Overview
overview
10Static
static
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
7Resubmissions
28-07-2024 16:38
240728-t5tryssgmm 1007-07-2024 14:07
240707-rfgd8atekm 1007-07-2024 14:07
240707-re689awdpe 1013-09-2022 17:54
220913-wg1lpsgbg7 10Analysis
-
max time kernel
1563s -
max time network
1572s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
07-07-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
RansomwareSamples/DarkSide_01_05_2021_30KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
RansomwareSamples/DarkSide_01_05_2021_30KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
RansomwareSamples/DarkSide_16_01_2021_59KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
RansomwareSamples/DarkSide_16_01_2021_59KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
RansomwareSamples/Hive_17_07_2021_808KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
RansomwareSamples/Hive_17_07_2021_808KB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10v2004-20240704-en
General
-
Target
RansomwareSamples/Conti_22_12_2020_186KB.exe
-
Size
185KB
-
MD5
7076f9674bc42536d1e0e2ca80d1e4f6
-
SHA1
854485ee63e5a399fffe150f04cd038d6a5490ef
-
SHA256
ebeca2df24a55c629cf0ce0d4b703ed632819d8ac101b1b930ec666760036124
-
SHA512
71c507108cc0c8b5609076672bd0b64a42c015995fe7220aa97e273c1754e63271edb06b284f4fc01b71a4751c1bcac0f572339e94ff0fd538dc0250caa9181a
-
SSDEEP
3072:+qS7gtGIeq8KxrvRp1MImcZeuLaxugfCJsOlq8WkJK0BOog/Tt3onM9kHpOBae4f:zS7gtyuzFxm16axugfqlMw5g5BkOdSlr
Malware Config
Extracted
C:\Program Files (x86)\R3ADM3.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.info
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (7995) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
Processes:
Conti_22_12_2020_186KB.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\R3ADM3.txt Conti_22_12_2020_186KB.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
Conti_22_12_2020_186KB.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Links\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Pictures\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Videos\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\G2KVEH0D\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Music\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\7JXML4U5\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Documents\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Libraries\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\CNQY6MQU\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\Music\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini Conti_22_12_2020_186KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\72EHROQQ\desktop.ini Conti_22_12_2020_186KB.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Conti_22_12_2020_186KB.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02404_.WMF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Common Files\System\msadc\handsafe.reg Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jre7\lib\management-agent.jar Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099202.GIF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105388.WMF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00934_.WMF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MARQUEE.POC Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299763.WMF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10254_.GIF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FRENCH.LNG Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105306.WMF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL083.XML Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2 Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382930.JPG Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\BG_ADOBE.GIF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\ISO690.XSL Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8 Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.ICO Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182902.WMF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241781.WMF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309705.JPG Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_choosefont.gif Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45B.GIF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF Conti_22_12_2020_186KB.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\R3ADM3.txt Conti_22_12_2020_186KB.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\R3ADM3.txt Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0332364.WMF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\PREVIEW.GIF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR43B.GIF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Premium.css Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.properties.src Conti_22_12_2020_186KB.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\R3ADM3.txt Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\PRODIGY.NET.XML Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Beige.css Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_REVIEW.XSN Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR28F.GIF Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\StatusOnline.ico Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313974.JPG Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Dawson Conti_22_12_2020_186KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png Conti_22_12_2020_186KB.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Conti_22_12_2020_186KB.exepid process 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe 1556 Conti_22_12_2020_186KB.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 2316 vssvc.exe Token: SeRestorePrivilege 2316 vssvc.exe Token: SeAuditPrivilege 2316 vssvc.exe Token: SeIncreaseQuotaPrivilege 2980 WMIC.exe Token: SeSecurityPrivilege 2980 WMIC.exe Token: SeTakeOwnershipPrivilege 2980 WMIC.exe Token: SeLoadDriverPrivilege 2980 WMIC.exe Token: SeSystemProfilePrivilege 2980 WMIC.exe Token: SeSystemtimePrivilege 2980 WMIC.exe Token: SeProfSingleProcessPrivilege 2980 WMIC.exe Token: SeIncBasePriorityPrivilege 2980 WMIC.exe Token: SeCreatePagefilePrivilege 2980 WMIC.exe Token: SeBackupPrivilege 2980 WMIC.exe Token: SeRestorePrivilege 2980 WMIC.exe Token: SeShutdownPrivilege 2980 WMIC.exe Token: SeDebugPrivilege 2980 WMIC.exe Token: SeSystemEnvironmentPrivilege 2980 WMIC.exe Token: SeRemoteShutdownPrivilege 2980 WMIC.exe Token: SeUndockPrivilege 2980 WMIC.exe Token: SeManageVolumePrivilege 2980 WMIC.exe Token: 33 2980 WMIC.exe Token: 34 2980 WMIC.exe Token: 35 2980 WMIC.exe Token: SeIncreaseQuotaPrivilege 2980 WMIC.exe Token: SeSecurityPrivilege 2980 WMIC.exe Token: SeTakeOwnershipPrivilege 2980 WMIC.exe Token: SeLoadDriverPrivilege 2980 WMIC.exe Token: SeSystemProfilePrivilege 2980 WMIC.exe Token: SeSystemtimePrivilege 2980 WMIC.exe Token: SeProfSingleProcessPrivilege 2980 WMIC.exe Token: SeIncBasePriorityPrivilege 2980 WMIC.exe Token: SeCreatePagefilePrivilege 2980 WMIC.exe Token: SeBackupPrivilege 2980 WMIC.exe Token: SeRestorePrivilege 2980 WMIC.exe Token: SeShutdownPrivilege 2980 WMIC.exe Token: SeDebugPrivilege 2980 WMIC.exe Token: SeSystemEnvironmentPrivilege 2980 WMIC.exe Token: SeRemoteShutdownPrivilege 2980 WMIC.exe Token: SeUndockPrivilege 2980 WMIC.exe Token: SeManageVolumePrivilege 2980 WMIC.exe Token: 33 2980 WMIC.exe Token: 34 2980 WMIC.exe Token: 35 2980 WMIC.exe Token: SeIncreaseQuotaPrivilege 2976 WMIC.exe Token: SeSecurityPrivilege 2976 WMIC.exe Token: SeTakeOwnershipPrivilege 2976 WMIC.exe Token: SeLoadDriverPrivilege 2976 WMIC.exe Token: SeSystemProfilePrivilege 2976 WMIC.exe Token: SeSystemtimePrivilege 2976 WMIC.exe Token: SeProfSingleProcessPrivilege 2976 WMIC.exe Token: SeIncBasePriorityPrivilege 2976 WMIC.exe Token: SeCreatePagefilePrivilege 2976 WMIC.exe Token: SeBackupPrivilege 2976 WMIC.exe Token: SeRestorePrivilege 2976 WMIC.exe Token: SeShutdownPrivilege 2976 WMIC.exe Token: SeDebugPrivilege 2976 WMIC.exe Token: SeSystemEnvironmentPrivilege 2976 WMIC.exe Token: SeRemoteShutdownPrivilege 2976 WMIC.exe Token: SeUndockPrivilege 2976 WMIC.exe Token: SeManageVolumePrivilege 2976 WMIC.exe Token: 33 2976 WMIC.exe Token: 34 2976 WMIC.exe Token: 35 2976 WMIC.exe Token: SeIncreaseQuotaPrivilege 2976 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Conti_22_12_2020_186KB.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1556 wrote to memory of 2724 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2724 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2724 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2724 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 2724 wrote to memory of 2980 2724 cmd.exe WMIC.exe PID 2724 wrote to memory of 2980 2724 cmd.exe WMIC.exe PID 2724 wrote to memory of 2980 2724 cmd.exe WMIC.exe PID 1556 wrote to memory of 2736 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2736 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2736 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2736 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 2736 wrote to memory of 2976 2736 cmd.exe WMIC.exe PID 2736 wrote to memory of 2976 2736 cmd.exe WMIC.exe PID 2736 wrote to memory of 2976 2736 cmd.exe WMIC.exe PID 1556 wrote to memory of 1592 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 1592 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 1592 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 1592 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1592 wrote to memory of 1852 1592 cmd.exe WMIC.exe PID 1592 wrote to memory of 1852 1592 cmd.exe WMIC.exe PID 1592 wrote to memory of 1852 1592 cmd.exe WMIC.exe PID 1556 wrote to memory of 2632 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2632 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2632 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2632 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 2632 wrote to memory of 2684 2632 cmd.exe WMIC.exe PID 2632 wrote to memory of 2684 2632 cmd.exe WMIC.exe PID 2632 wrote to memory of 2684 2632 cmd.exe WMIC.exe PID 1556 wrote to memory of 2164 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2164 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2164 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2164 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 2164 wrote to memory of 3068 2164 cmd.exe WMIC.exe PID 2164 wrote to memory of 3068 2164 cmd.exe WMIC.exe PID 2164 wrote to memory of 3068 2164 cmd.exe WMIC.exe PID 1556 wrote to memory of 1928 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 1928 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 1928 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 1928 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1928 wrote to memory of 2044 1928 cmd.exe WMIC.exe PID 1928 wrote to memory of 2044 1928 cmd.exe WMIC.exe PID 1928 wrote to memory of 2044 1928 cmd.exe WMIC.exe PID 1556 wrote to memory of 3032 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 3032 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 3032 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 3032 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 3032 wrote to memory of 1868 3032 cmd.exe WMIC.exe PID 3032 wrote to memory of 1868 3032 cmd.exe WMIC.exe PID 3032 wrote to memory of 1868 3032 cmd.exe WMIC.exe PID 1556 wrote to memory of 1972 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 1972 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 1972 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 1972 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1972 wrote to memory of 1996 1972 cmd.exe WMIC.exe PID 1972 wrote to memory of 1996 1972 cmd.exe WMIC.exe PID 1972 wrote to memory of 1996 1972 cmd.exe WMIC.exe PID 1556 wrote to memory of 2940 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2940 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2940 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 1556 wrote to memory of 2940 1556 Conti_22_12_2020_186KB.exe cmd.exe PID 2940 wrote to memory of 1440 2940 cmd.exe WMIC.exe PID 2940 wrote to memory of 1440 2940 cmd.exe WMIC.exe PID 2940 wrote to memory of 1440 2940 cmd.exe WMIC.exe PID 1556 wrote to memory of 2160 1556 Conti_22_12_2020_186KB.exe cmd.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Conti_22_12_2020_186KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Conti_22_12_2020_186KB.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84B23760-D083-4387-974D-3C4546D42F6A}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84B23760-D083-4387-974D-3C4546D42F6A}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7F4FF19A-F0A9-4D37-804C-BBA1AC496F39}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7F4FF19A-F0A9-4D37-804C-BBA1AC496F39}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2976 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9F6E7A5F-91E3-42B9-9E2A-D87FADA45EB4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9F6E7A5F-91E3-42B9-9E2A-D87FADA45EB4}'" delete3⤵PID:1852
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{314E70DD-6CC8-441F-8B30-A71AFD3666D4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{314E70DD-6CC8-441F-8B30-A71AFD3666D4}'" delete3⤵PID:2684
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F28370CD-B12E-4E29-BDEC-FADD070A311C}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F28370CD-B12E-4E29-BDEC-FADD070A311C}'" delete3⤵PID:3068
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9CFA1FAC-8B30-464C-A41C-E8A415E47E56}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9CFA1FAC-8B30-464C-A41C-E8A415E47E56}'" delete3⤵PID:2044
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CE807F35-9C0E-4446-B318-8485AF6C0259}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CE807F35-9C0E-4446-B318-8485AF6C0259}'" delete3⤵PID:1868
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ED089E91-80BF-4ED9-8981-C380E00AF48A}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ED089E91-80BF-4ED9-8981-C380E00AF48A}'" delete3⤵PID:1996
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D1A50FE4-92ED-419B-8E4F-FD59A2FB70FF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D1A50FE4-92ED-419B-8E4F-FD59A2FB70FF}'" delete3⤵PID:1440
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{95BCBF4B-AB01-429A-BC22-D699995F488D}'" delete2⤵PID:2160
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{95BCBF4B-AB01-429A-BC22-D699995F488D}'" delete3⤵PID:1168
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D3411E52-7961-4272-BD9B-AC00A7C176FD}'" delete2⤵PID:1940
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D3411E52-7961-4272-BD9B-AC00A7C176FD}'" delete3⤵PID:2364
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5A5BC5FA-1945-4C64-98AB-48EB9B258476}'" delete2⤵PID:784
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5A5BC5FA-1945-4C64-98AB-48EB9B258476}'" delete3⤵PID:2912
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4209BC2E-63F3-4311-B318-4266CE6427FD}'" delete2⤵PID:2384
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4209BC2E-63F3-4311-B318-4266CE6427FD}'" delete3⤵PID:2948
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0FB96D71-416E-4221-B050-53851A8DFEFF}'" delete2⤵PID:1484
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0FB96D71-416E-4221-B050-53851A8DFEFF}'" delete3⤵PID:440
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA9D1DC0-6918-4793-9B97-17DC4DC11B7A}'" delete2⤵PID:3004
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA9D1DC0-6918-4793-9B97-17DC4DC11B7A}'" delete3⤵PID:1932
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5F3413EA-0DE7-4717-9100-512425AA05AF}'" delete2⤵PID:1076
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5F3413EA-0DE7-4717-9100-512425AA05AF}'" delete3⤵PID:1332
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B69ED39F-CDDB-47E0-81FC-5EF4BC215C92}'" delete2⤵PID:1384
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B69ED39F-CDDB-47E0-81FC-5EF4BC215C92}'" delete3⤵PID:1704
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C44555B4-BF9B-4600-B9BC-43446450A014}'" delete2⤵PID:1292
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C44555B4-BF9B-4600-B9BC-43446450A014}'" delete3⤵PID:2336
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
846B
MD5e6f001fc98cb51a0429ca5dc95f6a950
SHA116a73b95d0b5408fa95c97bc9f314f1eff4902b4
SHA256acf1bb83790c25806dd3c29e0b453002397c7fe7abc25a3470ae4e3164f9f31b
SHA51211e65ed0e80aedb497ab40edf5d3f756b121527cb1102408cdd9f146549c849a41a16fc908bb284c920b061c6b37723117b929de150a62cd61273c40e660168c