CarbonBlack Conti July 2020

Conti can retrieve the ARP cache from the local system by using the GetIpNetTable() API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.

Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.

Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.

Conti can enumerate routine network connections from a compromised host.

Conti has loaded an encrypted DLL into memory and then executes it.

Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.

Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.

Conti can spread itself by infecting other remote machines via network shared drives.

Conti can discover files on a local system.

Conti has used API calls during execution.

Conti can enumerate remote open SMB network shares using NetShareEnum().

Conti has decrypted its payload using a hardcoded AES-256 key.

Conti can use CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.

Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.

Conti can delete Windows Volume Shadow Copies using vssadmin.