15e1fe22bc0d449923951102d12d508d348c280dee2f9dd385ffc179b735fe05

Analysis

max time kernel
81s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/05/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.2MB
Sample260519-ydma1set8m
SHA256 15e1fe22bc0d449923951102d12d508d348c280dee2f9dd385ffc179b735fe05
MD5 64b5002ee2ca548c1d07a3384b904cd5
SHA1 5e78009e8494b8765e212a404fd00612b3cc2456
SHA512 bd7d7f20ec68009f9a43373026a6942ec8ae8a4b1839cfc964d212d96a97ed864035f4d109c264371158041bcd7676d2ce9d9bacac202a283bcf9ff03cac6fdb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bis5jcAkSYqyE:A3k03kHRJYpYq
TLSH
T1D9457C17F66441B5D063C1B9CAD2AA66FE313846173097CF1389C7282F63BE19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 13 IoCs

resource	yara_rule
behavioral1/memory/3700-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000700000002445b-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4804-7-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000022bd0-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3700-40-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4804-65-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000200000002353d-135.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x006d00000002134a-1262.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0002000000023336-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000200000002332a-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00150000000202e1-1528.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0007000000024460-1590.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000900000002445f-1614.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000700000002445b-6.dat	aspack_v212_v242
behavioral1/files/0x0003000000022bd0-12.dat	aspack_v212_v242
behavioral1/files/0x000200000002353d-135.dat	aspack_v212_v242
behavioral1/files/0x006d00000002134a-1262.dat	aspack_v212_v242
behavioral1/files/0x0002000000023336-1326.dat	aspack_v212_v242
behavioral1/files/0x000200000002332a-1328.dat	aspack_v212_v242
behavioral1/files/0x00150000000202e1-1528.dat	aspack_v212_v242
behavioral1/files/0x0007000000024460-1590.dat	aspack_v212_v242
behavioral1/files/0x000900000002445f-1614.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4804	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3700	2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
4804	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_64b5002ee2ca548c1d07a3384b904cd5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3700

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.2MB
SHA256 15e1fe22bc0d449923951102d12d508d348c280dee2f9dd385ffc179b735fe05
MD5 64b5002ee2ca548c1d07a3384b904cd5
SHA1 5e78009e8494b8765e212a404fd00612b3cc2456
SHA512 bd7d7f20ec68009f9a43373026a6942ec8ae8a4b1839cfc964d212d96a97ed864035f4d109c264371158041bcd7676d2ce9d9bacac202a283bcf9ff03cac6fdb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bis5jcAkSYqyE:A3k03kHRJYpYq
TLSH
T1D9457C17F66441B5D063C1B9CAD2AA66FE313846173097CF1389C7282F63BE19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe$

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
Size 1.7MB
SHA256 cd440f58e50a9e2c64327a440257ad3ee52759ade99dd87563dddaf1d59024fd
MD5 99a6ec02e550775c110342219b5381fd
SHA1 798f02d3093a3f3f88c20e68129fab60a2ee348e
SHA512 08e6ac261d01f67ca76240cba7aec9378dacfdefae0e4b41872e9fe95f3282041b9579737ca67e234fddab68fa74a40c18befacdce50b0b2c0bf95dc1895b9b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bis5jcAkSYqyEX3Td9CHKy7GZO:A3k03kHRJYpYqHTd9CHKyao
TLSH
T154856C16F7A401B5E073C179C9E29656EA7238461B30DBCF139896292F33BD19E39B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 1.3MB
SHA256 351e96b708aa75331482a30bf2139fef4c05c05bd8574d87c9fe9e7400f604c8
MD5 33b97e50644303478ef17166cfc71939
SHA1 fe2d426547bf0bbfde9001d3c2adc35fbbd83db6
SHA512 5bf540032450dcc382fb7f0de5d538e01a2c4049691f2665e5d80bb78a5ffc9b7dcfd400da7b741b095c59049d6d936b4db052eb533cf924679a89394c9484d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bis5jcAkSYqyEdTjE:A3k03kHRJYpYqdw
TLSH
T150557C17F6A441B5D063C1B9CAD29A66FB71384617309BCF1358C7282F23BE19E3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
Size 1.7MB
SHA256 70c39ae70926c308e2619791beda54600263a54faacf792d5f4620324bc7286b
MD5 ca336698cdf380e17a4f3a7540ee9dce
SHA1 97a35c47631817d15c89a1ba7c0cf4a5945f173d
SHA512 a829c34f9e6d505793aa77e61abef782b7c5f443c0f7838482d492272324940a37781f820f875dc594f5b7d6f2705fa89335b82902536ec4ea2c5e1bced16399
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bis5jcAkSYqyEe86n9kAJ9tA3L:A3k03kHRJYpYq+T9t2
TLSH
T1BF858C16F7A842F5D067C178CAD29656EA7138860B3097CF1394C3292F27BE19F3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.7MB
SHA256 38d0dabd19c23d57ed8a2ed925e686a4c4f90d13a49bb9a060b302900cbb7a37
MD5 6328f21d08905a8214668f3c676815fa
SHA1 822cf0518393d8d7f0293f6755f27108c76e2423
SHA512 f9ec2ffeb5081435612c2515b1f0d31ae25ab44604e9dd68f42a5a1b14dce6e519f3459cd4cbb4643c4a0a46b7f3bd1b6ff6f3ae5d7ccf3013c75b0ab80a28ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bis5jcAkSYqyED0Le5ji0hmxNrM:A3k03kHRJYpYqjPji0Aj
TLSH
T162856C16F6744275D073C0B9C5D2AA9AFE71348617308ACB1385C7283F67BE69A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 1.3MB
SHA256 c567daacf6e3cb14f8842cb4878664673ec53e5a0f48d560574d5a81807c7ba9
MD5 b714133fd8bf8b4d25d4c07a370aee1c
SHA1 d0cd1da8ad8bf0527aa7afe8eea2614536e98b08
SHA512 24caacc856cdea358124f460d44198de58f4e88a0abab0b97ad4c52a2c742c664724c486270b1f534f8bf4c87bafdf70afc5d846bee2d3ba67b2a9b71a2f8a8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bis5jcAkSYqyEYD:A3k03kHRJYpYqk
TLSH
T1C9555A16E66401A5D06EC179CBD29A56FA33384607F096CB13C4D63C2F23BD19AFA763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
Size 1.3MB
SHA256 d2c63c95f6927a286ed8056c7fd0959874ae00ee7727623aa95675004e462ba4
MD5 8c393cc928e1501cbcc457dc0ff55b2b
SHA1 539363b75e78593d8bd4d3d8542f66abeeb1ba02
SHA512 50e84991799074ddf8eaa7d307deeb09c9d92d0161a5bd37925b8703e7be6fa3d0bb2e12da41886c4f795d21b4ec8760edeae836e5d39689646d0389970d963b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bis5jcAkSYqyEPF:A3k03kHRJYpYqt
TLSH
T184557C16F6A442B5D063C079CED69A66FA313C8507309ADF1358F7292F337D1AA3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 1.3MB
SHA256 b56d4a26a8b226e7d246697dc924dc8a81cd323b3bad6c813fef294315280391
MD5 71970e9645f997b84b4fcd6483cd235e
SHA1 deceee1b90926be5c6d3be78294d0c85b7e07e6c
SHA512 38f6f5288ba09d179c1781c9f979f76a9337b3e53dd3e9945da0788bbe2ded86c1562416d38f660d5004d2a43bb3c468f7ba1367869eb020860c9af6ca0557c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bis5jcAkSYqyEi1:A3k03kHRJYpYqI
TLSH
T169557C17F66441B5D063C1B9CAD2AA66EB713846173097CF1389C7282F23BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe$

Path C:\Program Files\Mozilla Firefox\pingsender.exe$
Size 1.7MB
SHA256 c151f127c509611c79475ab70c3247f3879a261f2473d9ca3fe3dae87fd0db3b
MD5 c302892f1d13636148c6f39ed47d7065
SHA1 543bcaffd794f03410eb4a0f3f65e7c4578afccd
SHA512 820d46801c87b81a622ffcd0602a4501f39a2854f0257582288f7ccac76c28538cf81146308bb47464a7ab8ace4ec24db550c50c83e3a515cda95677656f00c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bis5jcAkSYqyEDYAdvlXiUn0N+P:A3k03kHRJYpYqndNXhn42
TLSH
T181857C12F6A545B9D027C078C6C79676FA32748907309ADF2398D6382F27BE19F39760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3700-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3700-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4804-65-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4804-7-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads