Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system - submitted
10/01/2026, 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe
Resource
win11-20251231-en
windows11-21h2-x64
20 signatures
150 seconds
General
- Target 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe
- Size 358KB
- Sample260110-dmpsaact2f
- SHA256 9bf7d4ea7392ee39fe577a67c7456fb83eda3e41f4f17c987317dfd784a217b8
- MD5 ffd73f697b6d13c629190672569ce577
- SHA1 483d3d63ada59581236bbe3b4551fdb9195f2475
- SHA512 5f1ba36f4df99a3a805dab254c6ec0891abd56bdb7121eb651b3eda6383314fbf3c9006c54b035e138197ab4a31cc26acc6ca7c741f91318dc86f7dce98fb324
- SSDEEP 6144:xZutCeimy7QQ4m4xHFu9Sbu7SBEFaphl4:j0/5y7l4dHPu7lFShl4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
- Babuk family
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (2282) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Como restaurar seus arquivos.txt 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\S: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\H: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\L: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\V: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\Q: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\W: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\R: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\T: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\I: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\O: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\J: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\K: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\A: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\Z: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\B: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\M: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\Y: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\U: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\G: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\X: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\N: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe File opened (read-only) \??\E: 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier StartMenuExperienceHost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 StartMenuExperienceHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier StartMenuExperienceHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz StartMenuExperienceHost.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5088 vssadmin.exe 1492 vssadmin.exe - Modifies registry class 35 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "11545" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8650" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5431" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8326" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3275" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8326" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "9205" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5986" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5986" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "13463" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3242" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5431" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "10244" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10244" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 4468 vssvc.exe Token: SeRestorePrivilege 4468 vssvc.exe Token: SeAuditPrivilege 4468 vssvc.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3148 StartMenuExperienceHost.exe 1620 SearchHost.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5000 wrote to memory of 3344 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 78 PID 3344 wrote to memory of 5088 3344 cmd.exe 80 PID 5000 wrote to memory of 4232 5000 2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe 93 PID 4232 wrote to memory of 1492 4232 cmd.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-01-10_ffd73f697b6d13c629190672569ce577_conti.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5088
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1492
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3148
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1620
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
- Size 33KB
- SHA256 bbcea13ec2394120ef346a864d5cf9860f4081fe1a265b7e22dcf6038be16e40
- MD5 d7ad162a8cedaaa055149ac3e88b9407
- SHA1 4bb868b0b89b56310e88cc5b1b7d9ccaaed13d19
- SHA512 a0f7f8ec1c57c4e70c67a9bca6be05b0262b02cfc296692010e63f6c204de4b19271ea63e93788336f1357d20c860eaaac20fc33f0ad57acad798318f1d1ce60
- SSDEEP 768:v+fVcG8Dl8RJk7gvkjU31jd+GDa50XT4H6YAVDcSG+YiKh:oVG7g8Uljd+GDa50X0H6YAVDcSG+YiKh
- TLSH T15FE219743AF51315F3F29F759AF1AA9A693AB866AC00DB4D0162024D0937E52CD70F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
- Size 26KB
- SHA256 4b78223ec90282a781a1a78376021e37aadb73a2ebafbbf6453c88bf666d3dce
- MD5 bfd386e878853cf9b3745a32d6a261c4
- SHA1 9f7b99a5675cb2a9363903a97462548e7e353a60
- SHA512 f0ff64d3cdbf750168f487d26592dc32d18eef683bf15cb1d2b3e6df878787015775d541e328819961a832a828919116d48c049dc9eb50c9c0384c6974323918
- SSDEEP 768:5+bVcWDDl8RJT3g4jUwCyIi+GDa50mr+YAVycSEYnKB:CVs3gIUxyIi+GDa50mr+YAVycSEYnKB
- TLSH T137C228743AF41715F3F29F759AF16999683AB866AC00DB4D0062028D0977E92CDB0F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
- Size 32KB
- SHA256 4c59ad8356de73d59f72ee8176ca2c9cd02034353b25fd68b06be8c72dea2426
- MD5 2c7e2122b224ac46dbc2405bf685685c
- SHA1 cf5e05f02dc99ff42b3c6c2a4e63e20fe50635e2
- SHA512 3d364d6088ac8f745a854c5b7f9420f65185f7c5f4467290dc61cabb2fd83353cef2c3a1d3ceb418ec6735a9f79f730629398d5454ba084e53d095193567ea49
- SSDEEP 768:O+fVcW8Dl8RJk7gvkjU39jd+GDa50XT4H6YAVDcSG+YiKP:PVm7g8Utjd+GDa50X0H6YAVDcSG+YiKP
- TLSH T1B6E219743AF51315F3F29F759AF1AA9A693AB866AC00DB4D0162024D0937E52CD70F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2QBGWIRQ\www.bing[1].xml
- Size 97B
- SHA256 31cb0f55a3e2607d01f1cd575b42d6d77b90452149178f1d370ca8ceb55fa23f
- MD5 fd86e3947b1e65d394b19c55b2ee61d3
- SHA1 cc3229c68283b67694194a6d691c6edb4eb2262e
- SHA512 28ae9c18b7d6a2ccf6a7ca63ec07b0c9ece74ac79afa5a3127ccebe751608874c597e15f83829415ea13f46b1d3e261f7cfe3005823339b12fc4e23b4abd8409
- TLSH T1E8B0121135448C1807C0CFF92E0E50D432EE0092A38EB5B478F4BD017487D4AC021CA0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2QBGWIRQ\www.bing[1].xml
- Size 12KB
- SHA256 49ab64e0983dbb2360851c711facfbcdffdc702f64206e75780f0f68c9ac1ff2
- MD5 6aff0f34b0364f9cae8751936543970c
- SHA1 616bb5c0fdc0c3c5c3dcd3a211fc4fdcc8e2f53b
- SHA512 481fc416b0bd65975bb5035c10c4b7931fdeee539353856a834b0becca80576fcd21145d5c66af47f9757d70b9c2afeeb8ba1a8de8126dff8ecc23ce907dbefd
- SSDEEP 384:+mJFuMW+YjTwkeZ+ZAZZZoMqVuurEzZa7HIo82MiLO1z/duqjtSnnLAlp:+EsJh/cZ+ZAZZZoM9CIknLAP
- TLSH T1F6421F76D5F3DA378E7EF592E6A5AF5D969BD71B6BC1EFF284004082929400F0E13088
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
- Size 29KB
- SHA256 3c2f53cabe09c39d411becf659f59b1e024058e1b54da7a2adec8f43322709a2
- MD5 d7ede8aa1a1c740847789193e0e1c964
- SHA1 4aa1791d62c41ec81fb7c015cde9d9c7a35ed97f
- SHA512 682bc262280e29ecb8b8de030512210cdc1fbbc7325e921ee4d93fa078194eb2f8b65212a54b6cf0d9c9812a7e7d959f50d6fc0ab95cd43f3f098c5acdbddc86
- SSDEEP 768:MSGKYL7gtcEZrkjUNKOHZYAVfsEVIw+YG+GDa50wLwl8RJO:4KYL7gtc2oU4OHZYAVfsEVIw+YG+GDaA
- TLSH T1D1D21D743AF51715F3F29F758AF5699A683AB866AC00DB8D0161024D0937E93CE70F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
- Size 29KB
- SHA256 9505a402f42cea48e7e8f9158e4bb54255b724ad5c39677ae28e85f5d0f895f3
- MD5 fe25bc250ffff665c0bd18210b3816b0
- SHA1 cf78e3df7dcd121558ba9fd623cf6c9f90b05ced
- SHA512 8b1818ad293826d720f589abe5198171e9d44d6b5f6d6800539506f832b723dffae3a9c57beef4fb0dec2d0d0dbdec7ccf531e724e2c9eae4cd7e8efbca2c984
- SSDEEP 768:XkuyB0IciI5T1RazG5ZLKxAehEtpuJ8zuKrJ/h+z:0TB0Ict5T1RjOxAe6zuJ89rJIz
- TLSH T145D2F269E6BF766FF5E2C1BC308893B1405FD8870FDA654B0DB8BE298391B109057D58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Como restaurar seus arquivos.txt
- Size 1KB
- SHA256 8395d7bad7ba2adc14d41fcc899ca7d92de2b5f59b1f61700531a13b3f44f27f
- MD5 d00155367e419df5d2200221b3fe044a
- SHA1 764c1e239256acf34ef4612b8dac0d0e1dad99c4
- SHA512 815cbaf31c875a6fda0b05e1d5ac7d9d949af38bd5a9ced42dbdf6205334557ea935967059ddd8e8475759b5835918a8bbc9dcfa11e5c026106b41ff9ea416fd
- TLSH T1D82195141D4BBFAC0E61C650AA5AC743E64D9124118BEBC7FD474D0441D1B065C3F48B
- MD5 SHA1 SHA512 TLSH