Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2024 15:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe
-
Size
515KB
-
MD5
83848a20f22e2db86b700520b5c3af69
-
SHA1
71c1d23dd905ae91183d61d6f703fb803b5c3926
-
SHA256
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6
-
SHA512
b1f9cd195e3ec3144efdf132a2a34bc59ad41309cd29cfc7625b8fcf30f18e5a540a203b6f17c75332c25af70019c4f3a7619e4db3b0ad2e7d7743a2a6233876
-
SSDEEP
3072:uPaYEBc2jrORnQssIJkP52+JKY8/d7epmB98g89QP2EKO0+5Wk29YKvaEAJ:zYEBc2jMQsdJkQ+J+/dB9rP2v+5RS
Score
10/10
Malware Config
Extracted
Path
C:\ProgramData\readme.txt
Family
conti
Ransom Note
All of your files are currently encrypted by CONTI strain.
As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly.
If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value.
To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge.
You can contact our team directly for further instructions through our website :
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
HTTPS VERSION :
https://contirecovery.xyz/
YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible.
---BEGIN ID---
ec5sSORrGN3JYtjUtK7QvDv7ZtnFwgcUnCEmqJITc9YfyoAPydlyCoE1FHyB8wCq
---END ID---
URLs
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 44 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\License.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\dotnet\ThirdPartyNotices.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Microsoft Office\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Microsoft Office 15\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\ResetInvoke.eps f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\UndoCompress.htm f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\dotnet\LICENSE.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files (x86)\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\7z.sfx f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Google\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\HideExpand.mpe f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\ResumeInitialize.tiff f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Microsoft Office\FileSystemMetadata.xml f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Crashpad\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Internet Explorer\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Microsoft Office\AppXManifest.xml f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\CompressWait.tiff f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DisconnectReset.xps f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Common Files\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\dotnet\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Microsoft Office\ThinAppXManifest.xml f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Mozilla Firefox\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\BackupWait.zip f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\RemoveResolve.jpg f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\TestInitialize.3g2 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\descript.ion f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Crashpad\metadata f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Java\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\AssertBackup.pps f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\InvokeSuspend.tmp f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\History.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Crashpad\settings.dat f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\GroupResume.rtf f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\TestPublish.jfif f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2492 4572 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4572 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 4572 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 5028 vssvc.exe Token: SeRestorePrivilege 5028 vssvc.exe Token: SeAuditPrivilege 5028 vssvc.exe Token: SeIncreaseQuotaPrivilege 4100 WMIC.exe Token: SeSecurityPrivilege 4100 WMIC.exe Token: SeTakeOwnershipPrivilege 4100 WMIC.exe Token: SeLoadDriverPrivilege 4100 WMIC.exe Token: SeSystemProfilePrivilege 4100 WMIC.exe Token: SeSystemtimePrivilege 4100 WMIC.exe Token: SeProfSingleProcessPrivilege 4100 WMIC.exe Token: SeIncBasePriorityPrivilege 4100 WMIC.exe Token: SeCreatePagefilePrivilege 4100 WMIC.exe Token: SeBackupPrivilege 4100 WMIC.exe Token: SeRestorePrivilege 4100 WMIC.exe Token: SeShutdownPrivilege 4100 WMIC.exe Token: SeDebugPrivilege 4100 WMIC.exe Token: SeSystemEnvironmentPrivilege 4100 WMIC.exe Token: SeRemoteShutdownPrivilege 4100 WMIC.exe Token: SeUndockPrivilege 4100 WMIC.exe Token: SeManageVolumePrivilege 4100 WMIC.exe Token: 33 4100 WMIC.exe Token: 34 4100 WMIC.exe Token: 35 4100 WMIC.exe Token: 36 4100 WMIC.exe Token: SeIncreaseQuotaPrivilege 4100 WMIC.exe Token: SeSecurityPrivilege 4100 WMIC.exe Token: SeTakeOwnershipPrivilege 4100 WMIC.exe Token: SeLoadDriverPrivilege 4100 WMIC.exe Token: SeSystemProfilePrivilege 4100 WMIC.exe Token: SeSystemtimePrivilege 4100 WMIC.exe Token: SeProfSingleProcessPrivilege 4100 WMIC.exe Token: SeIncBasePriorityPrivilege 4100 WMIC.exe Token: SeCreatePagefilePrivilege 4100 WMIC.exe Token: SeBackupPrivilege 4100 WMIC.exe Token: SeRestorePrivilege 4100 WMIC.exe Token: SeShutdownPrivilege 4100 WMIC.exe Token: SeDebugPrivilege 4100 WMIC.exe Token: SeSystemEnvironmentPrivilege 4100 WMIC.exe Token: SeRemoteShutdownPrivilege 4100 WMIC.exe Token: SeUndockPrivilege 4100 WMIC.exe Token: SeManageVolumePrivilege 4100 WMIC.exe Token: 33 4100 WMIC.exe Token: 34 4100 WMIC.exe Token: 35 4100 WMIC.exe Token: 36 4100 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4572 wrote to memory of 2392 4572 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 88 PID 4572 wrote to memory of 2392 4572 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 88 PID 2392 wrote to memory of 4100 2392 cmd.exe 90 PID 2392 wrote to memory of 4100 2392 cmd.exe 90 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe"C:\Users\Admin\AppData\Local\Temp\f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9B1C0B51-DF9F-4F59-949C-517E6288FE02}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9B1C0B51-DF9F-4F59-949C-517E6288FE02}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 20242⤵
- Program crash
PID:2492
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4572 -ip 45721⤵PID:2652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d030c401512051cf275eb9d2b61f327e
SHA1eaf4022b5b6cd27b9e4a833d4863a3de6f65b819
SHA2567d6b2b2e67b72d46d10f8dbf0233bd3fa94ac11d839148e305d0190268ca6edb
SHA512e4d6864c785da9d703cc298b31f94887b914950fdb2ed635232e35baa6c4d8674fe8d327c1cde2808cbceb922136fcfe46d6591d6988125a09f414c2ec07df9d