MALICIOUS — 9e2ad47329661f8f65ca72dd32dc4e7dee931c148af4c71562d9fb347c8fc39d

MALICIOUS — 9e2ad47329661f8f65ca72dd32dc4e7dee931c148af4c71562d9fb347c8fc39d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Conti family. 3 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9e2ad47329661f8f65ca72dd32dc4e7dee931c148af4c71562d9fb347c8fc39d
SHA-1: f5d4549a4b85d16ca9d16cda12eb846b31ed3b16
MD5: 3ba3f08cd2b26a479c5b90ff2a69e58b
imphash: 6086b106052d52e5a3fcd156b426713b
ssdeep: 3072:ovOXfbBI4++rye6iLfv7FizEPB5Oe4UKXqlc8Lm87wgZPhyOmem0:DXzin6jwUKXSL/hMOH
TLSH: T124412A9E414B3604CAB7C6E1A8123F5C9457F0FE257B349A5A43D01E3F2A88BD8F1256
Submitted as: 9e2ad47329661f8f65ca72dd32dc4e7dee931c148af4c71562d9fb347c8fc39d
File type: pe · Size: 198656 bytes
Verdict: malicious (97/100) · Family: Conti

Detections (3 of 56 engines)

Microsoft Defender: Ransom:Win32/Conti.AD!MTB
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Diavolo.2
Kaspersky (KVRT): UDS:Trojan-Ransom.Win32.Cryptor.gen

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 8 weighted signals:

Microsoft Defender flagged Ransom:Win32/Conti.AD!MTB (rule Ransom:Win32/Conti.AD!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Diavolo.2 (rule Gen:Variant.Ransom.Diavolo.2) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Ransom.Win32.Cryptor.gen (rule UDS:Trojan-Ransom.Win32.Cryptor.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497 - dynamic signal, weight 0.40, confidence 0.75
Extracted Conti config (0 C2) - engine signal, weight 0.45, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

48504 behavior events · 2 ATT&CK techniques · 30 dropped files.

Dropped files

c:\python3\news.txt.tjnwf - cb7d1ff417fabe14815e0157347c03fa98a910814927812f50996ec055791329
c:\$winreagent\backup\reagent.xml.tjnwf - 55a26da12ce2a10353c5c8fce1f68b7852043d0924af7005a35db4927fd62dc6
c:\threatlens\bake.log.tjnwf - 983de611f42a7a418ed890fd7ec3d25b28145db215c02420f4214fa967f75bb1
c:\office-config.ps1.tjnwf - c5530adf5e21a7f835e7bca23d813c4c12abb0901347e17d5d4af5e2783e3406
c:\uac.ps1.tjnwf - 606d9c9066ad43d8dd6fb08ac9ce2f70e6fb576a5595ac9c2ba1c4f638895049
c:\bake.ps1.tjnwf - 041514ab4376f043675bf13c63ddc1b7a7204768d90bb6bfd064df0110a4304b
c:\program files\7-zip\history.txt.tjnwf - 95b7c1d9c19e0ea714751cf3c99654ada1029efe56c439a27d7ad3daa540434e
c:\program files\libreoffice\license.html.tjnwf - a04cf0b33550f610577f7e4e0119a03375325ed61fa7af2d8509e73bad2b39e1
c:\python3\license.txt.tjnwf - 4ce131b8ff93528a67abe773835f80766d6d791ca401822569bb813db133586a
c:\program files\7-zip\7zcon.sfx.tjnwf - 7ad2d34c2d207b3d2f3280e10f5444bbbac7217153e18e82add6f51583efeed7
c:\scoobe-fix.cmd.tjnwf - a1cb8d2b6680e407fb061562abf68f8a645718bbc2c31da7f3ed52c3eac1d215
c:\cape\agent.py.tjnwf - 9e35ec59b0c28e95ce6e91347fa8163cfa17884510d7fd15f6f28c005899f16c
c:\cape\bootstrap.log.tjnwf - da79515813011ff40128c7f79642c522219d68c1e5b167e41121a830444e35bc
c:\program files\7-zip\license.txt.tjnwf - 6ee882e83b6e587cabe9b55e128933969e30881eac1db5dcdc8a2d5b0023839f
c:\program files\7-zip\7-zip.chm.tjnwf - 91253ffd3046ece15e4f076e980e14f3b65c59ad092d3229643c0f46feb0a5f1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.104.15.252
52.123.252.198
4.230.171.124
48.211.4.16
74.179.77.204
135.232.92.97
20.42.73.27
20.247.184.197
104.18.33.89
135.233.45.222
52.110.12.37
52.110.12.4
20.42.65.84
52.148.114.188
135.234.160.246
52.110.12.21
52.110.12.19
72.145.35.111

More Conti samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report