Overview

overview

10

Static

static

10

2026-06-27...ry.exe

windows10-2004-x64

9

2026-06-27...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    123s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 06:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_7310f813e88d93dc11593db20a42c676_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
  • Size 853KB
  • Sample260629-gv44qaev8s
  • SHA256 0c525dd249501dc8d637f75fa683ff0ac25aab0a8eefd758bbc711a494e5964b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
aspackv2discoverypersistencespywarestealer

Malware Config

Signatures

  • Detects executables packed with ASPack 50 IoCs
  • ASPack v2.12-2.42 47 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_7310f813e88d93dc11593db20a42c676_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_7310f813e88d93dc11593db20a42c676_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:3636
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2720

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 853KB
        • SHA256 0c525dd249501dc8d637f75fa683ff0ac25aab0a8eefd758bbc711a494e5964b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdateOnDemand.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
        • Size 952KB
        • SHA256 db4f3aa60a27a4290741004b6dae49929533890960e00a19a582a73b6f614281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.4MB
        • SHA256 2b3536dcea6517a721ff20d829fa1eaeed7b4ba6ab43c8b4fc20be357e8cf1be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 868KB
        • SHA256 1ba042ad7da8a6501ac29304c9aa07e39ba4a9a0ae16862892c9c9402a9aa9ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 901KB
        • SHA256 b9bd8a899f4a37b27fccd6e12b335af280c0a552f4c5aa7a4737150072be8799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 877KB
        • SHA256 8acce28e7f9bf98fbc1c2a5c2029d33cf26e9a9fe5e445f4460c3222395260e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 877KB
        • SHA256 0566e4ad2679f9337685fb45541f5c9002166c942acac5d63ba5993038dcb834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 877KB
        • SHA256 77d788ef8c1af8165cfa4f8367f768fb520b2e42b6af11bea05b355e87299c86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 877KB
        • SHA256 97dc19b0598dd3f50d80e64bc2d5f15dbb47bd5035061fd9c7f6d9ce36f31ada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 877KB
        • SHA256 988068a164f6f7931f9db15332c6a58aec3830da0cb1936c66fd24e873c5dd35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 877KB
        • SHA256 06a897d704f94810ce25463c76276e73311c0b8b16de8ee9e21e7e8847c4f172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 877KB
        • SHA256 a8c090b279f1f56187e255fc2504f26114db02a0ba3c1e7fdc75d14200b02450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 877KB
        • SHA256 a3f02d259a18d077efccde331e70e4c8b8102e262b351b40dc5f4020bcc99acf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 877KB
        • SHA256 6bb96871aeffce7953798326c8970f05b0562f382debe919b5015a9f0bee1dc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 877KB
        • SHA256 761f5e3fa1f3a2ce2e6a6cdf49355cfbd2173becede3c9213990621393c405ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 877KB
        • SHA256 0722977d557fceaf27386a6a68ac5c9e65a4b887ae104157a7992274bf8a9007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 877KB
        • SHA256 3b7d08358617d4dd4757cd88898b5502e643671bd65fe44d0d0bcd09e10b364c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 877KB
        • SHA256 bbb9a729a1fb0caa8a249444e5aa3d2002ff9495c6344000aafebd3c03d12749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 877KB
        • SHA256 b24dbfac955052059a9fc6b0aa064e824a4a7960080d8f6ebcf903c6fd6597f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 877KB
        • SHA256 005c06659bb058bb451b9157926e1f0a63086223ac471b96b2fd67d9b938ac60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 877KB
        • SHA256 1b44ae2fd3ab8abd90bd76e51a74c91e38629ba10067976c3a249cba5234dce1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 877KB
        • SHA256 6a17d8382fc20a640a46cb36faf29de3e9788b6386b5d53811ecdd5a3f0b2a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 877KB
        • SHA256 99443a1a96261ec73516443a7c51805d51294bec85eb39162f7f2da9c7c7da44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 877KB
        • SHA256 04d617637ac696e61cd7d5feaae72f2e5948c56c2834eca3fbc4af644c3a8721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 877KB
        • SHA256 1388f88e4c7fc13b1f04f7263f024d199f5accde6a93507d86d394863e3e2466
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 877KB
        • SHA256 caf01a596beac0b706b8635e113b473f4b5aedb10299f073008693208ae2905f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 877KB
        • SHA256 1ce72616842aea55114254d8fe5d3f289c76a2fbf702bc10c295318ab7f801c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 877KB
        • SHA256 d121b02adb74fe102f9f33b1570f442fee840701f0d416274de36d0649b0b957
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 877KB
        • SHA256 df5693e969aa97e780cdf8b43334d63e50cb2073881c3f7c51359d07cd7b1a64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 877KB
        • SHA256 0e58f80f9aa7caf8d2b2d7be7cd6298005852215548d6146a2dca83cdfc6b67d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 877KB
        • SHA256 a90653a30aeeeeb64746542a066a8494056b87280cb954f0d5b351bd104df9e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 877KB
        • SHA256 337a9117a24228e9b7b9356a5a4d2d8fff474c774ad9765d7bfc890de704843c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 877KB
        • SHA256 0fcd6ac4b44fe077cd40b75e6bed4423f056ad3ca344638b14f30757ebc861c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 877KB
        • SHA256 ca2e5820163804c170c45440b1a2f1d3be897d76aefeb40948666192595e32ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 877KB
        • SHA256 2171cd2cbccd4995e09e1e2a7840e25834e845703da72cc65ea4900da7f93f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 877KB
        • SHA256 f5dbde807991a41721ddacb16035e081b7320e9d9f28faf2a070018265b12b19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 877KB
        • SHA256 dc4a6ed61e9d0173f7e003735ddc622510a7b901b4aeaffdf8897b21078b69b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 877KB
        • SHA256 ac9d514bec18d2c000d3ed8e8b07779dd2460e1304eeb66149dddca15a491039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 877KB
        • SHA256 7a8caf964286541984bc387c0f9e6fbda2162d451a83dd0ef06f8869fd3f2f4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 877KB
        • SHA256 3bedfe6304224911b4bcfa9d87dc6214c93c0d94052c0447dd04860e8aef2ec3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 877KB
        • SHA256 4414aa42fbd8827da3a76c02af1ac57af696cf1ae7da0aaa450d288aff73d401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 877KB
        • SHA256 ee172cce11b0a53592c7ac20b0dae2b7148b1fd5399910a12fffe97e2849903b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 877KB
        • SHA256 e904d54654f78a948aa2f2ed55edaf08240fe1dbb8fe2e7464f02d33b4123014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 877KB
        • SHA256 56a3a3f0668627cc593b4a5c9fbe6d2610edbdd3878dcd273782538d5bf8ef85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msouc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
        • Size 909KB
        • SHA256 334add8fb63abeb0a8fd8f4f813e2788bc98899b2f8855fa96af05b5f15e2c9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osmadminicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
        • Size 915KB
        • SHA256 6b936e99c1f057fa6b5a2e0bc3c4b9325e5b0428e610eb0418de57e079efa469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sscicons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
        • Size 933KB
        • SHA256 7c743c6b4771b066c7fb0909661679932e022435594a3be52ba047a67225f3bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2720-22-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3636-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3636-21-0x0000000000400000-0x000000000040F000-memory.dmp
        Download