1398c018eb9ba4440c98071412eccb08fc06f74b0778ae6bd31c5ce35e28498a

Analysis

max time kernel
149s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_380ef5bbdc8404e9890ccb3adefffc7a_conti.exe
Size 23KB
Sample260604-kd9vesbt8w
SHA256 1398c018eb9ba4440c98071412eccb08fc06f74b0778ae6bd31c5ce35e28498a
MD5 380ef5bbdc8404e9890ccb3adefffc7a
SHA1 67901a863e55d62455b22e78811aae7a899b26fc
SHA512 f0784edc85115e14601be2fdfa63b2b4fa679ef267271e4f8aa1e50ee27f8a96ba04d4b65e9e3260c245a61235fcb138498b41cefa8c0d44e7d4c93474720f7a
SSDEEP 384:t4OlWnYILTdUwlZlKSt7V25nqZSvKjmZCW:+OlcYWISt7aqZmKS8W
TLSH
T1F4B2081F33D644E8D572D238DABA5331EAF3B920143A571C2358C6252F33DA48A7979B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe
1612	osk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 484	672	2026-06-04_380ef5bbdc8404e9890ccb3adefffc7a_conti.exe	82
PID 672 wrote to memory of 1612	672	2026-06-04_380ef5bbdc8404e9890ccb3adefffc7a_conti.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-06-04_380ef5bbdc8404e9890ccb3adefffc7a_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_380ef5bbdc8404e9890ccb3adefffc7a_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
  "C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe"
  2⤵
  PID:484
- C:\Windows\System32\osk.exe
  "C:\Windows\System32\osk.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-0-0x00007FF7873C0000-0x00007FF7873CD000-memory.dmp

Download