Analysis
- max time kernel
148s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 16:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe
- Size 88KB
- Sample260727-tvb46axvb1
- SHA256 5400e671020fe26549a15e44639aaf2c6786a0e9c351b74c48cf4f07c9f5916b
- MD5 df6c94a80220a1890cc58737c6fd6847
- SHA1 517ba400f5789d9117afc8c157e7a86d9ae09f23
- SHA512 7a9a8b2f3651d1761ef708ff48bd5beafb2a5cf5803bdc99c24147ddd1b0730e36d996ce1f2c365a293051e848e032ea37038543f2062fb56503f7e2d855ca97
- SSDEEP 1536:d0TEtoZdnO/XUdeHXUdekLaTMSFWjXUdeSFhNGpWSNNxEycf0sgTH3hhAj:eTECbLaTC0FhNGpWSNNxpsCAj
- TLSH T1A393A5DA6ADC9182E647A5778473E4F4DE38EDC129700212E309F5F62EB25F2731E065
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-3986082593-3624157295-3514260330-1000\desktop.ini 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-3986082593-3624157295-3514260330-1000\desktop.ini 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File created \??\c:\Program Files\desktop.ini 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Xml.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\PresentationUI.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\TipRes.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Xaml.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\ba.txt 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-TW.pak 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File created \??\c:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Formatters.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\npt.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\UIAutomationClientSideProviders.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ru_NEUTER.pak 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\javaws.jar 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\en-GB_MASCULINE.pak 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\an.txt 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\ru.txt 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\mr-IN\tipresx.dll.mui 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1364 1416 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_df6c94a80220a1890cc58737c6fd6847_conti_elex_sivis.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 7162⤵
- Program crash
PID:1364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1416 -ip 14161⤵PID:1836
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 1.9MB
- SHA256 ba5433a1c6e264ee983dbfbb354208c0edd2485f757a4655a27e8a6d26b3bb2d
- MD5 ad2d76d218c2d2b23ae5a36096b43eb0
- SHA1 facfe3ab96f4e25ba0b456e0d1cfa72c417b9e0f
- SHA512 5805cba46ad911f40a342b3e91b6d2d7d2b508fc6666702b3dcb13ecb373c5e5a7ebf26e8b3d6e1fbb999f10c25eb01ccc0b5def7b95d55dcaf3a83eafb91619
- SSDEEP 24576:MaTC0FhNGpWOsfezTxNGDd6nCtpzxTuh8WpkPpz6ylzGlvGkw7:MaT/FhNGpWOsGzTxMtpzpDBGyo
- TLSH T179953C5AF6748260D0B6C075C5E2ABA6EE713C864B3096C75285FB3D2F33AF58539321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512