Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 16:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe
- Size 70KB
- Sample260727-t3mkvsxaqd
- SHA256 aa575090cb5705e8df546e01d2809f41cd2c4537abc4a7e0a2a74afa1ebe5c32
- MD5 1764450142eb604d00763c8683d9d1f7
- SHA1 57f61f085a61e5e7a1d269cd1f9a93eaa82cf6d1
- SHA512 1dfbe44e7df2a9cf6129c4e2e8fc0c71510c81498fa959675acf4185f1b33e942096100db94e101db1bf35f16d31d651dcc43a277ef21e3fa508efd613da6471
- SSDEEP 1536:2IGERoZdnO+XUdeHXUdekLaTMSFWjXUdeSFhNGpWSNNxEycf0sgTZlwlw:TGEOsLaTC0FhNGpWSNNxpsa
- TLSH T10163C59871C85A53EA8341B785B3F4F0AE65ADD505304337D389F9F72AD20E2B13A2B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 5 IoCs
description ioc Process File created \??\c:\Program Files\desktop.ini 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File created \??\c:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\ca.txt 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ca.pak 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoCanary.png 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File created \??\c:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\ar.txt 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\lij.txt 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\Ole DB\sqloledb.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\libpng.md 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\tipresx.dll.mui 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\kk.txt 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\mng2.txt 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fil-PH\tipresx.dll.mui 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi_MASCULINE.pak 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\WindowsBase.resources.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\gl.txt 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\zh-tw.txt 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Parallel.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5420 2668 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_1764450142eb604d00763c8683d9d1f7_conti_elex_sivis.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 7202⤵
- Program crash
PID:5420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2668 -ip 26681⤵PID:2444
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 1.9MB
- SHA256 88011b39a289e572d855061f4978ce95898aef59805f6f23099042625a3825bb
- MD5 8c44bdbea1344839c2c44c38fc234489
- SHA1 213abf289dd77a785c093b9a8ecb840e7d45e213
- SHA512 1d989322f004a8ba5e2dbde6b6c6d024fb93cccded0db670a73d9613b67afdbb0b853f786cdbe1243f20a4b2350cb630a2379e268a9c3a75fcff502f73d5f898
- SSDEEP 24576:paTC0FhNGpWOsaezTxNGDd6nCtpzxTuh8WpkPpz6ylzGlvGkw7:paT/FhNGpWOsFzTxMtpzpDBGyo
- TLSH T18D953B5AF6748270D0B7C075C5E2ABAAEE7134864B30A6C75285DB7D2F13AF6C539320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\Office16\OSPP.HTM
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512