486c05f35b7465b7e9f9244532bd3549a5f0987d05e5e47fb965470db7162b79

Analysis

max time kernel
103s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 877KB
Sample260701-gnlc2ahs8v
SHA256 486c05f35b7465b7e9f9244532bd3549a5f0987d05e5e47fb965470db7162b79
MD5 2882581f343788ecbe5861dd32fe36b2
SHA1 077ae32957f4fbef23597332c83b1a4fda7a9da2
SHA512 7093cf2aebc6ea3229b8c352e2761c42a98f6c5799cd3399aeccbcb60ee74dbd372801a5aef40a771de07ddbee25632a560d02483741a3840b04743177b84db0
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zN:A3mnXoZB0Le5ji0hmxNrMJaEoFWiN
TLSH
T15D155B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D76C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3440-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c5d2-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b7-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3440-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3664-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e4-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c74-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a4b-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d0000000184ab-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-433.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000900000001983a-519.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-604.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-629.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-826.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c5d2-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b7-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e4-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c74-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a4b-221.dat	aspack_v212_v242
behavioral2/files/0x000d0000000184ab-264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-433.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-494.dat	aspack_v212_v242
behavioral2/files/0x000900000001983a-519.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-604.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-629.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-726.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-745.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-788.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-826.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-858.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1153.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1325.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1344.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3664	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3440	2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
3664	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_2882581f343788ecbe5861dd32fe36b2_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3440

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 877KB
SHA256 486c05f35b7465b7e9f9244532bd3549a5f0987d05e5e47fb965470db7162b79
MD5 2882581f343788ecbe5861dd32fe36b2
SHA1 077ae32957f4fbef23597332c83b1a4fda7a9da2
SHA512 7093cf2aebc6ea3229b8c352e2761c42a98f6c5799cd3399aeccbcb60ee74dbd372801a5aef40a771de07ddbee25632a560d02483741a3840b04743177b84db0
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zN:A3mnXoZB0Le5ji0hmxNrMJaEoFWiN
TLSH
T15D155B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D76C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 87c4d5c1e915ac76b0bb32d6ec344f3e3e42927d4c8f789c7c1a1e28d06e801e
MD5 3ecefd849de6b997f6614556f91cb514
SHA1 9d144c48f89081ae7dc205e6682a976c6272211b
SHA512 761ed9dc48d37b0930bf13fdfe5122894921613b8c2f2243bc33c689b2666dce8611aece4f5459a8c933f26be5bc9ef0500c4570f5975c211e0324a4fc213f48
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFWiZ0Le5ji0hmxNrM:A3kqPji0AjDPji0Aj
TLSH
T1C4653A16F6B44375D073C0B9C5D2A69AEA7134821B308ACB4385D76C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 891KB
SHA256 9553035850a148c7ac56cee8d7c93194b8a1188ad6c39188d2de79aa5a4f8744
MD5 e2f58a42980d7834792565d59b9e4e69
SHA1 b174e94156e7c221314dac0407830edb34b3d5d9
SHA512 a1d6097450af7b2065a80ec550e899e83d8b254fab51e72b259fcc913a29f49f49dc544acee2cff927cc4a165e9d70f39a56ecd55a799dfb2b6429085e532134
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zLa:A3mnXoZB0Le5ji0hmxNrMJaEoFWiLa
TLSH
T1C6155B16F6B44371D073C0B9C5E2A69AEA71348217308ACB4395D7683F67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 925KB
SHA256 299b2d4312f65176491878017aa8665576ffa33b999a941cbf09ed2e9e203433
MD5 258916722af7b5be5f790685a4f2bc91
SHA1 32f7ea15a19abae3df72bb67ba27ef380c609181
SHA512 92e8564d3d55ce4a9516d76c577bae737b3b62fdba097b8a1026ef0a1cd493acd710d50dcf8858345aa72315a606a2aceb931474626fdaeca913afc4cae59853
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zIb:A3mnXoZB0Le5ji0hmxNrMJaEoFWiIb
TLSH
T19B155B16F6B44375D073C0B9C5E2A69AEE7134821B308ACB4385D7683F67BE5863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 901KB
SHA256 c640972b5dec6a7350f9247a8a3d4077b8f1a4bc13ca9942a7e0c2cadb59d215
MD5 fb22e3cbca25ef9385cb93dfc2a77876
SHA1 b13d258f404bce9b8f9f5f7197c662223dd04900
SHA512 0c51d0f29ed57943a6a116c77ca96c151bad36330ae1c34ef5a99a9f9d8e78704745e8167d1a7f8667816bcf54668b8c1e33f2151461a6b26077a3c93e7c57e8
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zK6:A3mnXoZB0Le5ji0hmxNrMJaEoFWiK6
TLSH
T106156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 901KB
SHA256 ab1796a93b81c940f126f0c9a89c22535ae1744f9db95562b1750ea7a92b7570
MD5 59a8a9a10b6b8026d681b83338087ca9
SHA1 d2478b6f55776877d6cf57887d9bfc1d60ad05cb
SHA512 bf730a8715d84ced813ec0a442395f323988282d9f96bd4af1775095518a331e6fab9595b0d817ae3d6960e1f3118c4d2130afd26a8f053b8a0ec016e70ee84a
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0ziN:A3mnXoZB0Le5ji0hmxNrMJaEoFWiiN
TLSH
T137155B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 901KB
SHA256 37251122bc245f3f2e1bffd9b79f0ec7593bccd1e29bc28213afc2bba6b02e9e
MD5 5b4e260bf2ef22275c4a6baa160dc0b7
SHA1 45df7467893c72b6bb4b14199ab3bef770e383c6
SHA512 47fee6457ee7af40731748b988d412cccd54c08153e4314c3fa9a30e13613cb0a912059f3cca87429435b9a16de79e2e053ef00eeaeaae59c40ddcf0f181a54c
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zYf:A3mnXoZB0Le5ji0hmxNrMJaEoFWiYf
TLSH
T1C7156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 901KB
SHA256 89f19a3d9394a619921a27c7cd68e3954f93f0a4cb8dd733203e7d5ed3b0315d
MD5 132c14efe56f2ede20a3eecb79578ab9
SHA1 4432a78cd2a0b2a842dda4039b62b003c90c2c0c
SHA512 17eb63c4e0693cd5ea7ee8f7a9ebe9365ffd597b7e1fc3af4ee0200810f71f71ede87d833fd3e6eba0869dc93eaef18710258cc09eda8d31fe659ee4d0a427bf
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zyo:A3mnXoZB0Le5ji0hmxNrMJaEoFWiyo
TLSH
T153156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 901KB
SHA256 86050ee3b8e610490b90fa1db4d1e1d52f6933d556d093bea8ef0dec194f2a93
MD5 d0dfe1c1198a10ca666d2f2f4337d731
SHA1 c93760a48050287d002ea4e255404b1211967f13
SHA512 3ad033cafc789973e9adca24ac1e7e321e85b93736d1478d7972bb331aeada149d728428c8523b3f9481fdbd4c6b56d610e2202236133801679282bbe249b321
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zmu:A3mnXoZB0Le5ji0hmxNrMJaEoFWimu
TLSH
T11B156B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 901KB
SHA256 137a3e0cbd5f0af2088c3f610e5a58950eb643a7ce4f6e121a831a6f6ad7fb31
MD5 58fa75edd9aeeb08e316b1cbb28bf915
SHA1 0785accdf95ae24da3e83480c1d2eb6eb12dfc86
SHA512 7bf0b8d47ec20fd6a2bc9da6bfe66958a08fde8f76cc8ae434c2e1db70dd4e4ae0caf0c4fc99d0dc3a24da5a360fc95221f7177c08b4d3b76cbc34b12c8047dd
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0za9:A3mnXoZB0Le5ji0hmxNrMJaEoFWia9
TLSH
T107156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 901KB
SHA256 9e44986b468affe5ef7518051cb7d837943ea623b044bd7ba3c90454c5313ebf
MD5 4d0ee09bb4059d610cdfc6a3be3f4690
SHA1 58a001fb089311e7ce36d8f52f0b77dc53cf6c50
SHA512 dc902cb091b85f52b1c26d445960af44c6c5afc0b0db6cca8d266dacec47910936221c74a22e760f0951d1741b4861cf1b32d5c6ce5f076cdce8d683a53f8a4f
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zac:A3mnXoZB0Le5ji0hmxNrMJaEoFWiac
TLSH
T182155B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 901KB
SHA256 04e50fdb7359f4ff03119b3acbfd3417b789645711137fe127bd140de4fc6d83
MD5 17196f8da7ad1270a8b057589fb67917
SHA1 35800f0009ab518b5cda77f5bdecc9225c97c819
SHA512 a8b9c06e5e2812420bcc098080bb47a9020fda35853864795f6d94b3e8dd79a51dfbe6955bd56cf2b47a25b366f1fd9eacd1728ce6057306424191e9a8144a7e
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zTp:A3mnXoZB0Le5ji0hmxNrMJaEoFWiTp
TLSH
T15F156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 901KB
SHA256 7b0f26ca44a34706e2209eccf960e2e052938993955a468d0a929af8819d12a8
MD5 8ccecf2dabfcb0beba053d21c70ef75b
SHA1 470958f3c6470d4f8cd539293beebe125d541d46
SHA512 eefacbd71fa83ac354b41a2ea2951b3916be7ddf72cfdc97cf255d16a11458d9181df22f638c214bc0035e51b69538824046cca9c3ebcad0621548ac060c91c2
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0z00a:A3mnXoZB0Le5ji0hmxNrMJaEoFWi0N
TLSH
T114156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 901KB
SHA256 9e31797676f56098748780b5bed02b52b4fac62036f51d0e297f99630b5023e5
MD5 55ad098c2a0648acb59269dcd982fb81
SHA1 566d8562d2ef9016ffad0ab1d1beaa3c00386328
SHA512 16f7591efd1f7fbb0cf0a486c1bafd84560ece125c15f470db72272f63e09f3092f63b468b261c9f24d5fbb6d6bfe841928d9a3aa81121b87817644a97b56b3f
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zcF:A3mnXoZB0Le5ji0hmxNrMJaEoFWicF
TLSH
T1F4156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 901KB
SHA256 ffad5221d72c0efe45ba0882c4db156e19cccb97c10e20316c7717d1173a848f
MD5 1e624361dc4219059d02bca0ca1f4a84
SHA1 72e64fc27de5274caef18c794ab09520d454b1a6
SHA512 5e343682aff3e2341952025ff3102f8437d848268406e771f95f5d98f8bbfe7c7278019c11848379f110c769fd47ce96470ccb5346e91ab2fee8de5c4baf5036
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zJC:A3mnXoZB0Le5ji0hmxNrMJaEoFWiJC
TLSH
T1B7156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 901KB
SHA256 95b872f3eaf5a192590cd09a5ab41966a1c73f183a3494e319f33e1e732e84fc
MD5 ba07fb4908c03a9baabb2277ca3cebd9
SHA1 ee53cefa044d6e3823873ce81c9c835f0a1bb0f8
SHA512 7e9ae0ddaf2387f204e780e1550f35455eb684b80c97155d78a431f17c7102bbc186fb09340d1b1419ce083eef2fb4a0fd89e9ae693f883c14673c6b6de64db9
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zqw:A3mnXoZB0Le5ji0hmxNrMJaEoFWiqw
TLSH
T185156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 901KB
SHA256 87ff61f44ce59f31ba60d92e9509e94f2a778fa71ba7935c047ede698c09493c
MD5 7075283c67b9ebcb2bbf2020e428dcdb
SHA1 e44697945802b0ec93dc61ff97b67472ea75eb33
SHA512 b511baad16bde95dddcb6cc87d75e50264a9be32d400d42711067ab7476862fb358dbe5fd1eebe437b8f2bed9a05883cd6b350204171725f27f024f3888e4599
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zxT:A3mnXoZB0Le5ji0hmxNrMJaEoFWixT
TLSH
T105156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 901KB
SHA256 828359f850dade0bda9a8495e0db916d91fc276d4dd253e607cf15511a124c58
MD5 0ef5451308a42f78e89b9a50981bc714
SHA1 9c3881fe0f5cfb278d6afd91a18304002d0186bb
SHA512 e621c8f130f42f1148c823a7135d68278d8cb3d3e1d5289800ac87db022997742454a3ec282e960793132c24418ed391fa568aff5eef549dd7351fbfd5694902
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zfu:A3mnXoZB0Le5ji0hmxNrMJaEoFWifu
TLSH
T114155B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 901KB
SHA256 8d56794d578557fd27a3a946eb00656ac2d349977daf50682ecfd4e6ef4d44a0
MD5 e54e8f95312ca86ac4390b1622d0dc43
SHA1 572d1be7208b78f5213a9bc893cf813d545eb5fe
SHA512 3fabecad4146aa3459df5e4c27f4893c6e07f4a9a8a1c1518f9bf72bbcb9a6167a6b3056822b5ebaeb1d41b7df0209dd10e6ed7f7adb802a65aa4d3a9cdfa097
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zDb:A3mnXoZB0Le5ji0hmxNrMJaEoFWiDb
TLSH
T104156B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 901KB
SHA256 bc9a9bc965df15ac8f6af6af2a8e9805143a4f34fd554e65c0cb997e9b31244a
MD5 7360608d4636f93a0a37ac68595981ed
SHA1 f5fed9108101ab401c48f123cf26da2e917bfb29
SHA512 3c9edd1e1c0cdb0e3c6677eb2ae49832488d34295aa08d1c96fe86fb30ca12058eec970b7cac9fbe2db125a9f8f7f6149299d0b9a4899c9dc56ea06724b9eec8
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zXf:A3mnXoZB0Le5ji0hmxNrMJaEoFWiXf
TLSH
T103156B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 901KB
SHA256 4b8bf69b6bcdf494b64f2704041cc9a20fc9f0a8628c4937358fe0f713cf7156
MD5 84d616a7c7eadaa3578993cd9d83f0b5
SHA1 641fb71bd93b7c3e424295a829e0c6752b3f63af
SHA512 ae61653f9428ee5fffeec9a20f50701650b87bc875d3d37ad6114520ac74933111222ad748f7650423f6f6b6d397107e1897622c92c0574d7af475c8a1ae5e7d
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zgK:A3mnXoZB0Le5ji0hmxNrMJaEoFWigK
TLSH
T159156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 901KB
SHA256 1a15b201c9956c2c2d8405522716cc1786a214c766e8fe9bf3ba5e595d4a6f85
MD5 9d76ff14378cc85243521322f50912e9
SHA1 83bde365d884126763c25423a19a59ca2a2273dc
SHA512 a1c0be4b50229ba01d1750d4b02a53c7e1457c9f45cc3e20f165705ae99f4ac72b8785fdcfde5aa7c581d91f54bb795f0ed0f4ca19b837c61dfadbc09dff2800
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zdk:A3mnXoZB0Le5ji0hmxNrMJaEoFWidk
TLSH
T106156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 901KB
SHA256 7eee39e35a55bbfef50d5fdc0de449150a71f2c421fa681e5de43aab5d958131
MD5 8d7b008526db97b42e1c724984190734
SHA1 b69cac2aa35b0ab4b50987dd3605a9c8c18510f1
SHA512 d91e8c494339d93888ad8473cf44754ebe3c2f830c15499e2bd5ea6397823969953b5fa99babf6a816940847fee669a32a9cd16fec2b073404c8fa653d818072
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zC0:A3mnXoZB0Le5ji0hmxNrMJaEoFWiC0
TLSH
T10B156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 901KB
SHA256 08883465bbb6e8837b54d52a2245350262d973ee9f0c2e4dbdccf4517ca2187d
MD5 4db31781910699cc62af6db97b013199
SHA1 6e6e00feeb1589d99d2650bfd1ab28cc252f54be
SHA512 250ae70e564db0c0bfd1c4373a9272782cbce973ec48eee5259d32ba01c10b69971de4614eac0f893cf6935a4e655d78654b7433d3e82be2f7c51fcdd6eab77e
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zR70:A3mnXoZB0Le5ji0hmxNrMJaEoFWiRg
TLSH
T176156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 901KB
SHA256 dda44eaf408611554b4ab6c46098a19897fb555bc84643c5b5301fd508829884
MD5 d1b623616e511be4d9333fbc767d5e76
SHA1 9d850eab3c62b544ff7e571d123ad513cfcd1302
SHA512 4bd8e97f85caeecdfd6a37a76a7cf87bd20ed65b716a74a261d7a961dd31bf22d229fec95be368db0209fbd3c0babcced740bf16c7750ae499684fe5a7872b74
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0z4r:A3mnXoZB0Le5ji0hmxNrMJaEoFWi4r
TLSH
T15D156B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 901KB
SHA256 621c22afcdc4c5af60cdf4524547394783d2b241b48fa2c3e917383996c4eb7e
MD5 eb12ddcab9aca4a1fdbfbfdfc82e4b8b
SHA1 4676840e68c8927e2dc6d7cf9206d338a8485723
SHA512 d5f603d448d3c17c5e06a6e8d261d26eedb854a61d27b15bd9ea396a1d5a8257c85b99c88c771a167189e9ee5b48e286f59393aebe94fdd83090abcda140dcb4
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zWn:A3mnXoZB0Le5ji0hmxNrMJaEoFWiWn
TLSH
T192156B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 901KB
SHA256 447d08d864827f3b31e01d3048b9bbb0fb3e175de3e6110a8d290c27320e7742
MD5 0902e75a5cba118030b96c4d4f1c8ff7
SHA1 e0b28daf76f3de43deb4387d1ba21a367c88e4f0
SHA512 72480e0402b4c3eba844c76564ea37b36c3d3fe031e6fbbe89083946ba69b20cdb5569ed5f331c9a9f6d041af13916e22410799234a937a0850c6e1ba829359c
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0z8x:A3mnXoZB0Le5ji0hmxNrMJaEoFWi8x
TLSH
T11B156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 901KB
SHA256 d869b96d0834f304b8471588d059f9693be3326eec5bbbb91013d6063d8e1c2b
MD5 4160976b26c190557dbd82000f8ddc39
SHA1 c55ebd10339c60c99f627e946e6b7b554bcd4557
SHA512 872ae0d9ef1ea7dff4e4bff6a915925e68565ed9fdf2662462dbe674080646ebd5d264bb82a201fc6752e12e99cd628f44b9db0b67520243da43c756b2fdfacd
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0z2A:A3mnXoZB0Le5ji0hmxNrMJaEoFWi2A
TLSH
T13A156B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 901KB
SHA256 4f3a62748e8cc8b9e992642c3a49bc0212ce5886e6f654db323ad69f48e0db46
MD5 c997c5ceac9e1c76b3dec49561bac338
SHA1 b9e8697bb438772450081edd8eecd4b380a940a3
SHA512 50a982eaa40bfe2d09a3d6929a19e0f1675f0cc164f5f9144ca9c36b5e816d5135e5d3723046c3c09f26eb2d506524d5d35808617e9fce9e6561a13349797a8c
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zv9Q:A3mnXoZB0Le5ji0hmxNrMJaEoFWiv9Q
TLSH
T145156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 901KB
SHA256 b07414cdc685573d688b6699574eed1e3fbb9a70049875569540730422920339
MD5 21ab9c76b4b52d48a2bda4ee3b421f47
SHA1 5b05e6f4a93e84e66e66fba18666b8c6d4b508fa
SHA512 31ca26ecb29566139b1dc43f6888909caabbe5864b40a36831d73e8259e84fbad7517a87ce4a317ee1d57d7e3ced9020f16ddfa3fbebe11f69702cd423bb9773
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zG4:A3mnXoZB0Le5ji0hmxNrMJaEoFWiG4
TLSH
T1F8156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 901KB
SHA256 e94b2d8390870816e3a2e200dcecd655e1d95c19b71f111985ed0ad39971fb08
MD5 1913aede54e9afb86529987f0ce68f3a
SHA1 2c90bc8bc95b9cad2061a3dd9bbe375dd00efdf2
SHA512 6147bd9b3473b11f914ac4eb5d9753dddfcae2698863e2424d540bfe20bb25b50ec3a3f9d8fb61c2ef912b1a780ebbede18fc756eec49dfecee91b856febf941
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zVu:A3mnXoZB0Le5ji0hmxNrMJaEoFWiVu
TLSH
T13B156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 901KB
SHA256 83065779da216fab41940adb73c953d4ea6e80fc728c1845358b4fc845908df7
MD5 84bae22a6c6adb2bb40b89db5adc073b
SHA1 0ff3a07ae9759ef5baa9cd3771f1f83a871e2ce6
SHA512 641df200a3dd8c37294fcd7c5332b6a80c1f00331476a903a9c2f3e63124e89babefabfdb79388a27fcef6689fe7b9336b392818d5fc00a476bf755c4f4db526
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zIj:A3mnXoZB0Le5ji0hmxNrMJaEoFWiIj
TLSH
T1DE156B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 901KB
SHA256 a50a79116d6230dcc6a497080644e281d9aaf1e6138490d523d16f77b42277af
MD5 9507ee6407ae1ff721900b4d86307bcc
SHA1 25df73dd968d783c12733decc751aefa897147d9
SHA512 6014f8de30fb71313b876e5195f063128bc0053b04ecc84a284b25d2e239bc6619bd4db8b15fa0afe4718ea373e79083655f73882cd625b0d8f19d3cb30231d7
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0z5g:A3mnXoZB0Le5ji0hmxNrMJaEoFWi5g
TLSH
T1BD155B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 901KB
SHA256 f9b6be9f15a0241b68293fbdba82fd34f60f9cd4c6fd9cb9debf919e2876f86b
MD5 663187f1331fc71156fbf98a6a633097
SHA1 de34968bf732a4705b71e65695154d2caa23a3bc
SHA512 f7a583e829578ecd559e262579619ae394736baf6c9415eec1f7987d1282e56bf2b2eb2865d41213fe7b3cc73ee73678912d11c4cc5c4f8e7a9ebb07abcedd28
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zgI:A3mnXoZB0Le5ji0hmxNrMJaEoFWigI
TLSH
T137156B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 901KB
SHA256 5fb9b69f8e2d1c6437dc4d76a38384f0c18a83b2f2f3e40af2ca952091f65b86
MD5 30cb7d46d2e3ebcfbdae8d94cd15321e
SHA1 ffd1528b08057d90054b8d7b35fd61637b1f7d0c
SHA512 a647a61555707d23367f631bb8424056854c4967f68200d4683488ae15454a7ba17d0002829439473e2f68c776d80d2150ecf4e6cf5ace5b2d78fb0d95782a06
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zio:A3mnXoZB0Le5ji0hmxNrMJaEoFWiio
TLSH
T17D156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 901KB
SHA256 0194743a4986ef82c9f0eeee20253f4952e30d1007c79daac9adafed3482b16d
MD5 3b5b6fdd76b9ce9d719c439ce302eb2d
SHA1 376907bd5862059f041b3e2959ec1469e9d2b3dc
SHA512 376fae60c31c004f1fdf94333e5412d867a9de15d5a0d02a82e0c1101149b9e6678b551dd9b14a760217108b6ec36152ae646491ab45bcadf97145a563ad432c
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zZ+:A3mnXoZB0Le5ji0hmxNrMJaEoFWiZ+
TLSH
T1D3156B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 901KB
SHA256 53d44ff32e075248489e32af1c86e205b6492f397d1f6639ea1d74bed2dd78b5
MD5 484f223651cf8ab0a9f4d4f7065fedae
SHA1 a049adcd0f835ee3133f3bd5040ecfe0bf6b1f87
SHA512 d3ab76c0eaceb6c144009356ef6304539de9b9ee10ae2dda79c593d3d5fabcfc9905a5e5c447c3f67315d57ef79c54fdadadeea5d7962c1a514335d31cc7557d
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zHQ:A3mnXoZB0Le5ji0hmxNrMJaEoFWiHQ
TLSH
T198156B16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D72C3F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 901KB
SHA256 60b73bea360d5ebcd3631d66a2d7ec901a2b0edfe5b92341f9787c1c59e538a6
MD5 2f5c4f5175182517387dd854dfda2123
SHA1 c86d8ef099dc376d87b417beceb70401dd0c988e
SHA512 b0a61c86394e578d8863904725e709668b2aa7009d2f54e57505b5f43cf0200e0a9323b2aba496b94f306c5518fabe3708a321f00fc16ad602f61c1b90e6111f
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zcX:A3mnXoZB0Le5ji0hmxNrMJaEoFWicX
TLSH
T1B8156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 901KB
SHA256 4fda6c2628ac888bfb2365e32ba4b158e04daf2b72999d253e6ab5ce3d9c4a74
MD5 70f1264417f35a44fac2409e37b04ea2
SHA1 9c49db75425cbc0a5329a8731c93eb713f773653
SHA512 8d5d7dcd3914d5e4693dd3093fa06643c3258b57bca13f6acc980d79a32844d1868c40094348638a3a098ace0f97d99a8988fd00cb8baab23a05902bad57468d
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0zaL:A3mnXoZB0Le5ji0hmxNrMJaEoFWiaL
TLSH
T144156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 901KB
SHA256 7fb5b98b8e03b85ce225f7d71d143119521bf24f05ba8937d36ec6cea92a9292
MD5 6b46fec3a854222196ba132429f6c751
SHA1 3d1ce6fd620de812c86e40feb748322dd79be273
SHA512 c3afa6afd7a24f96aa3a0cf10f0b225dcbe7c15053f6923bafb029523956e1662bfa767062a84a6e107f114d130eb153925c7669a6f13cfc15bb8b02bd8fe610
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0z+FC:A3mnXoZB0Le5ji0hmxNrMJaEoFWi+M
TLSH
T17A156B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 901KB
SHA256 84bcb0e2457dcf8923906ceae04d7001592ceb0ddf2550e84196114689c5a933
MD5 9963653b9a483efe552cf03912e6ca46
SHA1 a9da4f5f6a22a332dbefc0c32563b9489b356891
SHA512 b5441ed3fb24bf90952a7f1aa219e847349795fbacbf51565830b3ba2ced0a2a97dbfe56d6156e5820a3c51233aca8d54f265b90b72222493bba95e83e7b06c5
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFW0znh:A3mnXoZB0Le5ji0hmxNrMJaEoFWinh
TLSH
T13C155B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB4395D7283F67BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3440-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3440-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3664-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads