MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Conti


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367
SHA3-384 hash: 5220ad49838d42d162e1266c030c27d1351f4e1cce96f12c25914758598e99ac83a4d4ef4e1ffa5986a4ec57fb838961
SHA1 hash: e7304e2436dc0eddddba229f1ec7145055030151
MD5 hash: 7906dc475a8ae55ffb5af7fd3ac8f10a
humanhash: oregon-cat-twelve-oregon
File name:7906dc47_by_Libranalysis
Download: download sample
Signature Conti
Create hunting rule
File size:23'040 bytes
First seen:2021-05-21 17:14:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 384:otLvArTA5n2Kc/vURgbHs19l897hkuzetFS/z1ANkp2RD0CwMiOQkSd:odvOM5UNMRS7W2AiEd08D
Threatray 1 similar samples on MalwareBazaar
TLSH 77A2CF67B2E96DC6CD88247E3D87AD1815322D41F7021FAE1C4C3B7C095F12899629EB
Reporter Libranalysis
Tags:conti


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
500
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7906dc47_by_Libranalysis
Verdict:
No threats detected
Analysis date:
2021-05-21 17:20:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9436c660-30ff-4280-9752-67a16f38b1c4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Mikey.122820.25534.26838.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Changing a file
Reading critical registry keys
Creating a file
Launching a process
Creating a window
Running batch commands
Deleting a recently created file
Replacing files
Sending a UDP request
DNS request
Sending an HTTP GET request
Creating a file in the mass storage device
Stealing user critical data
Enabling autorun with the shell\open\command registry branches
Forced shutdown of a system process
Encrypting user's files
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Conti
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/787481
Signature
Contains functionality to create processes via WMI
Creates a thread in another existing process (thread injection)
Creates processes via WMI
Deletes shadow drive data (may be related to ransomware)
Found ransom note / readme
Found Tor onion address
Maps a DLL or memory area into another process
Modifies existing user documents (likely ransomware behavior)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Sets debug register (to hijack the execution of another thread)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: Suspicious Svchost Process
Yara detected Conti ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 419877 Sample: 7906dc47_by_Libranalysis Startdate: 21/05/2021 Architecture: WINDOWS Score: 100 82 Multi AV Scanner detection for submitted file 2->82 84 Found ransom note / readme 2->84 86 Yara detected Conti ransomware 2->86 88 6 other signatures 2->88 8 7906dc47_by_Libranalysis.exe 1 2->8         started        11 cmd.exe 1 2->11         started        13 cmd.exe 1 2->13         started        15 2 other processes 2->15 process3 signatures4 96 Sets debug register (to hijack the execution of another thread) 8->96 98 Modifies the context of a thread in another process (thread injection) 8->98 100 Maps a DLL or memory area into another process 8->100 102 Creates a thread in another existing process (thread injection) 8->102 17 sihost.exe 2 12 8->17 injected 21 taskhostw.exe 8->21 injected 23 svchost.exe 1 8->23 injected 25 svchost.exe 1 8->25 injected 27 ComputerDefaults.exe 1 15 11->27         started        29 conhost.exe 11->29         started        31 ComputerDefaults.exe 12 13->31         started        33 conhost.exe 13->33         started        35 4 other processes 15->35 process5 file6 72 C:\Users\user\Desktop\...\SUAVTZKNFL.pdf, data 17->72 dropped 74 C:\Users\user\Desktop\LSBIHQFDVT.docx, data 17->74 dropped 76 C:\Users\user\Desktop\...behaviorgraphAOBCVIQIJ.docx, data 17->76 dropped 80 2 other files (none is malicious) 17->80 dropped 90 Modifies existing user documents (likely ransomware behavior) 17->90 37 cmd.exe 1 17->37         started        39 cmd.exe 1 17->39         started        78 C:\Users\Public\readme.txt, ASCII 21->78 dropped 41 cmd.exe 1 23->41         started        43 cmd.exe 1 23->43         started        45 cmd.exe 25->45         started        47 cmd.exe 25->47         started        92 Creates processes via WMI 27->92 49 WMIC.exe 27->49         started        51 WMIC.exe 31->51         started        signatures7 process8 process9 53 WMIC.exe 1 37->53         started        56 conhost.exe 37->56         started        66 2 other processes 39->66 68 2 other processes 41->68 70 2 other processes 43->70 58 conhost.exe 45->58         started        60 conhost.exe 47->60         started        62 conhost.exe 49->62         started        64 conhost.exe 51->64         started        signatures10 94 Creates processes via WMI 53->94
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367/
Threat name:
Win64.Trojan.Mikey
Create hunting rule
Status:
Malicious
First seen:
2021-05-21 17:15:13 UTC
AV detection:
14 of 44 (31.82%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dakknjtus2cm3lgxsi3u4c5ddn56j73psz27h7iv2vb27o2uantq._file
Verdict:
unknown
Similar samples:
317f3e79ff4110f5310f4722d429082ef957112fc16221b28c7e036a4b7f68f8
Conti
Result
Malware family:
n/a
Score:
  10/10
Tags:
ransomware
Link:
https://tria.ge/reports/210521-f7lr19wnc6/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Opens file in notepad (likely ransom note)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Checks computer location settings
Modifies extensions of user files
Process spawned unexpected child process
Suspicious use of NtCreateProcessExOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Cryptor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-21 18:29:18 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0026.002] Data Micro-objective::XOR::Encode Data