Analysis
- max time kernel
149s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 04:33
General
- Target 2026-07-17_251fff013b147a108c4319141ec303dd_conti.exe
- Size 22KB
- Sample260718-e6ks4sbw8z
- SHA256 b60d5f555c59d00046e459a86dcc3b355de916209902cb45b851d4577e005026
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops startup file 1 IoCs
- Executes dropped EXE 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_251fff013b147a108c4319141ec303dd_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_251fff013b147a108c4319141ec303dd_conti.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemOptimizer.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\SystemOptimizer\sysopt.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\SystemOptimizer'; $Shortcut.Description = 'System Optimization Service'; $Shortcut.Save();"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemOptimizerTask" /tr "C:\ProgramData\SystemOptimizer\sysopt.exe" /sc hourly /mo 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\SystemOptimizer\sysopt.exe"C:\ProgramData\SystemOptimizer\sysopt.exe"2⤵
- Executes dropped EXE
-
-
C:\PROGRA~3\SYSTEM~1\sysopt.exeC:\PROGRA~3\SYSTEM~1\sysopt.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\SystemOptimizer\sysopt.exeC:\ProgramData\SystemOptimizer\sysopt.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sysopt.exe
memory/1812-32-0x00007FF7F1BA0000-0x00007FF7F1BAD000-memory.dmp
memory/2156-25-0x00007FF7F1BA0000-0x00007FF7F1BAD000-memory.dmp
memory/4376-13-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-15-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-7-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-8-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-9-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-10-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-11-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-0-0x00007FFA95AFF000-0x00007FFA95B00000-memory.dmp
memory/4376-14-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-6-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-16-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-18-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-21-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-5-0x000002DF5B730000-0x000002DF5B752000-memory.dmp
memory/4376-33-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-2-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4376-1-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
memory/4500-24-0x00007FF7F1BA0000-0x00007FF7F1BAD000-memory.dmp
memory/4636-31-0x00007FF797080000-0x00007FF79708D000-memory.dmp
memory/4636-26-0x00007FF797080000-0x00007FF79708D000-memory.dmp