Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2024 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
-
Size
515KB
-
MD5
3b99e833809115583f76a1d8637dcbaf
-
SHA1
e1b5e7a4486e63dad4bde2322f9d7725fbd2eb3b
-
SHA256
d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e
-
SHA512
aaaf4318ec34381f7cfa5d7908635082f7e4e7486649e9cafebfb1fb748028a7a18558ed51338f40f35daed86e5da39e39440cfe94c372c664ddeffab2f637b0
-
SSDEEP
3072:szyP/EBc2jrORnQssIJZYKcgtHhGk528yJKY8/d7epmB98g89QP2EKOBzWk2:szyXEBc2jMQsdJdBgHJ+/dB9rP2GR
Score
10/10
Malware Config
Extracted
Path
C:\ProgramData\readme.txt
Family
conti
Ransom Note
All of your files are currently encrypted by CONTI strain.
As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly.
If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value.
To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge.
You can contact our team directly for further instructions through our website :
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
HTTPS VERSION :
https://contirecovery.xyz/
YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible.
---BEGIN ID---
xjQQ6zI9IWv1N6QnV5qrfoU1pTTuYIo23yPKUNgQjSoHd9dGOKNlScc9CP8Mi8pm
---END ID---
URLs
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (143) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\hy.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File created C:\Program Files\Mozilla Firefox\readme.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\MoveShow.css d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File created C:\Program Files (x86)\readme.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\Microsoft Office\AppXManifest.xml d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\BackupGrant.gif d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File created C:\Program Files\Uninstall Information\readme.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File created C:\Program Files (x86)\Microsoft\readme.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\Mozilla Firefox\postSigningData d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File created C:\Program Files (x86)\MSBuild\readme.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File created C:\Program Files\Crashpad\readme.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File created C:\Program Files\Microsoft Office\readme.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\RenameInitialize.3gp d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\History.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\dotnet\LICENSE.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\descript.ion d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\Crashpad\settings.dat d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\SwitchSave.avi d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File created C:\Program Files\Common Files\readme.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 6000 d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe 6000 d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 412 vssvc.exe Token: SeRestorePrivilege 412 vssvc.exe Token: SeAuditPrivilege 412 vssvc.exe Token: SeIncreaseQuotaPrivilege 5424 WMIC.exe Token: SeSecurityPrivilege 5424 WMIC.exe Token: SeTakeOwnershipPrivilege 5424 WMIC.exe Token: SeLoadDriverPrivilege 5424 WMIC.exe Token: SeSystemProfilePrivilege 5424 WMIC.exe Token: SeSystemtimePrivilege 5424 WMIC.exe Token: SeProfSingleProcessPrivilege 5424 WMIC.exe Token: SeIncBasePriorityPrivilege 5424 WMIC.exe Token: SeCreatePagefilePrivilege 5424 WMIC.exe Token: SeBackupPrivilege 5424 WMIC.exe Token: SeRestorePrivilege 5424 WMIC.exe Token: SeShutdownPrivilege 5424 WMIC.exe Token: SeDebugPrivilege 5424 WMIC.exe Token: SeSystemEnvironmentPrivilege 5424 WMIC.exe Token: SeRemoteShutdownPrivilege 5424 WMIC.exe Token: SeUndockPrivilege 5424 WMIC.exe Token: SeManageVolumePrivilege 5424 WMIC.exe Token: 33 5424 WMIC.exe Token: 34 5424 WMIC.exe Token: 35 5424 WMIC.exe Token: 36 5424 WMIC.exe Token: SeIncreaseQuotaPrivilege 5424 WMIC.exe Token: SeSecurityPrivilege 5424 WMIC.exe Token: SeTakeOwnershipPrivilege 5424 WMIC.exe Token: SeLoadDriverPrivilege 5424 WMIC.exe Token: SeSystemProfilePrivilege 5424 WMIC.exe Token: SeSystemtimePrivilege 5424 WMIC.exe Token: SeProfSingleProcessPrivilege 5424 WMIC.exe Token: SeIncBasePriorityPrivilege 5424 WMIC.exe Token: SeCreatePagefilePrivilege 5424 WMIC.exe Token: SeBackupPrivilege 5424 WMIC.exe Token: SeRestorePrivilege 5424 WMIC.exe Token: SeShutdownPrivilege 5424 WMIC.exe Token: SeDebugPrivilege 5424 WMIC.exe Token: SeSystemEnvironmentPrivilege 5424 WMIC.exe Token: SeRemoteShutdownPrivilege 5424 WMIC.exe Token: SeUndockPrivilege 5424 WMIC.exe Token: SeManageVolumePrivilege 5424 WMIC.exe Token: 33 5424 WMIC.exe Token: 34 5424 WMIC.exe Token: 35 5424 WMIC.exe Token: 36 5424 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 6000 wrote to memory of 2392 6000 d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe 88 PID 6000 wrote to memory of 2392 6000 d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe 88 PID 2392 wrote to memory of 5424 2392 cmd.exe 90 PID 2392 wrote to memory of 5424 2392 cmd.exe 90 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe"C:\Users\Admin\AppData\Local\Temp\d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4D4E2414-9437-4DC7-AFCE-265A1EAA49D8}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4D4E2414-9437-4DC7-AFCE-265A1EAA49D8}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5424
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5701579edee1063d1b39f483e86fbed79
SHA1ba728b45f74c8fb9fe7cf1e9c01663283c3a06d2
SHA25693aed46310470f2aa10dd3626ed13ae15819c9417497c01b22865664ec01afc8
SHA5127e1ed8fab572f38325b1b0eb9e1b2afae438cf8387eb19d07481d2f09ed00416368701abec1d9c046947a42809ee83dd7859b159876837ff31ef2c23f2d67c96