md Conti.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_radio_unselected_18.svg Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms Conti.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms Conti.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\R3ADM3.txt Conti.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\R3ADM3.txt Conti.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\R3ADM3.txt Conti.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 8900 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe 4900 Conti.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 5104 vssvc.exe Token: SeRestorePrivilege 5104 vssvc.exe Token: SeAuditPrivilege 5104 vssvc.exe Token: SeIncreaseQuotaPrivilege 4056 WMIC.exe Token: SeSecurityPrivilege 4056 WMIC.exe Token: SeTakeOwnershipPrivilege 4056 WMIC.exe Token: SeLoadDriverPrivilege 4056 WMIC.exe Token: SeSystemProfilePrivilege 4056 WMIC.exe Token: SeSystemtimePrivilege 4056 WMIC.exe Token: SeProfSingleProcessPrivilege 4056 WMIC.exe Token: SeIncBasePriorityPrivilege 4056 WMIC.exe Token: SeCreatePagefilePrivilege 4056 WMIC.exe Token: SeBackupPrivilege 4056 WMIC.exe Token: SeRestorePrivilege 4056 WMIC.exe Token: SeShutdownPrivilege 4056 WMIC.exe Token: SeDebugPrivilege 4056 WMIC.exe Token: SeSystemEnvironmentPrivilege 4056 WMIC.exe Token: SeRemoteShutdownPrivilege 4056 WMIC.exe Token: SeUndockPrivilege 4056 WMIC.exe Token: SeManageVolumePrivilege 4056 WMIC.exe Token: 33 4056 WMIC.exe Token: 34 4056 WMIC.exe Token: 35 4056 WMIC.exe Token: 36 4056 WMIC.exe Token: SeIncreaseQuotaPrivilege 4056 WMIC.exe Token: SeSecurityPrivilege 4056 WMIC.exe Token: SeTakeOwnershipPrivilege 4056 WMIC.exe Token: SeLoadDriverPrivilege 4056 WMIC.exe Token: SeSystemProfilePrivilege 4056 WMIC.exe Token: SeSystemtimePrivilege 4056 WMIC.exe Token: SeProfSingleProcessPrivilege 4056 WMIC.exe Token: SeIncBasePriorityPrivilege 4056 WMIC.exe Token: SeCreatePagefilePrivilege 4056 WMIC.exe Token: SeBackupPrivilege 4056 WMIC.exe Token: SeRestorePrivilege 4056 WMIC.exe Token: SeShutdownPrivilege 4056 WMIC.exe Token: SeDebugPrivilege 4056 WMIC.exe Token: SeSystemEnvironmentPrivilege 4056 WMIC.exe Token: SeRemoteShutdownPrivilege 4056 WMIC.exe Token: SeUndockPrivilege 4056 WMIC.exe Token: SeManageVolumePrivilege 4056 WMIC.exe Token: 33 4056 WMIC.exe Token: 34 4056 WMIC.exe Token: 35 4056 WMIC.exe Token: 36 4056 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4900 wrote to memory of 1932 4900 Conti.exe 92 PID 4900 wrote to memory of 1932 4900 Conti.exe 92 PID 1932 wrote to memory of 4056 1932 cmd.exe 94 PID 1932 wrote to memory of 4056 1932 cmd.exe 94 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Conti.exe"C:\Users\Admin\AppData\Local\Temp\Conti.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4F4E627C-7431-49CD-9829-BEAF7BF7B2B5}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4F4E627C-7431-49CD-9829-BEAF7BF7B2B5}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4056
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\R3ADM3.txt1⤵
- Opens file in notepad (likely ransom note)
PID:8900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
846B
MD5e6f001fc98cb51a0429ca5dc95f6a950
SHA116a73b95d0b5408fa95c97bc9f314f1eff4902b4
SHA256acf1bb83790c25806dd3c29e0b453002397c7fe7abc25a3470ae4e3164f9f31b
SHA51211e65ed0e80aedb497ab40edf5d3f756b121527cb1102408cdd9f146549c849a41a16fc908bb284c920b061c6b37723117b929de150a62cd61273c40e660168c