321758765ddc0e02185dd3656bb5b9d11e661069c5324416969c2b330c93f681

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_f69b20542c2139d44caa1a0634deddd0_conti.exe
Size 253KB
Sample261023-b68y6awsas
SHA256 321758765ddc0e02185dd3656bb5b9d11e661069c5324416969c2b330c93f681
MD5 f69b20542c2139d44caa1a0634deddd0
SHA1 2f4df4f49c6a5bdb94661f629e347f372c93bc66
SHA512 68e1d7687a1fe6af7434d77aaf2167dd97218f1511a0de1df3370d618fa46c53bbe5307bc7deb3cd14a7b336812aeb73d890f5afed7b9b38cf481ec5e304b4f1
SSDEEP 3072:StW4iCnxMkwxccbAfmw7BaqrQ3qxIOj2ILx6mwDcFWeuNrVibU7BpOxWJJ4rt5pk:Euq7/r5dj2T5ObU7wi+F5u3mM
TLSH
T105446DC5FBCAACEACA06523589AB43693338F7D117875B170D3972351E23AD0AD82747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Payload = "wscript C:\\Users\\Public\\Documents\\payload.vbs"	2026-10-22_f69b20542c2139d44caa1a0634deddd0_conti.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4212	cscript.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1396	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 1396	3704	2026-10-22_f69b20542c2139d44caa1a0634deddd0_conti.exe	90
PID 1396 wrote to memory of 4212	1396	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-22_f69b20542c2139d44caa1a0634deddd0_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_f69b20542c2139d44caa1a0634deddd0_conti.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript /nologo payload.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\cscript.exe
    cscript /nologo payload.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

payload.vbs

Path C:\Users\Admin\AppData\Local\Temp\payload.vbs
Size 60B
SHA256 4702dfa795642b5821131d0d3eea496b75934f85fb64b725c2110cfb1ee90d24
MD5 c1412b05476670a2c5051e29f1f87229
SHA1 e1b2f8bd4513edc3cd37d0305671bd7d805361e2
SHA512 4fac99244066886f6c3829d64acb6057dbfc6700cbdeaccdd9eeb5906b71d5d4642b545fb13bd67f60e7888321fa30f524a8c803aed286b948adf22457c860ef
TLSH
T1AFA022E0C0000320083CCC8000A0AC80030CAC003C2000280808E200208CC80F382CA3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3704-3-0x00007FF771F20000-0x00007FF771F60000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads