Overview

overview

10

Static

static

10

2026-07-03...ry.exe

windows10-2004-x64

9

2026-07-03...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    105s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 14:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-03_541b115a856cbc8fcce427354403f843_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
  • Size 853KB
  • Sample260703-rmffhafy8n
  • SHA256 9e8aea481bbe0dd0db81f1672818739b0564a53069c060f4d6c4421ed473f428
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwareaspackv2discoverypersistencespywarestealer

Malware Config

Signatures

  • Detects executables packed with ASPack 44 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ASPack v2.12-2.42 41 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_541b115a856cbc8fcce427354403f843_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-03_541b115a856cbc8fcce427354403f843_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:4004
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2004
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2728
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5404
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:6020

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Replication Through Removable Media

        1
        T1091

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Modify Registry

        3
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Replication Through Removable Media

        1
        T1091

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 853KB
        • SHA256 9e8aea481bbe0dd0db81f1672818739b0564a53069c060f4d6c4421ed473f428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.4MB
        • SHA256 b4515b45eaed05df0396b8df7dc97db9cffaaea4440df400f370a815be6e05ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 868KB
        • SHA256 77f01160c37a2d634c56ed4789fc31e89fbb9d123b5017674381ce282e922816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 901KB
        • SHA256 279b8a81a292bc7e3d055edd8628ef76b27c87eb5fc3acbff172f28b34b0e275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 877KB
        • SHA256 a88114b7de1cabe7f9206b4f1b99dc9cc6561174ae08ff5cb1ef35c860691368
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 877KB
        • SHA256 145af35025355925bcd90b434e662ec6e64b51bf60d302fd13bfc9c48f18114c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 877KB
        • SHA256 6e8b83d8a2244b6ed105d2b0c710820ae2c8e5e2993b544a8bd019bf58f749e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 877KB
        • SHA256 bbd59bf17ecffaf9284419ee13ecb7004a5b45a68db047bf6f0a07447f4a094b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 877KB
        • SHA256 18c9b24e15525fee83defb8df9d554c342237e6a7efd056f4d4c51e733447a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 877KB
        • SHA256 2f9da607b9387b3b76d16eda7b3ba73104a8fad9462ad146ec49b3cd6b207179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 877KB
        • SHA256 8d996a9969060b00dcabea1d279812e4281ac32e4f99f326ef7ed1a5baac64fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 877KB
        • SHA256 f6a971ed2fcd627620cd45be797ac761551c405da93ed7b87f7fbf83a15a3efd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 877KB
        • SHA256 1f4c1a4623facba9311b460b644338a415fcf363ef3ac47c6707eae3ac50eada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 877KB
        • SHA256 a21770b308300e8995169c5a57eca63cdd79c693c21d9757bd0299b9f7573fc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 877KB
        • SHA256 59dd8a5b3de22038376276d159396cdf5c27deef423dd55e9dfa368c7a018ea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 877KB
        • SHA256 8cbdc9e9f71beadb34fdbf699b10f1a01091c6a86304a2bec20fb755786b8997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 877KB
        • SHA256 5e0c119a1953742da8cc8bb610ec4da7c420d8b38249bf7148a5b7e9337748e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 877KB
        • SHA256 2a9ac51cceb5afb4a2c7d2cb71b1dd52ccf681cb8ed050cc9441d93476cf61d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 877KB
        • SHA256 a28bfd708e7f555d27aa09515862bbf5ba97b2b96e3e402920b9a9a1a5c9896e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 877KB
        • SHA256 d6fdc2e03b20ad74f21a686e22468333b4c124c8d3dab60129f616e075b9f4d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 877KB
        • SHA256 44c74819d2aaf3e752a2213cc81e4bd7a54f500dbd981797121db953aacfe900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 877KB
        • SHA256 144fbef84ac8753a39cbdf03cb3046a333c368bdf754ede3d17e46b426e78780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 877KB
        • SHA256 6410bb52761ad4d531b8c96deffdb44e658ef4adb2851f5e3583f56ea358a503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 877KB
        • SHA256 0868070f4af49722477a4c15f3266d7f62d6b052159513df47d680a9ec16fa4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 877KB
        • SHA256 f5cf2558944c498efc89f57a0a8aaa5c2b1abad8c91f11e2d8aacf17fa54949a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 877KB
        • SHA256 19e99403749b176ad2e5431951a672b35c597fef41844171e7c56c3240bb38e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 877KB
        • SHA256 49debbf9653cfd45c1b3470084a5e29107923c45521d622bc0e3f240fcff2f44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 877KB
        • SHA256 91cd6a30197d460894412705195d9fdec6714dc481662f1d21c83fdb28d8d93e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 877KB
        • SHA256 25b48532e2eb03849d122000f22a9ada77d9140c3a60255915996fccbda58c5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 877KB
        • SHA256 186214239ce228e203f328971d9a0dd7f16d39294d9810ba43ae6117f9a45f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 877KB
        • SHA256 45c9c12fbb4138dc4e0ec01923ef89d5a1e2d9824997a5eec276de8e2998c45d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 877KB
        • SHA256 4c42f71d6ac517e4dc9f53ecadf2a152c9d8cab6c7de300c9254644e5811b961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 877KB
        • SHA256 7709eb342466ad7060805b3bdc1b88fe7e0547dd508123e7da3e835ffa5342e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 877KB
        • SHA256 e6a6af288860011163f340ca7f291f31d2b542a8b9593d2193558ead1990e787
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 877KB
        • SHA256 5ce52efdc2cf11e1c945b480f2dc051a9e3e55b9eb339759c46cc79b1ecc5d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 877KB
        • SHA256 aba0cffccef2bc87ffe78107950f6e0e3c368427bf6754b9ecb90aa3ff974f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 877KB
        • SHA256 488cdf58ff6842a19c6e7d08ceb4a13a2a29303c00119a916631260eaf563df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 877KB
        • SHA256 7b25d9930c66210426ad6e971fdbe130b7641d0f6affdc880cfd2abfaf5e5a03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 877KB
        • SHA256 1196e358c9e7b87fc00869825cebed0c434539c190590c0168feaecf7f6376ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 877KB
        • SHA256 96d59c6e895ac7ab77312cb2f3bc743da1e5fac81522a91b23ac452e1cefc52b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 877KB
        • SHA256 ec95b84782a0d128c5767a3e10a08e0583f89f012c44ffe1e6741ab8be9b45a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2004-22-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2728-1108-0x000000000E200000-0x000000000E36C000-memory.dmp
        Download

        memory/2728-1109-0x0000000008510000-0x000000000855D000-memory.dmp
        Download

        memory/4004-21-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4004-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/5404-793-0x00000232801E0000-0x00000232802E0000-memory.dmp
        Download

        memory/5404-843-0x0000023294100000-0x0000023294120000-memory.dmp
        Download

        memory/5404-810-0x0000023283920000-0x0000023283940000-memory.dmp
        Download

        memory/5404-812-0x0000023293D80000-0x0000023293E80000-memory.dmp
        Download

        memory/5404-791-0x00000232801E0000-0x00000232802E0000-memory.dmp
        Download

        memory/5404-828-0x0000023283B80000-0x0000023283BA0000-memory.dmp
        Download

        memory/6020-1122-0x000001BD49C90000-0x000001BD49F4C000-memory.dmp
        Download

        memory/6020-2461-0x000001BD49C90000-0x000001BD49F4C000-memory.dmp
        Download