General
- Target 2026-08-18_994b4f74d00ca914d09d137520aa492c_conti
- Size 265KB
- Sample260818-hclp4axfpd
- SHA256 f068e41fad5ba0fe6e8f9f057890119915c87aaca8c07c10ffc584a6ff1bcef7
Score
10/10
Malware Config
Targets
-
- Target 2026-08-18_994b4f74d00ca914d09d137520aa492c_conti
- Size 265KB
- SHA256 f068e41fad5ba0fe6e8f9f057890119915c87aaca8c07c10ffc584a6ff1bcef7
Score10/10-
Modifies WinLogon for persistence
-
Detects command variations typically used by ransomware
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Event Triggered Execution: Image File Execution Options Injection
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1