Analysis
- max time kernel
98s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 02:13
Behavioral task
behavioral1
Sample
2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260701-cntl7aet7x
- SHA256 9818ad28e698219e3fd3d747f6052ee2d79793656167c00a4cc979e73fc9ec44
- MD5 ebce17a5537ecd7b6b9df17b2838604d
- SHA1 fcabd9748b72200405f997be771f953e91ef3c42
- SHA512 4d021038c55731ca26a20e1940f6f38791b6b42abd6b24ba69ca5dbd23cdf448f703023cf09afd0b22e92425e0e1e27b5ae86275279413d3293dcc14d9a261f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXAbGHZe0p4Ek4niOkl/A04szE87JN:A3k03kB56rpeW4SkZP4sz9Mb
- TLSH T1AA853A16F6784B62D07BC0B9C5D6AA56FA333C455F3087CB03459B283F276D1963A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2392-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5fa-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c5-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2392-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2476-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a55-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb5f-250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001996f-522.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019968-525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c97-1288.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d0000000066a8-1873.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5fa-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c5-11.dat aspack_v212_v242 behavioral2/files/0x0004000000018a55-252.dat aspack_v212_v242 behavioral2/files/0x000300000001bb5f-250.dat aspack_v212_v242 behavioral2/files/0x000300000001996f-522.dat aspack_v212_v242 behavioral2/files/0x0004000000019968-525.dat aspack_v212_v242 behavioral2/files/0x0004000000019c97-1288.dat aspack_v212_v242 behavioral2/files/0x000d0000000066a8-1873.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2476 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2392 2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2476 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_ebce17a5537ecd7b6b9df17b2838604d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2392
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 9818ad28e698219e3fd3d747f6052ee2d79793656167c00a4cc979e73fc9ec44
- MD5 ebce17a5537ecd7b6b9df17b2838604d
- SHA1 fcabd9748b72200405f997be771f953e91ef3c42
- SHA512 4d021038c55731ca26a20e1940f6f38791b6b42abd6b24ba69ca5dbd23cdf448f703023cf09afd0b22e92425e0e1e27b5ae86275279413d3293dcc14d9a261f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXAbGHZe0p4Ek4niOkl/A04szE87JN:A3k03kB56rpeW4SkZP4sz9Mb
- TLSH T1AA853A16F6784B62D07BC0B9C5D6AA56FA333C455F3087CB03459B283F276D1963A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.8MB
- SHA256 67cb8583f88fb9cc819946b6bbaeb3a8ec53c249654baede7339d42513af6877
- MD5 aa80949b7dc3fb2dcca0c10fe477cef2
- SHA1 98d5b14cca705481fa49ce5d37e33120bf31402a
- SHA512 96fe3c98fca8ed2306635d218d4dda1c696eb6d2ec61eb82c7fc582b87c1ee3fd8afdbb6e71041198ea592b06075ed81fff6e046231865141affa0d89ea9255e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXAbGHZe0p4Ek4niOkl/A04szE87JK:A3k03kB56rpeW4SkZP4sz9MbzBPVAU
- TLSH T186953A16F6788B62D07BC075C5D6AA56FA333C451F308BCB03459B283F276D1963A72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 1b4ccaf4d119a5a6ab05a09e77c6c69cbf86c77af0dab6dc30af393b668a0c7a
- MD5 eae2e0a241265cc43a20080c7181ff9f
- SHA1 554fbaf805f9474c12393bbe203e4b9c15658672
- SHA512 3d5b2c6f79f043a16d9a9e6cfdee9cd985da2e46bfb30f4c252397792ad049cfca29c7ab729a3b8707673d923159852cd0e4d248cb6ac17068b5b27d0a805f82
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXAbGHZe0p4Ek4niOkl/A04szE87JM:A3k03kB56rpeW4SkZP4sz9MbBPji0Aj
- TLSH T134B52A16F6784722D077C0B9C5D6AA9AFA3238451F308ACB0345DB283F277D5963A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.7MB
- SHA256 24383b2e09f3ed706517ba706f65eebaa2fa4110b08d0541eda963156eae92fe
- MD5 cbbacf2dcc59f8de300c9b48115b3df8
- SHA1 ba8470d062288306dfe684bd42d8a02f8e59136c
- SHA512 f0d6d6284ad307977e08444cdcc8f2b85dc9791d0993baef4694dc757284eedc3ec82620a6ce7b1107966718a0348dd77dd245835aa2a12976cd6fc2c3a3b551
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXAbGHZe0p4Ek4niOkl/A04szE87J+:A3k03kB56rpeW4SkZP4sz9MbN
- TLSH T105853A16F6784B62D07BC0B9C5D6AA56FA333C455F3087CB03459B283F276D1963A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$
- Size 1.9MB
- SHA256 1006585f79e33a5a1a2a7106abfa2716834230c8da8aa3be9563866de4d5a157
- MD5 8bbb9da8b4601ae63e0840db0eee522f
- SHA1 f1a4d997ee8511da6d111a0072bea97794f46288
- SHA512 b64e66bb4dc640b5be33d77943f57e188f882f7a067e8dcae81246f75ac0f44035e89a7bae04d06c327741935b31f72022dccd964bcc7070f2a8d277aa1d1a8d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXAbGHZe0p4Ek4niOkl/A04szE87Jb:A3k03kB56rpeW4SkZP4sz9Mb2T
- TLSH T1E5953916F6784B62D07BC079C5D66A56FA333C461F308BCB03459B283F276D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 1.7MB
- SHA256 b7ed629f9863170987d877ee0c4e998c2ef5618be2a5b7a18bc019f7b16fc10f
- MD5 4eb44f0833767caed534d3dcce217c1c
- SHA1 784ae1c71a6ac9b4d11390dee8f703b66c9c9ddd
- SHA512 14618dd9e9a5d6e244e26266bfe66372aeab1cf96fa874fcf0786dda690f0594bb746ebb8de60eefbf6f3d65d256f3d2d05cca9f1ebe4ddb365417d9b850dabd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXAbGHZe0p4Ek4niOkl/A04szE87Je:A3k03kB56rpeW4SkZP4sz9Mbh
- TLSH T115853A16F6784B62D07BC0B9C5D6AA56FA333C455F3087CB03459B283F276D1963A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 1.9MB
- SHA256 18cf3602f6a079a620136d330a1478ec067753e891a8b867075d5535ba4136d5
- MD5 7608d9907a917f6a06c64a98935307be
- SHA1 b01ec6116f7356eb9768a5a9bd862d1e5f8c9d73
- SHA512 2abb53c81c64aa63ffa065471bc3cbfd081898838f968e0f6a619cfb63ea35bd24e10b83e74a9ab8b90ef662e3b522b7df08ef921557be1ca2357aad94689fe3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXAbGHZe0p4Ek4niOkl/A04szE87JR:A3k03kB56rpeW4SkZP4sz9Mb2
- TLSH T1FC952916F6B84B62D07BC079C5D6AA56FA323C461F308BCB03459B283F277D19639726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.8MB
- SHA256 005d38918ab5ea806c815fda811c7970d8ff859cb67b259a01e55a5912559b05
- MD5 0948b299891cd163a22f442d1b0a43d6
- SHA1 0f91756f7796c924902494719570ff9e752bea8f
- SHA512 250af7b9e785eb8a528f768b82440abdd32184ecce2abf54ee2be3c27e14b24071a3a981a7cc2ac49dcb7d6017c3ca421ba12af168371cb6d67ceb82bbd2874f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXAbGHZe0p4Ek4niOkl/A04szE87JA:A3k03kB56rpeW4SkZP4sz9Mbj
- TLSH T1EB953916F6B84B62D0BBC075C9D6AA56F9323C451F308BDB0345BB283E376D19639326
- MD5 SHA1 SHA512 SSDEEP TLSH