Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 03:54
General
- Target 2026-06-27_aed46cda653cb5f2b84c2e770aaa5b7b_conti.exe
- Size 20KB
- Sample260629-eghbpacw5s
- SHA256 3385e2e4ceb8e0a2d5c81a57b1abf5651cf83b8783f979ad838733cd52ce92c7
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_aed46cda653cb5f2b84c2e770aaa5b7b_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_aed46cda653cb5f2b84c2e770aaa5b7b_conti.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WdfddwsUpdate' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\WdfddwsUpdate\CraigslistSync.exe"C:\ProgramData\WdfddwsUpdate\CraigslistSync.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CraigslistSync.exe
__PSScriptPolicyTest_zvpstckf.mvp.ps1
memory/2304-76-0x000001C2B9A90000-0x000001C2B9B0C000-memory.dmp
memory/2304-75-0x00007FF777B30000-0x00007FF777B3D000-memory.dmp
memory/4488-87-0x00007FF691BA0000-0x00007FF691BAF000-memory.dmp
memory/6188-23-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-25-0x000001F2FD5F0000-0x000001F2FD5FA000-memory.dmp
memory/6188-12-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-13-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-14-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-21-0x000001F2FD510000-0x000001F2FD52E000-memory.dmp
memory/6188-22-0x000001F2FD530000-0x000001F2FD5E2000-memory.dmp
memory/6188-0-0x00007FFE3CD5F000-0x00007FFE3CD60000-memory.dmp
memory/6188-24-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-11-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-26-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-27-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-28-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-29-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-31-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-10-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-9-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp
memory/6188-7-0x000001F2FD1C0000-0x000001F2FD1E2000-memory.dmp
memory/6188-1-0x00007FFE3CBD0000-0x00007FFE3D574000-memory.dmp