2177504a18d490341b6c75b8a27e91f8fdba3bfab31c743020d3b238745ba242

Analysis

max time kernel
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 945KB
Sample260701-x88basdv5j
SHA256 2177504a18d490341b6c75b8a27e91f8fdba3bfab31c743020d3b238745ba242
MD5 44ffe0765c56ee35c685b123ff736272
SHA1 8819841cba8713275049b81830b0678ca00a9625
SHA512 1d63ef2ed8c0daa633c6e6deaa3719261dcbbb091185d5ffb0606a8f2b97a3fa0fe1e72b9bd9090f75b9515e41f5eb04bf9b4c9e055b7368f1aa6b6d801f728b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8o:A3k03kB56rQRJ2
TLSH
T1BF255A07A6980FE8D11F81749A968A62E7737C110F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/2668-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c5c7-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b4-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2668-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1128-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000189f8-203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a04-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a68-368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019855-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-514.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a65-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-747.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1011.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1091.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1407.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1408.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c5c7-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b4-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-41.dat	aspack_v212_v242
behavioral2/files/0x00040000000189f8-203.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a04-259.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a68-368.dat	aspack_v212_v242
behavioral2/files/0x0004000000019855-477.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-514.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-605.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a65-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-747.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-956.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1011.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1054.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1091.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1140.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1210.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1364.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1384.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1404.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1405.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1406.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1407.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1408.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1128	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2668	2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1128	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_44ffe0765c56ee35c685b123ff736272_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2668

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 945KB
SHA256 2177504a18d490341b6c75b8a27e91f8fdba3bfab31c743020d3b238745ba242
MD5 44ffe0765c56ee35c685b123ff736272
SHA1 8819841cba8713275049b81830b0678ca00a9625
SHA512 1d63ef2ed8c0daa633c6e6deaa3719261dcbbb091185d5ffb0606a8f2b97a3fa0fe1e72b9bd9090f75b9515e41f5eb04bf9b4c9e055b7368f1aa6b6d801f728b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8o:A3k03kB56rQRJ2
TLSH
T1BF255A07A6980FE8D11F81749A968A62E7737C110F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 5ce1fe141203ad7a0654612ece997282667f08b23eb3e48094ec131238a1c2ed
MD5 91e1cd2c98bd874768d28ddecd6e1a57
SHA1 b2e7cf830dd6aa76e638378db60b06e74b8d0727
SHA512 82c1368d73c7288031175bc332f2a5828b941020d85639764a1b9f5cea1c361975c0b3fd5791e76eb8016e039bc4dd37ee82ce28738e8144f531bcaa355520e5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8w0Le5ji0hmxNrM:A3k03kB56rQRJ2Pji0Aj
TLSH
T19B654A16F6A44BA5D06FC078C5D29656EA733C421F3097CB0354AE293F77BD19A3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 960KB
SHA256 efda523b4751611574277feb89964a12bd5d2b27ea5dc7cd7bec031d752c7e44
MD5 072d99b17b604aa780b0f471e3fec413
SHA1 0f3077da5e73eb41b7051581e7dc31c61d4243b3
SHA512 c3c78afdf17fb52562f02d14c2fce06f1eff4aae3d276fab253f01e8d461d6f69d750b44ec1dcaae5787c85411bc99a95202bfdd6ac205e6871ece576af50620
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8Ka:A3k03kB56rQRJ
TLSH
T181256A07A6980FE8D11F81749AA68A62E7737C110F2097DF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 969KB
SHA256 a6c678abb30f6354de69c0e8e050c1718bcba583080d882868b12a63c99da8eb
MD5 683043492586a9837be7c118686fd02a
SHA1 0a6158a8ba48f6839c065b5a55d77ca8e5ce7bd1
SHA512 e36c70bc3a5fb8bb585fa825a39edab99d171acfd784b7b468c41c364e710f5d74bf31a8cf4a6cae1f44a27e4740d91ea683b2972210faa48471dc3326c11422
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8EZ:A3k03kB56rQRJ0
TLSH
T102256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 969KB
SHA256 8072c19ae00d7cac4c8ed31d1a2567a09aa0611213436c934a73993af880905a
MD5 1830df6c962dffa8310d18b2194fa3b0
SHA1 c7035cbb4d3e4f8877f2e29d20c8af6eff1f2093
SHA512 94cdee1574e2e056136896376d3dd1ee5dbed0001fdeed4e9aaa180e78433dfcf8cef043ee82a4291b467e6a94d9d065781c5068d0ef7a2001debbea323630e6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8L1:A3k03kB56rQRJL
TLSH
T1B6256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 969KB
SHA256 78c264a299f87a83e700a9b4c413a8dfc21df9143097a06ae43f3527007510a3
MD5 ccbdce6c622b74dc9c7edf40e126cc3a
SHA1 8b9a3c0736742af3d87651b7482b339d978b0eef
SHA512 5937e9d2f2240b3309182b26323d053d7f34e0b3fc1a85e21d71079c29a2f1df59653407ccc47812a76c7aafd632ad83f1ec37268c633e4cf30856df32d625e9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja876:A3k03kB56rQRJg
TLSH
T163256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 969KB
SHA256 6450dde357d08ab1c47761e818d68d7ae3d7cf44c122b2f9cbe8eaaac6618bba
MD5 2f31c674db564d9767334f7fac234a59
SHA1 aa13dc2a8adaf80ea551e00573c5f56f63831d39
SHA512 8863826636659355955f7c68cf83cc051738ecfd588f4fdd2cc1a36e1d3e35421782f7b8a4dd45035b79c54fec2358ed11faaa54d206a55ee1f750d950e5b432
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8lN:A3k03kB56rQRJd
TLSH
T11A256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 969KB
SHA256 506c42b2e886d71cc86aad06176d5be8ee45e8474bfeadf752bf6b2f28744c9f
MD5 88ffb2f94f54be5fcd46f0d01e92251e
SHA1 81c1aa1d2f58475c2a7448d1970b28e3cdc6268a
SHA512 6d292437328a7f4a7527872f43b11c0d3e187707fc0f7a9ebd3e45bfbf3b6e0dc6e3d4103b23c49d5b41dc15d56625f729cba556cf94a4c1ffeb40a6ac720a30
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8jf:A3k03kB56rQRJV
TLSH
T135256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 969KB
SHA256 46a5eb3d69a7668cebf3b8deb3a241dffdc67e63b8207c781c83200a9a59e5bc
MD5 c63e0c1d35c52b780b15da89e2948162
SHA1 f3eec0efdd9451d96ccdd86a052469cccf71f0df
SHA512 d7113a4b59ed7ee6796541c1f80d47366e8987cc84fd3a20c9ac09bcae67b256a743029d13cde50b32b232afb0c12acb155f1d163c44fa601ee784f3afb4d355
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja81o:A3k03kB56rQRJg
TLSH
T181256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 969KB
SHA256 b23016f731cec104af247a01b47b4eb55017c7a9d9a04816b6d52fb3334aa1ff
MD5 012e93c8ef5bd2b6375f52089e596c8d
SHA1 1f06eb3c7c3e3b220d4242b7c53d6e7c0d189b85
SHA512 12332185f905edbadc183311d455f104057ab8e6a4155a79c04d3bd95f775fe1e0b95f4f5348f8ebdca6921fb0f0ede3f4f400e151fff82ffa00c826d64c60e9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja81u:A3k03kB56rQRJC
TLSH
T187256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 969KB
SHA256 4b1c088fabd12b8b461efac1b722f2c797063ef8f262e5a06e94b5cb8b6afb1d
MD5 2fc088156c1739cd03e20e967f40854e
SHA1 ca0dcd5745f7fdf13e758466d2583b2a323599a2
SHA512 c9a2cc5425338068c93f00887401e86d5d851f51ca8be29c7fe3e0f52350ed049201895c623e3ab84f9ef7092844391790faa9f13f523ef9c061ffdab7a1c33e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8r9:A3k03kB56rQRJj
TLSH
T131256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 969KB
SHA256 cc10aa82714be787014a2c3a6f1b2b8173622a240e841757d7804026f251fef2
MD5 4ec8affa8ac268f7b2baab90ea6735b1
SHA1 5f4a4373d58ee4cae783037e02e4732019983378
SHA512 697c4580e9cc5fb8db798e46ab23c830d1a78928f22566e0eb64a5436c720882126c8cdc55eadc3467ec4b3191f26a015b0057e37969594eb0b4124911acf2d8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja83c:A3k03kB56rQRJK
TLSH
T12C256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 969KB
SHA256 0d725ab6888b8cf79aea97fbf8cb9c143f7f0655c3ad04fa8b5a7229adc3583d
MD5 b24138f9c74e2cae4c7fbd98a7492a8e
SHA1 2d94c3c8ea81ed5511979a2427af76f8b25ff612
SHA512 63fb69a924e36814ec272298cbdd0c8a0d74f457c6f948c8fa449a1fbbf93831ee93c3fcf58d36634dbcc2cf39f7b5488fb4827e72f4cce10d9717ebf2340839
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8Ap:A3k03kB56rQRJQ
TLSH
T129256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 969KB
SHA256 0153b70e79117ed05d30bf5e07f4bc4f46873c9920957d7a8de3d0b30b97bee4
MD5 373d48f2ba6912786e1f96cda8129e6c
SHA1 c94a5fe66615072dd6c643029feb194ad7e2e771
SHA512 cf6a8ffad4354f10d1f29a4f1829c3a1f3d7d3ea31414d4e2acec7d3b01148471633530a04dd266b5c51ad242ac7fd72f7a539373c88d7191b1bf4cd58fd4e05
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8HN:A3k03kB56rQRJv
TLSH
T10C256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 969KB
SHA256 13d37d782eeff3ead16f89c466c6da573630d1cc9d75ea99d5a06607af1c43ac
MD5 144904034a80eaae13faf4c118c3cab6
SHA1 7f2a3d34805e81986a79fe8373d968d562be7d17
SHA512 7fa5e1a26e7665f886e1eab943afec717094080a2cfd088c2da82b57bd8601f20f6a65b38a79082335d2a3c65a52f61bab2802a4dbdaa7aba6de80c1d4575e7b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8lF:A3k03kB56rQRJJ
TLSH
T15C256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 969KB
SHA256 05175905e0e5a9c627e35209c71febb7cab6ecb14532fc8ff96f482283d7710b
MD5 faa4dda56b03019e6f15cffe6d90e3ec
SHA1 3de0ae6000efb4e22c2a40716469d553e1911c2f
SHA512 f3509740917707ddee63c55abbf1baf80e08c9aafea80d21c379df43e4600535ea71e5509ebf51bb4b9d09f078d0c2e4f34822322eeb03eabfe5911597a729a5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8GC:A3k03kB56rQRJV
TLSH
T171256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 969KB
SHA256 046b192b5d87320ebfb536a6d43489327b470d1ae4c04e1c3f00b69f97c7593a
MD5 cf70b0e836849b7649ce430fd9271c04
SHA1 84f88bf9636581244a2616d28e4323b268bade5e
SHA512 40783696c46e143c44a1861cb97383c1aaa699d20c23ff8fce018995c5e835c25bb3e594c4083851f9ad015e1cdf20f0d88a30b70c860416cd63ce51368f1607
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8Jw:A3k03kB56rQRJ4
TLSH
T10F256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 969KB
SHA256 fc86a3d43039f14e8727f011eb6f56f4a192bdeb261d93301497225a192bc6c0
MD5 30544b3807b4f92dcfed7f3cc4916eac
SHA1 bbe5de2464483c82994cfaceeec8f79bcd039905
SHA512 2c671ecebfd52678e079fd51c187a08f8dd7f3bbc01ef33be7f2692b47af9973ca7076d8d41b27ee19453971cbd7f5a7514c04472c6fd1a984a40710bd414188
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8QT:A3k03kB56rQRJw
TLSH
T103256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 969KB
SHA256 7bfa25b21d0c114e9ce807bf7d722fd55838f1236a59296ffa0cec854fffb69a
MD5 7ce1726f907136bd45f1beedddfc301b
SHA1 63edfbcbd7bee58b34db0218a5b7c1b2d890d523
SHA512 887100bc907b025f9e51ed73c3e50083494dd4c13ceb6b48cc08c3c321572b8a7f89d7e71116bc3a6f8aedfb7c216ac1a8c63c6dbd8eb47191e43e80b9db9f04
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja88u:A3k03kB56rQRJv
TLSH
T16E256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 969KB
SHA256 28ab783fc6c0ac92f4236f8e0863c2d26f97edc74f08ce434f5219a798efb09d
MD5 ea348d45712a84a7d979cc53d3c8c6d0
SHA1 212b02a1c766fcc778a492d2e27243b8d889c854
SHA512 aa7ce58b09a24ca34e826023d291f13d739052db91b505a835fb8aec9e4a5d5250e64dee945295a63fb300feef5fd2a62398f1f2bf2f67e3efded4d370b5279c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8ab:A3k03kB56rQRJW
TLSH
T169256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 969KB
SHA256 9fe74ddcec42999a13fe5707066e6fe5774f06e3779d01dced4113d904c0ce66
MD5 71655b492cf525797f2a6c0c586f98dc
SHA1 fc21326d4969d9eb24b9534b2b4b94cd5963e7e5
SHA512 93626d9f43cde594d2df3aada9c86a85596c442781098800c4eed511a0fa9d37b92f7b629bbb5bc9c5d70c7004a010e3b7fb1d41383de460edf6a5e1bccdcad8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8cf:A3k03kB56rQRJm
TLSH
T1B4256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 969KB
SHA256 b92a69303470e196887728788cead4dfedf24408a6fc2231455245023666cc08
MD5 68dc77508862183800b74c21ce7d7c65
SHA1 8e1fa7d3bfe17e2e99e39978ad22abb0abf37a65
SHA512 8f1e5a79b048f26082766808012db36ffdc19fd4fefd1a810279820a2671093d5ca96a52cba2f896bf7375128e527f69f493ad18e441cc07ba83a65e93bef06d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja85K:A3k03kB56rQRJG
TLSH
T13C256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 969KB
SHA256 9210e7338546381541ac599651523f6f4265747db6fd7d777296e132e30140f6
MD5 02467aa595e7bb7db6e6ac77636b2681
SHA1 32ff3bcbb4a28e09db50183770a16f6b15598a3c
SHA512 1c602ad243cbddd8ad7683ed70b3f2781ecfb67263a8ef7348e10a863356d1c5cb674fc93a48f1791b2c0173d136eca3a2ad2a8941c30b1348c8c7de6476867c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8ik:A3k03kB56rQRJ7
TLSH
T1F1256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 969KB
SHA256 99ff5e64c42026c600d7332905699af20d605a1c44fda53fdd9978e74ae358bd
MD5 2d72e8c44042f05a21a6d8f6f337ce9f
SHA1 9d11d88917d2639f0ef7b29780483c7feac66a86
SHA512 c3b6c54842ad9a8b469726e4e7a9c5a1816f26d33a9be5ee34f269d5d30cbc9441f686a7341746944ad7074fa1a78fd0d6378d57f69ae5c7a254096c7713d391
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja830:A3k03kB56rQRJq
TLSH
T11B256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 969KB
SHA256 43721b07e2d5959559c563f88fcdaedcf9074148d45b170145982e28e9a34d90
MD5 5a376fad273bf8872cb1b33beec3bee9
SHA1 21b69a911dc94e0c82d44dd884252ef83bf9b600
SHA512 d3db98b912c33c3f3f65fc6bc2e453f46d77aa68c41cd1c5eeaa680ff19bbc3fa6483d63aa9fe2b6efa19513c712b116871485e2a4f43c004e4a040e77c9c8f4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8mg:A3k03kB56rQRJT
TLSH
T1D7256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 969KB
SHA256 d19e10226158b05735ada3b98f867de824b05d9ec4849525871dcca3bd03ecdb
MD5 4f89f95eb31167b82e438ee13bd1df3e
SHA1 6449758b6d812d43fdfb4aa0d8829b72bd6039a6
SHA512 3b70526f1f3bdc8abc9b602adcb7d2ec9e6b90c53109da2b7500fdf8def05b3d68387587486407827a9670ed700bc879ed8d20c5f72e679f07aa6df7b8635d69
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8vr:A3k03kB56rQRJl
TLSH
T1F3256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 969KB
SHA256 5ca5fe6f150798c70ee74f05c30ca0afb4aeec79e3c9c03728a8f88daae40584
MD5 5d22d5b04827ec1c3f5ae475d1f0a5e8
SHA1 c4a94ba9093edcc1f4159952cedba0b6235d9609
SHA512 bad55ca47f9dbdc021b48c1fd50b07f80823931af8d2d1aba3b743c7bf769d1d8ddb47247f3267bd12073ce864a6f437b175cd9dce22bfa40e23d2e68755d57c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja85n:A3k03kB56rQRJ3
TLSH
T10D256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 969KB
SHA256 177f69be36ee7e6cf629e5d94cf3034e1b817359120748b1555c3ef39ae79b64
MD5 e2a13a4e3e6e574b93170d93e3d5041f
SHA1 6e7ccaa30046a428d12fd4b1fcf497b84e080fdc
SHA512 b5eccaeb89eb453b4c3b002470d498d821ad6a51f2c57084e84b184bbf06aaefffaf84af952557170ed8a786f318185b954c1673d8b60d43848c7f0883ddd23d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8Vx:A3k03kB56rQRJt
TLSH
T1DD256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 969KB
SHA256 4d2b294158d4f7d9271d8b40332c574332a424203e80d847eefeb6a0423f4b82
MD5 54816195b651f3d46b12eb867ddf9858
SHA1 ae63f82504a3ccdca75d6593b6e98273f6afae1e
SHA512 f8bd1f120991e4864694bfdeffd37c2cfaa9dfccc9e2ce76c1f907b650b7f8f6d44afc4e589ffbe985c09ad1badf734f44e118b3b4c63a3dc3cc9c81a5fb1bd1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8LA:A3k03kB56rQRJS
TLSH
T132256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 969KB
SHA256 84ab1d0477191e0eaba4b454962100f0f5322db5cd8cfc3893e0506bc879cdea
MD5 d8ef01ec23342d8555cd887ec0c90aa2
SHA1 2d872ef4eaad63d8acc0b3f8066c8082190b0ece
SHA512 15eaa6b0858020328caf6553495df2b2ab7012573d0023fb807f4ed9d4cf3dba08c74ed8d8fe8da0d1798aff6342b10f7108cbaac775f9561684263cb1373c93
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8c9Q:A3k03kB56rQRJP
TLSH
T16B256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 969KB
SHA256 1636cac5c35c465d78016db6bdfa1a76c107d485277c739b4b719527095a3eab
MD5 eecd97e2c0319e06a927acf648f0f06b
SHA1 76611c4fe9b3c415e05cfd4a8c67f9e2583b9245
SHA512 6989953fdc912904ac1e3baad79417ec975a0f18a045662ee50f0468f52cb05ec98165c0cbff2f98de8fc87b4cf14b8cd08095440137bcc0333918e8b53f59fc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8F4:A3k03kB56rQRJw
TLSH
T139256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 969KB
SHA256 fe2c5059976852e93302353eb22be3c891ce9d73bbe138c5c86d26692fafc34e
MD5 8d20903eb45df5021d36938d26312665
SHA1 99c45e3d6dcf3c5a1df1e519b41b18cb9156f55f
SHA512 6d35918da26d01755ee3534c5e70dd9b1777444dfcb865132bf599d36545a7fa74b7473d83878bc2981f527fec7d17c6af85d7b7f7932bd008e28696e2615147
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8Qu:A3k03kB56rQRJR
TLSH
T180256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 969KB
SHA256 88a108cdf95758005b2b9940c4cbda4b83dae3799cca6e4ea996fc889c254938
MD5 71d04aaff79c2f033603bbd709c61cd9
SHA1 c03631458da9735d778512c27092f8bb782df30d
SHA512 cb4818deb07dbdb73dfcb357953c61f4aaec8c92b6ef1ea5cd3c1cf535a627ece6619c5c6b2830863801e0251b89ffb310c1e33eb2a23a27dae8b8cf8b9aae2d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8Rj:A3k03kB56rQRJb
TLSH
T1BE256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 969KB
SHA256 2a85c48b90e9f1fef91047c177a6a684588c4f308899fc4b0c448e7834cd1bf4
MD5 bff96c19606514d9eb30dbb529a093f6
SHA1 580962c3ff7448373917d7736719d67edd7da87f
SHA512 2627e19477e36c9389b562d444e0e91815337827f27c99108706f659e83dc39b5d1bf3629f950044bbafc7897a33d15f59a43718246b0f3765bf07553e4cc533
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja84g:A3k03kB56rQRJT
TLSH
T1F7256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 969KB
SHA256 fb2b8a921dbada8482f91ebd593a3b6b53a6dd7f5b79f99874f5d5669530f321
MD5 bed3475d1686c51cf4bc30f6f8f2eba7
SHA1 d35cd5348b875eaf4d34ddac3ce12447fad18749
SHA512 89a65b9449848fbcc7100acdc7226d7c191d88ea50418f7cfcaef101a5a0dba6e0a0710fd5f6d2a30b6f6057d41fba45cab1ffa9520262ead47f7a1f3498670f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8XI:A3k03kB56rQRJ6
TLSH
T172256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 969KB
SHA256 21f245eca4373dae0d343cdcaadbdf9c235a0bd04e0fd742723b916481ab05b7
MD5 9712b9af022c9b5f7c5209e0a7e0cc93
SHA1 b82ff50e64e61ffa6cab5ea897b611cd33df1064
SHA512 0b114b004c3438a35086a8c12d3622a0bbf492b118e8b57388864726c4cbbbf7c7631fd44689f3e090ff637cc48323546ef2b8369deaee6385cb7ec5aad1402d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8do:A3k03kB56rQRJI
TLSH
T1A3256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 969KB
SHA256 4dc18254d9be01ebcf587033f4aaaf8713d13f4e3021244a47528c0b7727f693
MD5 d17d3a4253a5e86c0568a406a1124f61
SHA1 a30bb7d8c4c80df55baa13c3b90269a2c799470b
SHA512 014f5fff8bdd21061dfddac93678141fff0bec3c475c7f2176d6f896062aa32211a67293074d9f9911956fbe64f28036322e54186cc85f1faa09599cfc233941
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8O+:A3k03kB56rQRJ1
TLSH
T176256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 969KB
SHA256 c077ec09fdb20fa2f3066ee4d13098226a99c888b3fa09073bd3263f855572b1
MD5 c6fe2629acd0fb7ee0ab11769f54ab70
SHA1 1b9773e192ae51303804be10b85a96c5df298b1c
SHA512 a54bf6e0ce2c186df0e5bd2f6ab04248041e3d25de713220b0b14683616fd052deda89a003aacefc3d8ee831f1e1a6353bef70295ff1f0942e8f6bd9c46e207e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8OQ:A3k03kB56rQRJ9
TLSH
T16B256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 969KB
SHA256 8e8c7ebab39b63230f87fece422cbec83269adc730520aadab27e8bafc2e29e8
MD5 8aaf44650eeaa24de02da53770476579
SHA1 c6b4d751e7437669a19cda8766427a7f8844d3da
SHA512 0c998816fd5dd32f29d6ef0ffc5db23259d5fea464f1012d9641f3f545cfa8ea498cf49a8a361cb993187041cf8d39050b301e6802aa6bd7bc269c5978ad9358
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8vX:A3k03kB56rQRJJ
TLSH
T142256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 969KB
SHA256 1dc4a5c7e6e490172f65f3be808c3be7e8f94e6d25ef1436ca9239fb65b691d1
MD5 da7c08df47c62abae58bcf515e255fe9
SHA1 1fbdce73ebf69305a9ffe7a9a30bb25eb95ddd47
SHA512 6eff5810ddf4554847d30d9965cceaaf0cb90bfb32c04c6da31a304155ccbbfc30fd49127cfc8e24feb5de4202c3de31f38e4ef13cd966bcf6567e77e61f4426
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8lL:A3k03kB56rQRJD
TLSH
T19E256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 969KB
SHA256 d889e03729cb77a8660534f2daf3e8eedc20b84ae79c783cc1b4229f875f4f24
MD5 169703e9dfe536eae42c82c9d90c3382
SHA1 8bb9ef9914eb87c626831eb73be306c19d064a30
SHA512 a769cb63eb65c5539aa1a459e0d8f0504cf6268a18ec83f949e85c7d0456fe01c3947456cb78067ff57d86ae521c9f1c405ff27ee9eb9fb431108a825a5973c1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8DM:A3k03kB56rQRJu
TLSH
T1BB256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 969KB
SHA256 09d55039ddb5f3334a3e52be777824479518a60c1a57bb47fc87a2de92b24c7d
MD5 4533e36f32121aeabc2729bf90d3860f
SHA1 465ecdeb877ddecfc4e3855fcd3af71ba8347e1a
SHA512 86ffb04563dc528a78a54bba2ea15458e13786a34ccedda30f2a5e5bf0283a5a97cb64ac6cb0856f0327fab1f98a9604291f68abc3fa51e4eac84007c2ded952
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlja8Eh:A3k03kB56rQRJA
TLSH
T16E256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2668-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2668-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads