162ebaf11c28a37a2af386637d91b473d5129143266d1f132a8ae19da257d477

Analysis

max time kernel
110s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.1MB
Sample260522-t1rf2act9s
SHA256 162ebaf11c28a37a2af386637d91b473d5129143266d1f132a8ae19da257d477
MD5 58269fac55c58d62bae53ce6b229cb3f
SHA1 5c0b769b86b14df4d46c3aff5da6fb0fd9a4b717
SHA512 067afbd66b95af2cd9c678cfa77b135b1de193543c164563c6403815f45d6c3afb450c7c26b7b4cfa20b8504a57cb7c06a7fb64b6b749279185f869f6d796d33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccF6RqD5TvinrmC:A3k03kHRJx56rX
TLSH
T1E5455B13E6540FA4D10F917496994622E677BC0A1F2093CB137CAE253F26BF07A3D66B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 12 IoCs

resource	yara_rule
behavioral1/memory/1164-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0007000000024625-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3740-7-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000022b88-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1164-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3740-107-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00260000000212dd-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x001600000002029c-1532.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0007000000024675-1766.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000f00000001690f-1875.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000500000001e837-1924.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0008000000024647-2079.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0007000000024625-5.dat	aspack_v212_v242
behavioral1/files/0x0003000000022b88-12.dat	aspack_v212_v242
behavioral1/files/0x00260000000212dd-740.dat	aspack_v212_v242
behavioral1/files/0x001600000002029c-1532.dat	aspack_v212_v242
behavioral1/files/0x0007000000024675-1766.dat	aspack_v212_v242
behavioral1/files/0x000f00000001690f-1875.dat	aspack_v212_v242
behavioral1/files/0x000500000001e837-1924.dat	aspack_v212_v242
behavioral1/files/0x0008000000024647-2079.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3740	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe$	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1164	2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
3740	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_58269fac55c58d62bae53ce6b229cb3f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1164

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.1MB
SHA256 162ebaf11c28a37a2af386637d91b473d5129143266d1f132a8ae19da257d477
MD5 58269fac55c58d62bae53ce6b229cb3f
SHA1 5c0b769b86b14df4d46c3aff5da6fb0fd9a4b717
SHA512 067afbd66b95af2cd9c678cfa77b135b1de193543c164563c6403815f45d6c3afb450c7c26b7b4cfa20b8504a57cb7c06a7fb64b6b749279185f869f6d796d33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccF6RqD5TvinrmC:A3k03kHRJx56rX
TLSH
T1E5455B13E6540FA4D10F917496994622E677BC0A1F2093CB137CAE253F26BF07A3D66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe$

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
Size 1.6MB
SHA256 ddb67d6e4c6d6e38b250761c136bfe2a47e867ad4f24a76d22817b131d3dbef8
MD5 5eec57c47498ecfda279bb8c80d62a33
SHA1 c402e28b013fc367aa7aa94a561b6f5318a7afd3
SHA512 5d03005659ba3e454c08132ed9623d9c1ef12593250348504285a3cf71820e1c394fc5333b3ff1cc81e12a7afdfaf68a12bc71ea24718a4644402626b6d02a81
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccF6RqD5TvinrmO3Td9CHKy7GZO:A3k03kHRJx56rXTd9CHKyao
TLSH
T191756C13E6940EA4E12F913489A54512E677BC5A1F2087CF1368AE153F32BF06E3DB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe
Size 1.2MB
SHA256 32989a67b58efd9055cc615e52b30fff83daf54019e5878a82614fee012be541
MD5 aac0d252a8baec31a425a7c9df608d1c
SHA1 f23260f12908d02ab2fcf10005094c708ab8e4b3
SHA512 676272020f4af88d97a5a6386f60bb418b79995e7952df483dca75b51b0e7b1153901072d1de39b5217ee42dca6f68ad37091a158c5e6097865ecea0a57984f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccF6RqD5Tvinrm+TjE:A3k03kHRJx56rNw
TLSH
T120555A13A6940EA4D11F917486994622EB73BC1A1F2093DF137C9E253F22BF07E3D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdge_X64_139.0.3405.125.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{51A7B87B-57A4-493D-87A7-45DD03C49092}\MicrosoftEdge_X64_139.0.3405.125.exe
Size 1.2MB
SHA256 87f9324bad89a4a010718a55f2e27f0e5fcd44b692d8e2abff2f1550bd3ae60e
MD5 5675df216bc2c1d3f3da0537a7fc1bb5
SHA1 4c5b0a7a2a5fd9ea780582bec78d98a2b9f75315
SHA512 01513bea4259901acd0708fd6412d36c106e4cae829f174cb268f49e605d352803e8276b94807b772194ceaa2633e0c77b5fd24c922409fee08e0172b7ef8aff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccF6RqD5TvinrmcbBPzBAU:A3k03kHRJx56r9BPVAU
TLSH
T18A455C13E6840EA4D10F913495994622E677BC0A1F2097DB137CAE253F32BF07A3D66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe$

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe$
Size 1.2MB
SHA256 dd1f8fa3a2ca549a6057bd4e1e33c38566a92982e19b006903a18147c4928c0f
MD5 38fa8bd445bb870029ba1adadce3179d
SHA1 85a688b1e930cf371e586b13d19ef1747a79635a
SHA512 ea26ff5f055958db1086bab618c19019434dcef84dedb2404418ce0c46135f08b73afbaa5f42572c00473a1849e3bbd2410c88f4608068deb0a45094c03fdab5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccF6RqD5TvinrmpGen:A3k03kHRJx56rJI
TLSH
T176555A13A6940EA4D10F917486994622EB73BC1A1F2097DF137C9E253F22BF07E3D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.7MB
SHA256 9494a6c3835d1c91eda49f0b0fb22c036a52a6d6e4f39548999699f28ef8bf61
MD5 478e325528288094a3a5aa5b5668f5d8
SHA1 b6fe64e843d1372801f6fda481e40a20e2a0a56a
SHA512 b54ed7a39e963ed6ddb6df03fcc2fb2669e5cb8bb22c58415e79fcf49f69dd02373fd60df94fe823b07afc01102d5b92b0e760cd2de033b86e68610864f5ef30
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccF6RqD5TvinrmC0Le5ji0hmxNrM:A3k03kHRJx56rTPji0Aj
TLSH
T1C5854A13F6644B64D02BC074C5D69656EA327C461F3087CB1368DE283F27BE1AA3E766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe$

Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
Size 1.6MB
SHA256 82a82e600947933ebd731430ca38aeefeeeeb96184cd1e8f7091b905f56398bf
MD5 341734075657aa48039e430524541973
SHA1 65fc1929eff904514f6c7f3876171016659e352d
SHA512 51f7b7f1c9d7e090079b9a2a6a9cafff0df51f3af919fa1a375732747ed9ea84fb5f49321f9184ec97af5be9bcc7f76012b9194703179ff026b0045ece901e01
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccF6RqD5TvinrmyUOlZ7q/c9:A3k03kHRJx56rjUOlk09
TLSH
T117755A27EA544EE4C11F817486968611E673BC160F2097CB636CDE253F23BE06E3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdge.exe

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe
Size 1.4MB
SHA256 2e50672cb2b493feb6e8a744b2919943e665e5cccae4597c80240adf46192755
MD5 3944741d1b7fbb235f2d53571a6827ab
SHA1 dea6a58481c95355b2a39ee2cb1958ad43277b2e
SHA512 50e089b6af6e37f9e79c2b734baaca5b967bd6801ae894a12b5dd06f299f46ef95fd73edc8acd971a988e857d477ed955e1d0f9de70a6af1c34039539b3a2864
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccF6RqD5TvinrmQV+PAk2hMH3:A3k03kHRJx56rPi2WH3
TLSH
T179656C23A6940EA5D11F913059994626E737BC0A1F2083CB136CAE193F76BF07A3D767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1164-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3740-7-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3740-107-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads