Overview

overview

10

Static

static

10

2026-07-03...er.exe

windows10-2004-x64

9

2026-07-03...er.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    99s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 14:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-03_2ab38fd639a35d6da1523f490066618c_cobalt-strike_conti_elex_hijackloader.exe
  • Size 718KB
  • Sample260703-rs4qaaf16q
  • SHA256 f1283fd7c7151b29d1c5146ef126653bb1f99ed46747db44264d375ca7f30705
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarediscoverypersistencespyware

Malware Config

Signatures

  • Detects executables packed with ASPack 35 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_2ab38fd639a35d6da1523f490066618c_cobalt-strike_conti_elex_hijackloader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-03_2ab38fd639a35d6da1523f490066618c_cobalt-strike_conti_elex_hijackloader.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:2956
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6000
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2112
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4556
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1844
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:1624

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          patcher.exe
          • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
          • Size 718KB
          • SHA256 f1283fd7c7151b29d1c5146ef126653bb1f99ed46747db44264d375ca7f30705
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.exe$
          • Path C:\Program Files\7-Zip\7z.exe$
          • Size 1.2MB
          • SHA256 d599070bf8fae2f099a2a5c9601211bac20fd33d13bc8d2008663b380ce2be39
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\7-Zip\Uninstall.exe
          • Size 733KB
          • SHA256 238f7e8a24c0c034dffe00f2f2d66180e75072bbcd213d26b0d8fdb5c51b0d53
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IntegratedOffice.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
          • Size 766KB
          • SHA256 4f5c1398de336f5debe85e4d9f0490183e61b8375f280f7330ab1842bd574bba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jar.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
          • Size 742KB
          • SHA256 11f729f64cee1d7860969078d9cd3201d40f6415543c0408c31b2c00b7e3aad8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jarsigner.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
          • Size 742KB
          • SHA256 3477bd8710fe640873f1e6be2353882627338cd922f868393279119ca2318883
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java-rmi.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
          • Size 742KB
          • SHA256 099c70c4ea3a1bbab1986fcfcda5360abb5bffb32de480f1284ca0d5ac62ae21
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javah.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
          • Size 742KB
          • SHA256 47e06d0bc3ddb103377dc54f050761f1109be1b1218c801d7e1c98178aa36c87
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javap.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
          • Size 742KB
          • SHA256 939704b20f107e3aaf3438c9a52d1f9aa41c94265a0106eab6ec54af46fcb1b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javapackager.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
          • Size 880KB
          • SHA256 4059dc4d7179976190cfa79a83b4ef28d52bf782ed1176e267bfc5497ca345f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wsgen.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
          • Size 742KB
          • SHA256 db27eed65ec6d52c35e5c1cce66230ebd3db8692bf60cba65efe6bd485ee4553
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wsimport.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
          • Size 742KB
          • SHA256 437d031ea8cc71081704f69964223018a0246f3bbf31212a4892764fa5607845
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          xjc.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
          • Size 742KB
          • SHA256 a5be04ebf2e40abcf6c991444759b7cbd7d99a5091f5addd3c8685c0874fe65d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java-rmi.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
          • Size 742KB
          • SHA256 8a490a30b1faad4772054c6dcb8928b34f75dfe3b38982334118f33ba87f7f5d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javacpl.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
          • Size 821KB
          • SHA256 c79b5b584362d3fb7de345a1a2faaa59d1cf7e66ebc9b37e71e4995d6c75f8da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jjs.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
          • Size 742KB
          • SHA256 48ee9e71a89ec67e7035b5a25375daafd00ad78466fead11b3a80a383a1d3260
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          keytool.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
          • Size 742KB
          • SHA256 00e13e9928e94ed1d36157a1af1db082aec9cab714d68c580be31af5cf8113e1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kinit.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
          • Size 742KB
          • SHA256 1a5fcb984f9942e7604f4a27c7191c45c48530359902c633d5358e2e312e6362
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          klist.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
          • Size 742KB
          • SHA256 6fb1fda9a70bf63fde143731145475dffc41fceddc1de4f9e545d948de0aaa7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ktab.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
          • Size 742KB
          • SHA256 ef5a33025af022b21d3f8eeeb7f5a219db4e7fd9cf4a875ee6222c3d82327a75
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          orbd.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
          • Size 742KB
          • SHA256 5ec24f07915a97b7665e34676e8fae8e187e0c9635b039885348670bc2241ad5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pack200.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
          • Size 742KB
          • SHA256 668ea5d75b748d793b9170e7d915494042a8f25ffd5fb09221d6e22496810bfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          policytool.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
          • Size 742KB
          • SHA256 e8d50efe4720a0b4efff34f4cba6a848774d884b140b488162b49dd8f2c6c999
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmid.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
          • Size 742KB
          • SHA256 3f72c80ffa62f43a238e0563701cdcad1b2634570145995108e236bfdbc3d60d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmiregistry.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
          • Size 742KB
          • SHA256 4eaea4c1f4ad7e71a57c7e52bd24ad79919dee5f1d6e737c5958190509a789c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          servertool.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
          • Size 742KB
          • SHA256 fa3f2a8a6847e2ab205a84babfbc2edd77909aa69e4b3bc41317ae10c326bd98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssvagent.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
          • Size 816KB
          • SHA256 8f2ed6fd68b6d54dab273bda68a20f050abdf452abdaeda4e57639d1a2f8e8de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tnameserv.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
          • Size 742KB
          • SHA256 a832d41a98554433b191c3965f213e8b40c6363b66fe6baab67df89029ec4ed3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unpack200.exe
          • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
          • Size 938KB
          • SHA256 17de3e5dfb6fd6eff0014feaa7b938efdd909ae83515968d5ca54756e33f0cbd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msouc.exe
          • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
          • Size 774KB
          • SHA256 cbcc310ca7b2b3cd7720c0a40396a615ab90d80070aee1bdd2219b78c76f1d6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          osmadminicon.exe
          • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
          • Size 780KB
          • SHA256 15f33cab1e27d9c055968a36ac22f2885134707c208b6ae1eb9776954610276d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sscicons.exe
          • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
          • Size 798KB
          • SHA256 1b40318135f9804351ebcae158db3ceb318b3bf75d42779dbe5e4c477e0c1dac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 595B
          • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1844-948-0x0000017796AA0000-0x0000017796BA0000-memory.dmp
          Download

          memory/1844-949-0x0000017786990000-0x00000177869B0000-memory.dmp
          Download

          memory/1844-915-0x0000017782E70000-0x0000017782F70000-memory.dmp
          Download

          memory/1844-963-0x0000017796FD0000-0x0000017796FF0000-memory.dmp
          Download

          memory/1844-916-0x0000017782E70000-0x0000017782F70000-memory.dmp
          Download

          memory/1844-947-0x00000177865B0000-0x00000177865D0000-memory.dmp
          Download

          memory/2956-0-0x0000000000400000-0x000000000040D000-memory.dmp
          Download

          memory/2956-1421-0x0000000000400000-0x000000000040D000-memory.dmp
          Download

          memory/6000-1531-0x0000000000400000-0x000000000040D000-memory.dmp
          Download