Overview

overview

10

Static

static

3

132f4e074a...5e.exe

windows7-x64

10

132f4e074a...5e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 16:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe

  • Size

    515KB

  • MD5

    b9c56e7c05c5861cecbc3d99bf056c6a

  • SHA1

    1306b87b4ffbe513e19225d0bf5719f5f078e077

  • SHA256

    132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e

  • SHA512

    846666b9c0dc106931e7cbca61d759bc75aac5083bed636b8f00a9d2649c2f0d428515fd0d38e8f9d5879994681c97ce7c7d56031e0e821702240f4a6f54a96a

  • SSDEEP

    3072:HzyJa/EBc2jrORnQssIJZYKcgtHhGk528yJKY8/d7epmB98g89QP2EKO0+5Wk:HzymEBc2jMQsdJdBgHJ+/dB9rP2v+5R

Score
10/10
contidiscoveryransomware

Malware Config

Extracted

Path

C:\ProgramData\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.xyz/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- ec5sSORrGN3JYtjUtK7QvDv7ZtnFwgcUnCEmqJITc9YfyoAPydlyCoE1FHyB8wCq ---END ID---
URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.xyz/

Signatures

  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti
  • Renames multiple (142) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
    "C:\Users\Admin\AppData\Local\Temp\132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA4F2488-C812-4D6A-99DF-8A006EE3F21F}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA4F2488-C812-4D6A-99DF-8A006EE3F21F}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2052
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3788
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3364,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
    1⤵
      PID:3872

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\readme.txt
      Filesize

      1KB

      MD5

      d030c401512051cf275eb9d2b61f327e

      SHA1

      eaf4022b5b6cd27b9e4a833d4863a3de6f65b819

      SHA256

      7d6b2b2e67b72d46d10f8dbf0233bd3fa94ac11d839148e305d0190268ca6edb

      SHA512

      e4d6864c785da9d703cc298b31f94887b914950fdb2ed635232e35baa6c4d8674fe8d327c1cde2808cbceb922136fcfe46d6591d6988125a09f414c2ec07df9d

      Download Submit