Analysis
- max time kernel
149s - max time network
123s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 01:33
General
- Target 2026-06-02_0382c57f2ee741e10d13fab8260c14bf_conti.exe
- Size 21KB
- Sample260602-byjdjaax2v
- SHA256 ececff45f90a53e8bd44e219819dff96616022196d856665858c070af0bdf38b
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_0382c57f2ee741e10d13fab8260c14bf_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_0382c57f2ee741e10d13fab8260c14bf_conti.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Temp' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_gjhy5scn.jnv.ps1
memory/2328-29-0x00007FF6AC430000-0x00007FF6AC43D000-memory.dmp
memory/2328-43-0x00007FF6AC430000-0x00007FF6AC43D000-memory.dmp
memory/2368-19-0x000002796DC30000-0x000002796DC3A000-memory.dmp
memory/2368-21-0x000002796DC60000-0x000002796DC6A000-memory.dmp
memory/2368-10-0x00007FF4C22B0000-0x00007FF4C22C0000-memory.dmp
memory/2368-17-0x000002796DC40000-0x000002796DC5C000-memory.dmp
memory/2368-18-0x000002796DE90000-0x000002796DF43000-memory.dmp
memory/2368-0-0x000002796ADC0000-0x000002796ADD0000-memory.dmp
memory/2368-20-0x000002796E1A0000-0x000002796E1BC000-memory.dmp
memory/2368-9-0x000002796ADC0000-0x000002796ADD0000-memory.dmp
memory/2368-22-0x000002796E1E0000-0x000002796E1FA000-memory.dmp
memory/2368-23-0x000002796DC70000-0x000002796DC78000-memory.dmp
memory/2368-24-0x000002796E1C0000-0x000002796E1C6000-memory.dmp
memory/2368-25-0x000002796E1D0000-0x000002796E1DA000-memory.dmp
memory/2368-26-0x000002796ADC0000-0x000002796ADD0000-memory.dmp
memory/2368-7-0x0000027952840000-0x0000027952862000-memory.dmp
memory/2368-1-0x000002796ADC0000-0x000002796ADD0000-memory.dmp