Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe
- Size 44KB
- Sample260728-sdps9ayejb
- SHA256 9f4eefd1ac9ea4dda12233fdb0149261b1a2b4650368a6775d7b18203b553f47
- MD5 ee1924e9e14727d560214e1f99e8c93e
- SHA1 e0d5f0ad2bc3b979579834f6c1159f0579366720
- SHA512 02f592c07ec378831a2c886afb15af1305a7f83c3a6ab5b3e8b8b9adb1250c18c1c09bcd97d90b863822198b76d5abf6104587211570b3e50132f4d9bbd18f90
- SSDEEP 768:21u+kEto1d51Oh2SlSASeH2SlSASekLaTohSFWj2SlSASeSFhNGpWHmav1EFMFni:20REto1dnOhXUdeHXUdekLaTMSFWjXUM
- TLSH T15C13F74AF60D29E3CA420BFB04A754357237B95102D042DF89E7E94E9A61FE6323B25D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 5 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-189034102-168398478-1159367937-1000\desktop.ini 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-189034102-168398478-1159367937-1000\desktop.ini 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File created \??\c:\Program Files\desktop.ini 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\hy-AM\tipresx.dll.mui 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\Microsoft.VisualBasic.Forms.resources.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\en-GB.pak 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.DataAnnotations.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscorrc.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\verify.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\mraut.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.CodeDom.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\netstandard.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\security\java.policy 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\Ole DB\msxactps.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\ado\msado20.tlb 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\coreclr.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ru_FEMININE.pak 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Internet Explorer\IEShims.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe - Program crash 1 IoCs
pid pid_target Process procid_target 6092 1248 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_ee1924e9e14727d560214e1f99e8c93e_conti_elex_sivis.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1248 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 9762⤵
- Program crash
PID:6092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1248 -ip 12481⤵PID:3224
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 1.8MB
- SHA256 667c5007d1ad32bea36e4475b7b0975d306d9e4e1a5df4286cca05c09e5df333
- MD5 0b9827930fe1a4401c1eb23935e80ed6
- SHA1 f60ccd8328e05159682220ab98492f733fe59807
- SHA512 0a553f032bb94b68002147839627b9d6a8ec4765158d3e62b0724855b233eb61719798fa84a65c3d415a71508ceda81387255cd1d60a4690f9bfff99dc68f064
- SSDEEP 24576:JaTC0FhNGpW3EFMFnyezTxNGDd6nCtpzxTuh8WpkPpz6ylzGlvGkw7:JaT/FhNGpW3EFMFntzTxMtpzpDBGyo
- TLSH T1D1954C5AF6748270D0B7C075C5E2AB9AEA7134864B30A6C75385DB3D2F13AF6C639321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512