34c9f85e87b3460651b80ab975ae8d7302206b8040ae99b8a07f0f9e9d47e640

Analysis

max time kernel
146s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260702-apdw1sat5v
SHA256 34c9f85e87b3460651b80ab975ae8d7302206b8040ae99b8a07f0f9e9d47e640
MD5 18eb6cb5843fd97646e202840c3d0609
SHA1 03a2f761dab8b80b3c7e92cb5d02dfe410b246a3
SHA512 6ad6605ef4dc4424027d1052db51783aaca025f8221f498fe930336a0192c9ffa7c7bc7955ae63089bbcbf2c8d750e95ee45c0f38e8ae4d1a4a4ae20c86dacaa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT29:A3k03kHRJARJK
TLSH
T17B259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/2064-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000f00000001c4d1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2ee-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fc-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2064-58-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2564-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-242.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-255.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-287.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-423.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-449.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-480.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-481.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-488.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-501.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-509.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-510.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-535.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-578.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-604.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4d5-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-639.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-646.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-647.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-648.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-661.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-690.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-750.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-758.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-765.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-772.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-773.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a5ec-1025.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cd0-1292.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018902-1498.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000f00000001c4d1-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2ee-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fc-39.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-242.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-255.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-287.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-330.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-423.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-449.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-480.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-481.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-488.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-501.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-509.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-510.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-535.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-578.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-604.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-605.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4d5-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-639.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-646.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-647.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-648.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-661.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-690.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-750.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-758.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-765.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-772.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-773.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-792.dat	aspack_v212_v242
behavioral2/files/0x000300000001a5ec-1025.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cd0-1292.dat	aspack_v212_v242
behavioral2/files/0x0008000000018902-1498.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2564	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2064	2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2564	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_18eb6cb5843fd97646e202840c3d0609_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2064

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 34c9f85e87b3460651b80ab975ae8d7302206b8040ae99b8a07f0f9e9d47e640
MD5 18eb6cb5843fd97646e202840c3d0609
SHA1 03a2f761dab8b80b3c7e92cb5d02dfe410b246a3
SHA512 6ad6605ef4dc4424027d1052db51783aaca025f8221f498fe930336a0192c9ffa7c7bc7955ae63089bbcbf2c8d750e95ee45c0f38e8ae4d1a4a4ae20c86dacaa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT29:A3k03kHRJARJK
TLSH
T17B259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 969KB
SHA256 39831cd4a5d61a74a6c9c1192d3e5dd77352396016df8c44f47101d6ea87c4b3
MD5 1dc9d64ae7d7bad8a1c380feaf225916
SHA1 2829a5fae0685ef20ce99ef05f36b33e3edfdecb
SHA512 59480594d7f160e9635cacbad6eb10abb7126a249e2e516d19a421bc1bc6f252901bb55fd66ff3fdfc9125e917fa0d145071b71ec3df1336e46addf63f3347d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2rP:A3k03kHRJARJq
TLSH
T140259D03F79900E8D15AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 a4d917b3a2d1b696e59bb99ce4a3c0b5c46a00bb7456f25b94261c3eb9701f2d
MD5 d022491753968fe5ced269c94f2de696
SHA1 31bdc1fbbae05b7f2bc23bf0f5a4fcc67265f6ea
SHA512 184003f22191ef6355c78fe32ea7510098732a5fca29d7556bacc099e23644a20b6bff16ca83197739d491f4bc14b832b614f68b1a10a5b1d4aaab83597ff258
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2J0Le5ji0hmxNrM:A3k03kHRJARJaPji0Aj
TLSH
T115657B17F6A802B5D067C1B8C5D29A5AFA723842173097CF1394C7292F67BE19F3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 8786b7e7b04c3d440433e7703b4280f85a6cbdff8ed892a68fcaccf60a8ce9a8
MD5 38168feb4864cae52ac9dcf43935475f
SHA1 eb1c81075748a07532c70fb0609037a718628762
SHA512 682b6f7e754d1f4b4e977000d5a5b6fb63b49ab49275db10f4380fa2a762d8697769ff80645277ed16ff6e779fc25fe9bef2a73ef1d9e246464d4ea8f7a8c71b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2ba:A3k03kHRJARJ
TLSH
T19E259C03E79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 4bce7ccd8665b8e780dcf6448e720f78db7c4634989c86bba45b407b0eda0158
MD5 ea09c876ecc1362394d265d17cb6a8aa
SHA1 d9c040f4ba6d155e9544b0085a4f7073b774ebc5
SHA512 142de7c28b623fc2cad9c24b3e051f56ecb67e5f8b12d7d32530e02a80dad250d14b08c920d3f91e9974f9646bb74fbe9519134ce4dc88e6f1c8517b33c2e098
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT266:A3k03kHRJARJk
TLSH
T141259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 133ef9e54b5c047e358f6f81d2c14163f4b3f5e231666af6b668fa88a0ccc919
MD5 69a69f793ba7a32f4051a008433f41f4
SHA1 68bd9bbab0640f3d0b9906ba3117e6165d1c79d9
SHA512 e6f25f7ef69b13593f05f2280223a9e23bbc55c0ab66788ece65fc3be0814ffb36bcba2e80f905cf6383c3a135a5d29ce3cb8c0379677b470df3c326c654540e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2Co:A3k03kHRJARJM
TLSH
T106259D03F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 1941eae3e7dfbceb49b8260713d2d19b4082520d6d06320ad963656b503881da
MD5 75a1d3b15202b0bf8a72cfb8b5d695f0
SHA1 df0a5c87b57944c82081dba65aa5f43f9dd7eb5f
SHA512 811bc3a64f30c4cfba214b613e91d2765e663c446c052b2718de72e6adeb0ce33c5f3145843058db00a4befa1a5ebc4ac21fc9f914d3e0c545b42e32362e56f0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT22u:A3k03kHRJARJu
TLSH
T1DC259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 2363d18b69edac7daff16b70ab2e08830ed3649a7a29e3246423d1071307b46a
MD5 bd64b238e4fbb390e788e2393a394402
SHA1 6b286e7be44a3e501bfce827645f8ae56f5906cf
SHA512 77ec6c8ca4860c88b9342fe7aadaa068c3fc65f5e2bcdb9763d8d2a888095f8e935f273d0539725fb15f65e8c7ea3d3667dd698017aa3878606616717c653001
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2q9:A3k03kHRJARJP
TLSH
T12B259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 59334b0210a95daf9591eee56a43f0e06f0fa297e06d6ecf9aac83f0fabf2351
MD5 44cb70df5abdaff769234a942e0dea4c
SHA1 0fd83edd6974fe423e74ff570bb48949a51c510a
SHA512 2ae4e3d24064221d13602d834b95c2205fa9f5394c9ba10b58aeb8ed22c0c8c8550c3b41ddf1da472bc272691f662f63fc4fb40e3a1920de99d84da691c27a5f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2qc:A3k03kHRJARJO
TLSH
T11E259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 ccaabf718f79a7f815dc294ff45404edf47bde594247c8d6e94ee0ea4507e187
MD5 939edc785abef1333c46d3c63d36006b
SHA1 1767b632058ac9ac36b9cc91090dc6fb38c8366c
SHA512 6639ed0280a0491aa3339023b68750b9d462bd2ce8148c3ede3525496b13d112ef115a4bb0f65d42ca9eda89fc71aade271440e583a198680d9dbc8db4911327
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2jp:A3k03kHRJARJ8
TLSH
T164259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 07ab6602caaf04c4af78cff767a11c932f47da66b96b34b89a3e096e0e2cd695
MD5 c1ec90705eca8ac26403495c095b525f
SHA1 23780900f2cb71e05e60b0c7b8f21e56b0b895a5
SHA512 95233c2d8fdbb8d4eb29c40f9a71394025feb5f1ec4b19edbee441ac014ef24d10bb0d2d35782f81335b486f7bc42eaf9223a19773e23623fdcd543392823f48
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2EN:A3k03kHRJARJb
TLSH
T190259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 304931e26c30d8c5b37bc021aab3f6d6f60c1a1cc732ebb30c4fe4386919fec4
MD5 7f692544ef03b8c9d262b0de72c233d3
SHA1 1475e258e1fb313e573f38bff187ee33710d26a6
SHA512 262cc5e72b8dc60630192b976db30c14cdb967f6e2d6407356943d9a4ddcfb9a4757c412d628121ecb642191d6c66110541985ceae119961b583ce1cc3aaaa5d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2sF:A3k03kHRJARJN
TLSH
T1AC259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 fc8eef8aed85f029b335f02d8147815a555cd96ef5545fa913309dd27c99e736
MD5 f6145857bd0e862ad719d957cda02920
SHA1 8ae21f2d78b099e39fdcc87f63a5c6b9edc13acd
SHA512 02c857e1d5e444196d0d57d4e0d1f8828c03d248f579b63c51d6c1b23ceed3ff52ad43e68402b57216d90daee63751963be05b8bf30bcc8e16233e1693546cda
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2ZC:A3k03kHRJARJx
TLSH
T114259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 24910e6252c049a198c737bfa534284f731a3ec726d91eb905b1b2e933a90c3b
MD5 3be12fb74927e77d819c0c8c7766ff43
SHA1 2df1d594930a617b5d82a97c26a668b7ecc03ef1
SHA512 634ea5ab77c793198bf8cf3abd38fb46d834fb3b3793eb7ab2eea8811f5e6531d4ff73215e87bc8156820fa73ab9a648b66af0fb9535f4846ee02a5c82b9144c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2aw:A3k03kHRJARJ8
TLSH
T168259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 8fab57c30bbeed2486a910ba1587ab865b32df3a4465fee659412a4f1977bbfc
MD5 a35e53d3572ecc76fa8ddd1cdcf1001c
SHA1 64f093ace4ee198913086311a6b2c6e5b58ad8d1
SHA512 048a8172ecdb2044430773f4f2748048390e7b01b2f7e4d8ccb8339911e68772a3d5f31fcde4ba771937bbe250b1035f4afc7e5ed38de5a1c7ff08c5bc445087
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2hT:A3k03kHRJARJk
TLSH
T136259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 ddc5af1b1e24100fb0e944c79e7ca13b7abc55cc2c1c7d06c08594e35b4aad11
MD5 d8dcf2d1d913776e16af9d0db2e4d7b4
SHA1 39e833be3e46d992447242a0130450f7941f4960
SHA512 c2f94e7646fe4c8fe6f46a1f600d781ce0e177cd65315811a3288afab5cda4d0ae6fb48b472b832a5156bf9c6fdb4c2e2fefd9a9c5fd5a50a8ad6d6cfa8c67fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2Pu:A3k03kHRJARJT
TLSH
T1CE259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 c7888e00d743574c482803683d6314ffdf4eca00feff1a305407c8570a4904fd
MD5 23e7c6ea352c7babd4bcf7cf52270878
SHA1 06c9833d5cd52ec3a7786457b2bffb3bba5680ba
SHA512 227db70e4af68aced8b9a69e3ec6360ee6e401e7579179be6c8fd25c7e497b61f3c13bec43919ab7f356712ec153be944b857f1a58efc985ef993fc899ee817d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2zb:A3k03kHRJARJa
TLSH
T1BC259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 35a57fc1ab24ec8d22e5556dccc92c2d0eabead1111b31744f9562ee316d3feb
MD5 27935dad67a04b019fd33c5a73d9d761
SHA1 9cef6cd01ce6c0b1ee1f4e422b6c16e3b315f05c
SHA512 e4ee9442c92c6a747c4536d0fd3b4261bc7fbfae6e16ac041ece86ee46b73ac30256912180b58a63c4b180fcc91e928081e0ca2c40f05f594267bf29efbe63c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2Hf:A3k03kHRJARJq
TLSH
T1DC259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 fb1649d547763f43c2d80ac6e1cccd26dd4f6fb32acf99bdecfa69e5e9142669
MD5 155fddad48520cb80231576eb4216ab7
SHA1 d5833083a3aaa1eb0e4442baf2c1402c94bef3c1
SHA512 054d48e2f03cc9bcd9ee47df687e493e1b3ed6d0c4b2d52a6768f0d5db83eb5151412902d03d6e6adff6d96ccfa05dc9990969bd6700f1e187e5b0314efd1a93
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2wK:A3k03kHRJARJq
TLSH
T195259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 2622bbbf9b87fb2ea725ffec512a8644dfad4e9ca30f198bb26ce4c022bca3df
MD5 3343080ca7eb4df9143170ddd0e242fc
SHA1 a1f33d33a3e1846a26002c0f37ce128d50ebd92e
SHA512 db046990f3f537b9b126c326346cb167fdccb45bd9b2f8e6ec92298146fd345e68fe01e93d5ba1418fc31b2e3c8d5e810d352bff474083f32d0465b10df2eb5d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2tk:A3k03kHRJARJP
TLSH
T1F0259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 d89d7845dc067ba73727b76d40eec2c761d0cbe4cadc704209f76e4082f93942
MD5 7f38dddae9a981166b9c718a39ad08c2
SHA1 01e928377aaccc324f6fb77630f5235e48f565f7
SHA512 b19d4537bfa6165794832b95db1fa7ffe7cfb7a1ebfa8d8d3530d38ec847183eb60794626c45734d5b72052cab9a71c7757716c91585d04e23c82e68524fe03b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2y0:A3k03kHRJARJ+
TLSH
T1B2259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 dcd443403a654c9b05d79a78387fd40ce3fbdece5cbec4b594aa42c8333a536e
MD5 8fbf89bb4d00b2c0f2af9bd0fa66b67b
SHA1 dc4687464a278ba0ac5fb98667ece49cb4a2087b
SHA512 281124ec373e7cb77449b1b6a6dc6102f7a70dd6501c20676dee28f76668de9ec38441ef7dfe9d1c84c2aca0fd57d4e49d59c9266557e82e0929ed93307456c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2Bg:A3k03kHRJARJn
TLSH
T10C259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 96c0b61c90e803873b59b766de0e2413c8485939304f7e863f1a9b0e3172b44a
MD5 c5e5dae98e7d41d7115b9a0c28710c8c
SHA1 c9fc34ade740f969fb39d0b6c618d3a54ab9130e
SHA512 ad27dec231bff6e173b7b4d8b7b8338dfe898e9dccd19eb7fa0f47049ecbd12bb9785a19ea4f028709e0773f5418af9384bf7b0ff63ec9ed3bd1a285bfdda055
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2or:A3k03kHRJARJB
TLSH
T185259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 101179ec26b6a8bf52b32cacb301d6e1e50d770b09850995c4088686bbb4c9eb
MD5 c2a9aa4d26a21f1beb656629cb253358
SHA1 2d791fd65a0e9ef9d0938ed7fa2d658a81de195b
SHA512 cc68e73f26e960433e98a61dcb0d81b1f363ad8b034afe94cd374dccfde128abbdb9a54caf6b96a8804a1bb94cbeeae889832c1c8b043dd549119b110c3a29e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2Gn:A3k03kHRJARJr
TLSH
T1F9259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 d33e42a6886c5ac4834bed5c863a99e28a887dc7f15e11d81629f989996ca92e
MD5 26b6b09dd1ea7cda8721596d0a9c32c1
SHA1 6066d38b7da29e77628d52af61ae0db26f643ef3
SHA512 63e28409aaf595efcf07c58ca8bcc16d29f057cd3ae13e17598271f1dbf8b8e2b20309deefa9b73e0c33e2f36bc5a0c99b644ed111feea8c62e3a647519707e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2Mx:A3k03kHRJARJ5
TLSH
T12C259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 1296b015a73161e3be758cbec9bae11b5ac2025222ae0bf66b3c152ed6557d7e
MD5 a0954de37e32241329b2f6255d3800cd
SHA1 75e0ac80eaf0b65e400ad2bd49d72974231d53f6
SHA512 158992154a1a43e44a7c7939f4a7a9175950e8b4cf5d96eabe322ab3296ffd72cc1272c90d2034f98a5059683a18afb5069e7da548f6a6e2b09db87fe2cdda6c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2GA:A3k03kHRJARJG
TLSH
T124259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 bf30565feabb7ed8719874fea9b5ec3a0d72d8a34708a208a58b60161b61590a
MD5 856cedcbc47490b2aefbdba691e9c6e9
SHA1 61be813fb1263cbcc7b38f59c1d956f058fbee74
SHA512 976e404ad03b5ae7ad929768c6fac3e7b505bd0fa282abb7efb5bad39ca65f4c1f618f7ef8237ee0883cefde59bdb0b59a8f63ad15bbaec54ff1a59bdf903cb6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2f9Q:A3k03kHRJARJb
TLSH
T198259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 dc1ff3a49ae4f1eb1c8bc6053bbe68ac8f431b770093d49ef8452086a24be088
MD5 e142322321dfabdc8e0452d1d9a78167
SHA1 3256de16dec215d8aed434137c2b0c6f2c328428
SHA512 479fed5e799349201fdcc4963081f368afb7e19de91b2eeb4f6a5e4d62078d571e9e5b640103ecdd9410e2acc2bc2e19cdbb77476f41e0d484fea8824dbd3570
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2W4:A3k03kHRJARJM
TLSH
T196259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 61d69bd971c7a040736b267714cdb1a88c2f0e1c00f1f21483915970c808e6fa
MD5 ed3cad7edfcd76bbdc566fd69e7e2b04
SHA1 ea3bade855bb83a5edbea665c2d109070e2e89db
SHA512 72ae2780c04586fd36db2a4e2fa5a5b0fe97578f59bc62f100fa969d8063e48116cf3c132e920226718555e743242018a11f10a6e53657b4cbd66f74c148ea61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2Fu:A3k03kHRJARJN
TLSH
T11F259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 8101b4a72ebcdc569473b314beeb4d5ff8246d5cefeb778b493d33cd7d3a9df5
MD5 28111fd809957c01d13b8ec663fe6a9e
SHA1 fa9cd9e252d06639053c0e6b73acf57a0bfe7239
SHA512 db8d03eba54b2a5ed9d898e3025bded363928ed252fd630b9e4a9f011733492921194305ba897f97095bec71aae3dd876bfd3dbca125e11d9e91f73369871049
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2Yj:A3k03kHRJARJv
TLSH
T14F259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 66ec5c692e61b6aa46e85d120d58a7c81aa2642e282a10824869a6e4675020e8
MD5 b213d0892ffb3c9d5c56a75645f7aef3
SHA1 e00d151ebd79479e3ca9da4a4795076f8e595ff2
SHA512 3068126d84284f14e6dc159fc342d8c5d79fe3c5563be50143e9d47bf931df222b591ac8d793d081c9c2eed9a5afb30e3933a8e1cbd15540d6f87e47629c170e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2pg:A3k03kHRJARJn
TLSH
T1DF259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 e4233e7b9cb8b8e0153fef42c4d900fbf63a1b57b426acce7633f6d9a794b767
MD5 169029b19ee11a66de8fd463c4e51b34
SHA1 cb6d7906a8802a09d89652c1a1fb1e9ecafb0538
SHA512 013f7ef73954ea64d4d1a45a1ae3c9db3b729a60c41e7a2774958073c8936e7525e55de6289dbf899ee2fbd68751ed1c0df3e06a87cf3545d8b0fbb5eaf30220
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2wI:A3k03kHRJARJG
TLSH
T1E5259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 2d2ecc50765352888a049ae45e9a0ed293bb6cee9a4df5b79b2966fa5c7d63c2
MD5 11b67c7b7dcf986aae43bdde42c17c55
SHA1 446d80f48b564b9fbc63a56199062cb0b620cde6
SHA512 42675528a659a3775fbbfcf7e20fca8e9ab20944e1732762d3cdae9619f4518f2cb0fb2fd6e626a208d028e327d60f464c2c0d630add4f77a8164e2da686ab2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2yo:A3k03kHRJARJU
TLSH
T1B5259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 1f37c32dbfde2f34b4896aea30107d7a263a1d5598823882ccf298bfb8daf235
MD5 7f10fdece9d46503a4c70384b885463f
SHA1 a018d7b845b338c92b65eb18a01060b36b41e088
SHA512 20f9789d438bb84b5aa31592f21d32ad6ee99964521e510c7f70f8f180387a1714d99ea43f75940e5f4e150a31ae6b856ecca271ca9a300940a368fb27c3bf4c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2p+:A3k03kHRJARJJ
TLSH
T154259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 af78d09753c340448a2c52c88cd10456d509654ee5c99fbd825b5201985e47e6
MD5 850e56a28607c83b405e199acc9d434e
SHA1 1e0938665670d01c4f7933d135919266f1275713
SHA512 44484f608490ce6eb4909db89e1d8d2dfefb2a318c0984e009906f17786e955caa50e926aeb89ac506f4ee0fb5e86b80a4441ceec01862cea34f9cfe9c068c40
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2XQ:A3k03kHRJARJZ
TLSH
T1BC259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 e9a2e336f920762370d76b0fe540d9145b58c02aceeb5700ace6e1c288a35802
MD5 1e4e9b13c669e1fbfc7a0394bb89283e
SHA1 974bd122df3e5562905f4f1ea5395081cbd006c6
SHA512 eaa3ef0f2724743438e024b2c8fdd552ac6ff1df6ed78f191578349920c333a7602991e8ca8040675ec70ce2e73a309cf9b9c55950a6f94e2cc78af07a864da4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2sX:A3k03kHRJARJF
TLSH
T182259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 bf379f2f4287d6c702dc00575d5f661587507c6637e427fed9f48258576788c9
MD5 86df0e20014a30ae312119b757e2b5d0
SHA1 f1e3b6831f7074dc419877ff1c949200565f5dfd
SHA512 c684aa528033223d5746af4da0f17ad3e416ad01cad3690a724c646be1415d8dfea84e45076e220301359ebd390cc041caa0c5e1df078e6a118ec2d0e26d8eaa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2KL:A3k03kHRJARJ3
TLSH
T1C5259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 ce26c4f15ed98ef5da8eebe7097a7a21d9834dff94cb128f2e3401e8c730ad0f
MD5 8b5645c9d5c6ce5d0a53fae122e0d335
SHA1 82c139086b6cc1f16e0dac4d60acfe056078d000
SHA512 38049b040713b15c6fa486ecfa661e62a4c00a096156d97a2571535cb19a6dd91da6f5283dcb874ae88a0748d7bec715722c98821b87249daeccf8300c5beeeb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2uM:A3k03kHRJARJS
TLSH
T174259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 1b3138e69e375525dd2e503b4df5d91aec8cf5d05b6d997d525ffdbd90655847
MD5 e376c5ef4255de78508f0385e997a60e
SHA1 9beb19dbe1c096bba9505600980020507fdc4012
SHA512 73967697e706b9b072268349ef2618f58fc0152c9ff07206bbd2dbe200aad9049720ba1b206fc3bc364f12714d69a876860667a4826524271a630a67221e4832
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT23h:A3k03kHRJARJM
TLSH
T158259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelperBgt.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
Size 973KB
SHA256 534866cf22a9b18f9c7e2d19cdcef9d20530349db6bc7f2f6a900553fc04222e
MD5 6d751f6e43565e79e08d169a84858af9
SHA1 599df46799d800091dc5ee682950079a3b56d32c
SHA512 68994edfe07487b1ae9f097c301c4ee2fd538faf08a6a158853ecbcf14cb7a9d7905e0bfe113dc3b84f0bd1ba4e099a58e1494b7fa73549a8a9eaa8029a11aa1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2k1:A3k03kHRJARJ31
TLSH
T1F8259C07F79900E8D14AC1789AA69A22FB757C561730A3DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
Size 1019KB
SHA256 67f9ae907d4acba18b7f3a90516934d8a3e604d5acb81149a875993016b4d1ee
MD5 86f2a733f34d9104803dcab598eb3d42
SHA1 d0e3a3ad7315b049c35bb4f3fb993bb11be46deb
SHA512 0796683eb62701b1e92050365342ba1de7d8601ce9af776c3a3cba34640ec776f654ac75316f373a8c768ab52dff131211858009c12ae0e49d5f13507e12a312
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagtUT2pF:A3k03kHRJARJa
TLSH
T1E8258D03E6D500E9D64A8134DE9A8A22FB35BD92072097EF1358B7262F727D0BF39754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2064-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2064-58-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2564-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads