Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 00:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_e01b97aaf8a3b9332ff5127799778d82_conti.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_e01b97aaf8a3b9332ff5127799778d82_conti.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-16_e01b97aaf8a3b9332ff5127799778d82_conti.exe
- Size 220KB
- Sample260817-ap998acm2x
- SHA256 fd40df702f1da3e260abe287305f2bf049b53ef0fe0e4b8e6faf1d3610fd5777
- MD5 e01b97aaf8a3b9332ff5127799778d82
- SHA1 987b2aac61608e4d9005c08ca8bf1301b014ec6d
- SHA512 422e5c38b1be6b083a9ac6db58008fcb2533005ffa1a2e155dd90bbe35cd135f0f59f303d657d98ba096682dea83e1eea0a1a7555809287757ed32c5200155f4
- SSDEEP 6144:aDVjC3RClgK6XqYaQgRo4uUHOm3HF/lx5+Fv7ED/:uVe3RC+KaqYa1JHOm3l/lx5+FvYD/
- TLSH T1B9244AA2426B4CC6E4A57DF4A384C090C429C157EBD2F9F6BC574896A5AC9E0CE7D3CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1332 2026-08-16_e01b97aaf8a3b9332ff5127799778d82_conti.exe - Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B5D8D8F58A88EE46C8C994B6F08D02A0F1E096D5\Blob = 030000000100000014000000b5d8d8f58a88ee46c8c994b6f08d02a0f1e096d52000000001000000350300003082033130820219a00302010202144b4c1bb2325342db3f0e9e962055dfac878cf27b300d06092a864886f70d01010b05003048310b300906035504061302555331193017060355040a0c104c6f63616c204d49544d2050726f7879311e301c06035504030c154c6f63616c204d49544d2050726f787920526f6f74301e170d3235303630333134353832345a170d3335303630323134353832345a3048310b300906035504061302555331193017060355040a0c104c6f63616c204d49544d2050726f7879311e301c06035504030c154c6f63616c204d49544d2050726f787920526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100cea086cd15e5ae63b6f9aef204437cfc1e98e19ef34814d9d1dc6b2a08a7b168734d190b7bfd9650dec25df0029b2645df2cd1672eb15ed213c7232b03854e7baef82335b17b968ff6d01f2e48108288e17dfab78337e4932a8bb0f9db373bcfe25fd7e2663f9601db07ced111377d4e36f892748ac47f9a789a496d0676d8b06f740d21a0b98039ec2b62493f4460fb758d86326eab84758c4582a2e7081ac475d6fe41c1ff113166876163e12ec6278defce55b444a2e086ac1b08975ac07471c15450ae6c02dde4e5bcd25f0c681b0e3f44778f3e575cb7396740a3c1f484879dd32d3fe819a945d464a66e35c78b1f2d77d635ad94c88f0b25c8dcda133f0203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101007601792c1f705679df30a35919c40cedab45d64e64ecebfd1aa51cbf9183d47a4160a40c6cb39a2846f63cca0e21267835fcfb4f5c1b559d0e04506920db2456e7a3da04ae6bad5681fbacd65c0f2715e28749c71f1907831f9a5b4fd1a5efe3268e85146e8eb4eea030b3663fd94804f70fb092e6eb9e63cdf47a65cdacd206656b5c9ed052712a59f631b0466a1c88a3231719e290ff8ceedf9deeef5fc545e51ecbc5e767f38830f2b7b1c50e81d588c7585d9e858e70f99769434e04aec4a6e074ebce8a0eafad1bb1c76adc5493233d3c92da80b54859340e6a1fed75e4355bff96a1e85d8c9bbd2515bd4ea6dbceec690244d14dbbb715e19faf0f4226 2026-08-16_e01b97aaf8a3b9332ff5127799778d82_conti.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B5D8D8F58A88EE46C8C994B6F08D02A0F1E096D5 2026-08-16_e01b97aaf8a3b9332ff5127799778d82_conti.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_e01b97aaf8a3b9332ff5127799778d82_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e01b97aaf8a3b9332ff5127799778d82_conti.exe"1⤵
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies system certificate store
PID:1332
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\A3593987.dll
- Size 203KB
- SHA256 b2338aa5fbec72d5764f89729de12adeae47e0182f50dd6f567328af94ebe686
- MD5 c9b84994f8ae43f43a17eea0470f8b11
- SHA1 f1f3e05b8b7085ff5c341896d70742b15fac237c
- SHA512 a39e0c571bc9eb11ace1640e0dce0e08449333ca78da5e07a59ab2e54984800eddfe83153ca72868b2cf14e546147a611661b5ca8422eecf33de41d782f37003
- SSDEEP 3072:M4o3G9iMkwL3GUk1dQ+4E60lO2As/HERR:1kwL3GUGyEOlssRR
- TLSH T15C145C91FBD2AD4BC62261388ED743693339F58403635F37496862393D9BED09E87683
- MD5 SHA1 SHA512 SSDEEP TLSH