Analysis
- max time kernel
80s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
12/03/2026, 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe
- Size 501KB
- Sample260312-dk3lcsh17l
- SHA256 9777cea162362ebf62e4add299f8e65be458a9584bf5dba9861ef3faa4917d1c
- MD5 b8dd32dcc51e7ac077a5d302d29ba6bd
- SHA1 71d8befcc7d53a4de21aa5b963193d7b3cc74dd5
- SHA512 ac7696707459629610c6a6c069eb709e4a32a9b7ce88198560f24e262b9cd20a8d9ced58fecdbdd653290ae984c41cb5cbb5f4094dc28251c6258cbff655b74b
- SSDEEP 6144:/Iv1x6CYU+2ZsIweIu3P4SM7lnDW9MrlryT9b3P50g/V/YV71TuSN:A94jRlugDHry5yMYWSN
- TLSH T101B40911B752C185E021803A7208F5E1B53C34356637499BB386EBB92C95BFED5ABF0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Play family
- Renames multiple (6914) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-747994418-3253881032-1527946131-1000\desktop.ini 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\desktop.ini 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\desktop.ini 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\P: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\O: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\R: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\W: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\X: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\J: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\L: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\S: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\U: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\Y: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\Z: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\B: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\I: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\K: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\M: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\Q: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\T: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\V: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\A: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\E: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\G: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\H: 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-40_altform-lightunplated_contrast-black.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-125_contrast-white.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\he_MASCULINE.pak 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxSignature.p7x 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16_altform-unplated_contrast-white.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailSmallTile.scale-200.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\SegXbox2.ttf 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WeatherAppList.targetsize-24_altform-unplated_contrast-black.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-400_contrast-white.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-36.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\GetHelpAppList.targetsize-40_altform-unplated_contrast-white.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-96.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-60_altform-lightunplated.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\css.js 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ui-strings.js 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-125_contrast-black.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipThumbnail.svg 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-150.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\MSFT_PackageManagement.psm1 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit.svg 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-200.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-250.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-60_altform-lightunplated.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\SmallTile.scale-200_contrast-white.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib\version.js 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\selection\Selection.js 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\TEMPSITC.TTF 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\contrast-black\CameraMedTile.scale-200.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsAppList.scale-100.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\fonts\index.js 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\ui-strings.js 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\hi-in\Resources.resw 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-48.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-72.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-80_altform-lightunplated_contrast-white.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-20.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\dom\elementContains.js 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\BOLDSTRI.INF 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-64.png 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\Dropdown\Dropdown.types.js 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriL.ttf 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-12_b8dd32dcc51e7ac077a5d302d29ba6bd_amadey_cobalt-strike_elex_play.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4832
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-747994418-3253881032-1527946131-1000\desktop.ini
- Size 1KB
- SHA256 96cb098ee55d8169bc76409da6d31220bd7e81147008f620d4ed3fd6df28e3f4
- MD5 5434c52f0870a62d94667f6aca87aca6
- SHA1 20c0e8e73b74676bffbfbd9c1ae4cfbf68d06ccd
- SHA512 32c1244a9b70c306e9d2a3739c2c47739217efeab127f3698a96685c51d2ae0e0ff3ca0ab4244c68c996b8266c925cae8b8fbbdd35bdd029ef36720b07c6c838
- TLSH T13521D75B8BC0F1434867817F6CA45BEAB6980F501A024ECC2F176EC44DDD1E02F838E1
- MD5 SHA1 SHA512 TLSH
- Path F:\ReadMe.txt
- Size 32B
- SHA256 68330c7155a1b715274d0e21313f0a07c1a4c0ed6fdd1b1c11f5e2af67da2bc1
- MD5 f30211779cde078fcf2476163e215d17
- SHA1 2fff007602cf990949c2de90029b2d111e5d7b42
- SHA512 be6cd06d96c5b0cdb9d3253ee19559bbafae9d02a08d38b5e6a59ea1b7fd9771acf308fb7d4361576ed89ebb94d3e4694cb7039c56cb7ed575d3b271f0dc36e3
- MD5 SHA1 SHA512