Analysis
- max time kernel
133s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/04/2026, 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe
- Size 481KB
- Sample260405-argqpact51
- SHA256 ed7aa56a0e6c6c599b902634c518f513fe95c4b7c2c9d7b1d048336b991231d8
- MD5 288511809b3163135dcd8faf22565f5d
- SHA1 8fb3ce0ad25e836bdacf3de62b8f6476aa72029b
- SHA512 7a3cd9d8d0e44bc77f535ce4822e61b0b27676fb8b3bfee1a2aad22daff5dfa184fe52eeadf9740b182987ad95d90eb7e2573c8c3e3bb1b79cd5166873e74d06
- SSDEEP 6144:DHXWS65142aW9UW5NQjmlKTjJPklj64OLg8C9jK/TIeoXqDtPGsCgBjEHVC6u:jXW9aWdKT6jMKWb/oaDNGkC1C6u
- TLSH T1E0A41B21E651D346F02180B76219EAD2747831325A62865B33812FF93DD69FED2BEF07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Play family
- Renames multiple (7844) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Public\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Public\Music\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-747994418-3253881032-1527946131-1000\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\Z: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\A: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\B: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\E: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\G: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\H: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\P: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\V: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\W: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\I: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\J: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\K: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\N: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\Q: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\T: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\U: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\X: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\Y: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\L: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\M: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\O: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened (read-only) \??\R: 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingNews_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.scale-125_contrast-white.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_scale-100.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\Tented\TentMobile_100x96.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreStoreLogo.scale-100.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\ui-strings.js 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\CameraWideTile.scale-125.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-30_altform-unplated.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-400.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadSmallTile.scale-150.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WeatherAppList.targetsize-24_contrast-black.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-256.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-16_contrast-white.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-24_altform-lightunplated.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64_altform-unplated.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-57x57-precomposed.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\createpdf.svg 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\ui-strings.js 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview2x.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforcomments_18.svg 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Todos_0.33.33351.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square44x44Logo.scale-125_contrast-black.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\CertOriginUntrusted.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLargeTile.scale-200_altform-colorful_theme-light.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\SLATE.ELM 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Icons\StickyNotesLargeTile.scale-125_contrast-black.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-400.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-80_altform-unplated_contrast-white.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib-commonjs\elementContainsAttribute.js 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\wmlaunch.exe.mui 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TipsAppList.scale-125_contrast-black.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-48_altform-lightunplated.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\extendComponent.js 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\mobileDetector.js 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\Assets\Xbox_UnplatedLargeTile.scale-200_contrast-black.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-20_contrast-white.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-72.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\KeywordSpotters\ja-JP\Cortana.bin 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_contrast-white.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-400.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxBadge.scale-125.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-125.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\Retail\Retail_Get_Started_icon.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\TipsSplashScreen.scale-200_contrast-white.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.scale-100.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-400.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ui-strings.js 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.scale-200.png 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\ui-strings.js 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\ui-strings.js 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\test\injectWrapperMethod.js 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\SetupTeardown.Tests.ps1 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\ui-strings.js 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-05_288511809b3163135dcd8faf22565f5d_amadey_cobalt-strike_elex_play.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3136
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-747994418-3253881032-1527946131-1000\desktop.ini
- Size 1KB
- SHA256 92f0f28618ba4fc10bcd99e8cccb263329580fbd88f3db881b7a0524eaa5bc51
- MD5 ca2fa21a10069e176968674baaa32ac6
- SHA1 a997b2052675bff1530cb19d5ac2a7ff7b6dc1c6
- SHA512 b22d94d6c6ea3cf42c7004efb45772434f5ddd89faf1c7c6376ed96a74d794f211afe89540b595b9e5a8da09f2a7cedaf5c89928f1129d1bea1f4f8f03bd5980
- TLSH T1E221EA109610C492ECF4C36A8824CEDE5533CC5F4D6010E74A7770D3256A86BF4185DE
- MD5 SHA1 SHA512 TLSH
- Path C:\ReadMe.txt
- Size 539B
- SHA256 834737ef7c21cb71ccfb228b1bb73df29c8e74ae87b01eeafc06b47165f88098
- MD5 06edaa011acff529faa61af2aac82cbd
- SHA1 8b18fbcdf2f34cf3007a4afef0683ff6131bb771
- SHA512 387aa142db9cbfb5f70cc65f4d71b9948d93a06d85e677f2b351bff1eee1130ab91bfb209eb8d9ed29bd4144305149ec7eef41a605595337c2b26c93c6202e0b
- TLSH T1D0F0758FE468591111840416E00FA551B350BD1943AFC9D90AB073DD20D8FBF7B0B34A
- MD5 SHA1 SHA512 TLSH