Overview

overview

10

Static

static

10

2026-06-29...ar.exe

windows10-2004-x64

9

2026-06-29...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/06/2026, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-29_b62e0368afb99c1ddf6ee3d14dd078bc_cobalt-strike_conti_elex_hijackloader_vidar.exe
  • Size 821KB
  • Sample260630-e6cshaew6t
  • SHA256 af58d2f5b8d7a10b3f9fedc22214d020ca0d9667c7670c3850c05bf44961d885
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwareaspackv2discoverypersistencespyware

Malware Config

Signatures

  • Detects executables packed with ASPack 50 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ASPack v2.12-2.42 47 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-29_b62e0368afb99c1ddf6ee3d14dd078bc_cobalt-strike_conti_elex_hijackloader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-29_b62e0368afb99c1ddf6ee3d14dd078bc_cobalt-strike_conti_elex_hijackloader_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:972
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3636
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2404
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2200
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2524

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 821KB
        • SHA256 af58d2f5b8d7a10b3f9fedc22214d020ca0d9667c7670c3850c05bf44961d885
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.3MB
        • SHA256 6f69b38a3ba36db15f97f34daa9edb68072f43e25bd76bfff2032fb2c4f9dec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 835KB
        • SHA256 a636a83e86c823e3c42c445533525f3d23ac88c77ea8de36d1b196192e3b00e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 869KB
        • SHA256 4ee53009f8b87231dcc69fdf5ff264e06e84c1dfd855299847e9f9681ddc2b50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 965KB
        • SHA256 696a9bab116762975cc98ed296a238e97785565108bf4d6a09948e5ee90f7792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 845KB
        • SHA256 9fae2f03819c80473b82b3e3698858e0a8ecf372266fe4737e7dc894e280985f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 845KB
        • SHA256 1c44593170805f7157d8e7cf7430610e0ce3b4274c3dd9b8d8ddcfd2cfd326ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 845KB
        • SHA256 8142288807b5e8fa5e64917dbf03573b1ef2c30088d170d486d435a53a965215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 845KB
        • SHA256 3badd05f1489af2c12e9ef9a1e6e81244380b895f7ffc86c139ab074f8612aac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 845KB
        • SHA256 3a6a20617ea635ee8ef5c181b0718589b9ee117a89c3211e7854269c1fc088ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 845KB
        • SHA256 d219b365b6d95199bf30980c11d8c8f1a603bc435f8ac8494d4170fb5b5d5ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 845KB
        • SHA256 644ae1f74a1352fab4f3e0e8c1f17b191304e30f54981cc8170d25d070095d56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 845KB
        • SHA256 890869fe41077821975909d895d598d147d87fa0dce85114e3d5b9548cb7d1f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 845KB
        • SHA256 ac6062aaf3e8abde9a0ba8d7f0c3adf4ce048cadaf3376d6c99356ff577888ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 845KB
        • SHA256 4a4d365219cbe6b97c438890a28560c190bc461d084c322f2e72c1173f1f8a26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 845KB
        • SHA256 d56c5923287af21207762af5a74fb77fff43e4d81338f4a9006d11181bc7e971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 845KB
        • SHA256 8e54cefd73f1a983032698c719d28bdbd0d55779dd65807d8f721935cdfdee25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 845KB
        • SHA256 8367f84bd63063a099e9a3b109b3466815bf133488c2b4e8e3e6103815c0b738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 845KB
        • SHA256 ee090d18d7ca4442ab802f0b39eb966f38b6d0fa1831c267ff52f434426b8510
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 845KB
        • SHA256 0ed4ceae7e93e8483bf266d27f7d2a35a293810396dce5ff3e9f24adf4b45d5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 845KB
        • SHA256 84e6f8b21c9bd79bcbb94ad782499d89ef0da1fd2b34602d9fd75b9e14b5dce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 845KB
        • SHA256 2d66b9bb676f109d671e760e04708fc713f5a31589988ad4f87ce2a173098971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 845KB
        • SHA256 7b2f3f8d27f2feadce02cfb2ac607a3c6c42b38f39e9ab137360974cade26dff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 845KB
        • SHA256 3b6675ce31135fbf5250389cd780bc690b7b0c6e0ffb77e4cec9a2cc10149474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 845KB
        • SHA256 a6e983b0da601fee873535a18d9a8071879bd3eebc281cddfe39df7852e5db0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 845KB
        • SHA256 b806616173d2652ea4c80db9c23d2d626d706c51f457fdcb617b2f67f818d399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 845KB
        • SHA256 deea6b8dda7a03b64814c73e523dba23fdfc262a4f9f85374fc7c5a0655e8ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 845KB
        • SHA256 f34a81ed5e1e8e047f9ba9c3bb6daf42ffd1bc563f4a596cf16266a8408c491f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 845KB
        • SHA256 8aa1f5d19a3128cbc0e7add2bf630ef6a9e79468006a6bc0a5eb5009df3a0932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 845KB
        • SHA256 036885ae6140c8ff06afebed10e40751db228256f4d7ef65edf616b643e8d13a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 845KB
        • SHA256 16dc7bbbe61b5fb3f746210531d9b1a3068e12d0c9fdd6762797ea8a315ab7cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 845KB
        • SHA256 e14bb0d2d2e643c59a924b6f9104d09df7ce52e2bb1295e0becc2f9690cfc46c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 845KB
        • SHA256 be79b3c7d1380f37e1d353c724b6543cbec86611a5763894aa8675dc7f9e0582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 845KB
        • SHA256 ff4c6c03304711f4fb38d961f91c32f14df41ed179c540ead0b88dba6cb62f8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 845KB
        • SHA256 569b9186334b1ebe02d1951d8e9b5c79c116cb02720325d62d21415036cd30cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 845KB
        • SHA256 bf980eab9bb02b6800ed211c264e962d1ee446aff3a62ecb7f671ecce7375812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 845KB
        • SHA256 4f9104694dccf8992de9ccb517b2898b7c3fadd124b265b890da8b505cbc9d25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 845KB
        • SHA256 19161a181bcc4e1f481e9ea378fe650a1a4458d72c9301351c635d7f063748da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 845KB
        • SHA256 6f927ea9ca365a366cca320e04a988c91248ddee774db078ba9f3c07ba3b623b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 845KB
        • SHA256 0481ac6d5c7d6e66372a4297d505ba9afbe01ca23070286916e67c969db44672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NAMECONTROLSERVER.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE
        • Size 963KB
        • SHA256 3c83aca7fe266ccec86bcbfce4620e3b4a4acedb546dab2d622b2f456e35a152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OLCFG.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE
        • Size 946KB
        • SHA256 9710de732563c21e4a446f55bcdffc211411e1dac0359562a7a04bc37d329085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SCANPST.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE
        • Size 936KB
        • SHA256 aa23d02bcf4ef1eca8a4ab65b967a42fee2d57ed854bdd6799919916e2b07124
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDXHelper.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
        • Size 976KB
        • SHA256 e87548cc0b65d5ce06cba97626aa69c671356da2b9a69a8f43c87b3a56f375ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDXHelperBgt.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
        • Size 854KB
        • SHA256 850f8d1580315f02c56e0fb404e69f2e0d55329d41e86e2b8649dced292b98c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETLANG.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
        • Size 897KB
        • SHA256 b7acd9d86c672ba98db077e2c11cbd49b914031643f3a76152324a3927bfc101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wordconv.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
        • Size 865KB
        • SHA256 57204485a550e9e0c6c47c86ec38743b6bc716ffd47628b7ec279d5fa8227014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/972-40-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/972-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2404-1049-0x000000000D730000-0x000000000DFAB000-memory.dmp
        Download

        memory/2524-788-0x000002C1001E0000-0x000002C1002E0000-memory.dmp
        Download

        memory/2524-789-0x000002C1001E0000-0x000002C1002E0000-memory.dmp
        Download

        memory/2524-790-0x000002C1001E0000-0x000002C1002E0000-memory.dmp
        Download

        memory/2524-799-0x000002C103C90000-0x000002C103CB0000-memory.dmp
        Download

        memory/2524-795-0x000002C103E50000-0x000002C103F50000-memory.dmp
        Download

        memory/2524-810-0x000002C1146D0000-0x000002C1146F0000-memory.dmp
        Download

        memory/2524-794-0x000002C103A30000-0x000002C103A50000-memory.dmp
        Download

        memory/3636-41-0x0000000000400000-0x000000000040F000-memory.dmp
        Download