Overview

overview

10

Static

static

10

2026-07-02...ry.exe

windows10-2004-x64

9

2026-07-02...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    106s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 06:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_0744d335cad0c71fcc77af97bf973855_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
  • Size 892KB
  • Sample260702-hexv5sdt4x
  • SHA256 b364a8dbab7d9331530bf7b05f06f64f2648c35225f17e8257c6292d5cd5140d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwareaspackv2discoverypersistencespyware

Malware Config

Signatures

  • Detects executables packed with ASPack 50 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ASPack v2.12-2.42 47 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_0744d335cad0c71fcc77af97bf973855_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_0744d335cad0c71fcc77af97bf973855_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:3220
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1336
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5712
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4580
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2768

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 892KB
        • SHA256 b364a8dbab7d9331530bf7b05f06f64f2648c35225f17e8257c6292d5cd5140d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.4MB
        • SHA256 4d0fb1f0f3781233fdd4c2f9df53c1a73e03a853b559dc8140c70c0a825ddf9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 906KB
        • SHA256 63f92b29f1aa35147ba1b56e0725b74606a9c50ef3b1a3be7a16401c2bab9d06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 939KB
        • SHA256 64b491e60650adea45ed3ea70f86309a54829cb92f7b90ce6493a79458380738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 915KB
        • SHA256 b063b73e8942a86f70a2f3d651cb310a32bb5d9270054d3b169bdb2cbaa9ea20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 915KB
        • SHA256 23a250accd8fc7134a60bb9cbbc1554db9e0451e1a53dde28d813e478842a2b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 915KB
        • SHA256 935d7045ca625aca0a06c1d4b0ef8988e0129b554ce79cb161a9a6b5591a89df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 915KB
        • SHA256 6a950170ac3dff0e293ac72c75ea341cf6d40ea8ff2bbd4abe423fef98e42ef3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 915KB
        • SHA256 0fc642b88440b49034890f05e6efb0f806bbb42a8d2d898e2c8dc00f0e3156b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 915KB
        • SHA256 4ed1d8b492f041c69fae3af78e65b2375bc58f6adf56ebd1f27a29a7881499cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 915KB
        • SHA256 0c42ff544be6d84988c781e239928552e32f7400381e1b6a2ed0d490a5b59ee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 915KB
        • SHA256 86ff59ae836cf3a0e753709ae071888095b6d489003e65966b05ecaba80868f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 915KB
        • SHA256 69b15945ea52a9e6132cf6f063ea635935e5ef95296045d84237eb936039be68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 915KB
        • SHA256 331079b202d13334d7259af9e7f9d4d6985708a680570faa7118907bb40cf9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 915KB
        • SHA256 ce69d444affabffed3b2259f5b22f90cf3ac3a2163fcf56447d8f598866b5a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 915KB
        • SHA256 b9f25f56023c2f46b96243f7d7ca7e87d9ae55609600e9a2ab2ff3819eed4e66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 915KB
        • SHA256 07cb7055f05cb2362cdb3eed7ddbff7bf26082120c0bc37fc6dd5635bc6c497d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 915KB
        • SHA256 c53ca8f64251fee1bd3b4f30f1bc70e92534f93cb0718a70cb5ee1ec691a8116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 915KB
        • SHA256 149ca650dfae9fc7326346d167cf0fe83d5144bc8460c2f038f6f31922394863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 915KB
        • SHA256 dea03ae1468ba2b20e8a34d932f1c4ce606f206d32b1d1f34506d9122d9e30ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 915KB
        • SHA256 3cced1ee75cbe46733dd17b16184dbe74998b4aeafe7a2b0955f1d641b5ee21d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 915KB
        • SHA256 f078e3dab41f63a7fa8606d9233a559c1b6c794094d8ca35456fb8e15e522b55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 915KB
        • SHA256 6c58696d9e72b52a9f5bbc3d13796f03618c14805c6ad007049f61ca8e278397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 915KB
        • SHA256 10585a02082a033a663fa6b55e8d51a5b0a4913ae264de612b1daf442210a99f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 915KB
        • SHA256 5ca78537dbb9de4ae6f14324697c04adcafc78935f9b8225825fad112a71c2e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 915KB
        • SHA256 0e3b1a32010768e825c19e42b142fb811767a5eae64921490321ffd131824e5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 915KB
        • SHA256 6be298847dead7670db585e4851cf825b1ec11bc44d085b7c7d71a95bfdb7073
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 915KB
        • SHA256 59d432c5ec83604c62b27b89c8660be155c5e8fb0799eeae288965a8335b72f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 915KB
        • SHA256 513cce075aa8bb6dd902d8c50b51948525e9b5e07c4d8404771a8c3e8dc1c7f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 915KB
        • SHA256 8a0fc11baa4222be0ecb508376d627839ed1d7b126d83168233a9b17908d8575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 915KB
        • SHA256 f2229e14bef1e23d698b4953fc569e01ff34bf27c9888fd8d87d60d225550ee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 915KB
        • SHA256 2eca91fc8ad7085853d6cfdabd3327ba6443cdb29aa8de583effcc56146fd745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 915KB
        • SHA256 4426586517c88e48f3c1504137a0dc0e53a1ae57b085e660ec17369f06b01c7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 915KB
        • SHA256 e987082da39987d2b649f81fded206981faa1f2855832eb7b6088ab6c872c4ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 915KB
        • SHA256 eb82ccc0514f8b91033c5d38d10a9b8261dc03e66e11ec79cf84213b617e6337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 915KB
        • SHA256 bb7de4016d0f3c84d12a2721c7f35eb73cf9905ab9101d7c9db9eb29d119b55e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 915KB
        • SHA256 aaf3b67b67f1320c48c46fdc3325cadd77633f180e7da47130829573dc221983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 915KB
        • SHA256 b205795ab0b7ae03783a0b049d0b7c3cc4e68d60785c5207a37a68881f071bed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 915KB
        • SHA256 8f64ca5a0b7f95b4316d71d2f15856a19372ca28f968186442da3d5b3c8a7ce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 915KB
        • SHA256 933463716a24b26f554a2e342087286d36c8b025d41047f5024f4b3baa991d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
        • Size 915KB
        • SHA256 6b3caaa9411d4e71bd57de9342e0490147dae6a8445be6fca97ce3c83b8c90c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.NetFX40.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
        • Size 913KB
        • SHA256 bdac96e589a3f2efe49c818a9f54182148fd65f59fafa01821a680d0eabb4adb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.NetFX45.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
        • Size 913KB
        • SHA256 9733a2896960eda822338cb15d0b3317ffbf204419bc872cb16c440981fea353
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDXHelperBgt.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
        • Size 925KB
        • SHA256 308912a231db6d631d3353bbe3823b304f04bd95af30a2b83d38808ad2380909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETLANG.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
        • Size 968KB
        • SHA256 6172a9c83b6d6263693effb278e3328db83975b8a709e28e081f3be05e7d16e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wordconv.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
        • Size 936KB
        • SHA256 d5208d36d8e56c7ffe9a6a420f234fc7094d69aa68d143541ad7bdba972af567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msotd.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe
        • Size 948KB
        • SHA256 ec80d75b19ce41fbee76a72d777ff6502bf16a0e1b824cb0318290a151be8c82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 607B
        • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1336-53-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2768-1106-0x0000020E81E10000-0x0000020E81F10000-memory.dmp
        Download

        memory/2768-1119-0x0000020E94150000-0x0000020E94170000-memory.dmp
        Download

        memory/2768-1103-0x0000020E819B0000-0x0000020E819D0000-memory.dmp
        Download

        memory/2768-1095-0x0000020E801D0000-0x0000020E802D0000-memory.dmp
        Download

        memory/2768-1109-0x0000020E81C10000-0x0000020E81C30000-memory.dmp
        Download

        memory/3220-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3220-40-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/5712-1345-0x000000000A3A0000-0x000000000A52E000-memory.dmp
        Download

        memory/5712-1779-0x000000000A3A0000-0x000000000A52E000-memory.dmp
        Download