Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe
- Size 83KB
- Sample260801-da2w3swdjf
- SHA256 dc2293dd7cf47d3700a91a62df6b0c358d9aa3165191757d1adb4cc85e429b9d
- MD5 ab37edced561e99b6734ef42f069a0cb
- SHA1 6bfe5b32fefef27c5df18e2fe517a5722f04a446
- SHA512 69b75cdb319d36d86f4b57d9ff1e82a27c0b174452b8cddffc6c4be8b6850608bb5a74361c7672234d71c53df075fb1d0413936d64a467094cc80d46a7e9d571
- SSDEEP 1536:2HnERoZdnOfXUdeHXUdekLaTMSFWjXUdeSFhNGpWSNNxEycf0sgTH3hh6:MnEOLLaTC0FhNGpWSNNxpsC6
- TLSH T11083B89E2AD99142E64785B78473D8F4AE396DC029300367E349F5F72EB25F2722E074
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File created \??\c:\Program Files\desktop.ini 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Common Files\microsoft shared\ink\bn-IN\tipresx.dll.mui 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationTypes.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ja_NEUTER.pak 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File created \??\c:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\da.txt 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\af-ZA\tipresx.dll.mui 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.Win32.Registry.AccessControl.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es_MASCULINE.pak 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pl_FEMININE.pak 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Forms.Design.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\ReachFramework.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ro_FEMININE.pak 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\ro.txt 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sr_NEUTER.pak 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\th_NEUTER.pak 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ta-IN\tipresx.dll.mui 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebProxy.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\fa.txt 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationClientSideProviders.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\prism_common.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\eula.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\management\management.properties 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\adovbs.inc 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.Lightweight.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Input.Manipulations.resources.dll 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ko.pak 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2032 5108 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_ab37edced561e99b6734ef42f069a0cb_conti_elex_sivis.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5108 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 9682⤵
- Program crash
PID:2032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5108 -ip 51081⤵PID:620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 1.9MB
- SHA256 5b73b7a43276bf7c4f435db68029ca47d24e2ca310db59d9feb172e70e2214d5
- MD5 d1e4cd51c65b765e8b2ba4079cfb3af3
- SHA1 ac9dc4e0a81b4096652fcb63069773cfe884283c
- SHA512 0fd124197800142d9685cff3ddec51df9dadc236f7f1bdd656938e4a04a32afab243c9ad5aed6952228ae339a329451a7bfb4a308bd41cdb1b69811e8dd6010d
- SSDEEP 24576:yaTC0FhNGpWOs/ezTxNGDd6nCtpzxTuh8WpkPpz6ylzGlvGkw7:yaT/FhNGpWOsmzTxMtpzpDBGyo
- TLSH T1DF953C5AF6748260D0B6C075C5E2ABA6EE713C864B3096C75285FB3D2F33AF58539321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\sunec.dll
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512