Overview

overview

10

Static

static

10

2026-07-04...ar.exe

windows10-2004-x64

9

2026-07-04...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    87s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 15:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_8388016a8f21f4979b6ea696e016f902_cobalt-strike_conti_elex_hijackloader_vidar.exe
  • Size 909KB
  • Sample260704-shffdagy9t
  • SHA256 0cce4e5edabcb81671642688fa3cafd18f74f41c62c2f8f2478a42faefc68745
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwareaspackv2discoverypersistenceransomwarespyware

Malware Config

Signatures

  • Detects executables packed with ASPack 44 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ASPack v2.12-2.42 41 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_8388016a8f21f4979b6ea696e016f902_cobalt-strike_conti_elex_hijackloader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_8388016a8f21f4979b6ea696e016f902_cobalt-strike_conti_elex_hijackloader_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:2588
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1604
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5500
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3060
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2428

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 909KB
        • SHA256 0cce4e5edabcb81671642688fa3cafd18f74f41c62c2f8f2478a42faefc68745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.4MB
        • SHA256 a546f822c1c3b7586b992ddc4cadf4986ea50ee223728a2b2fa533f3933bf395
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 924KB
        • SHA256 3eeb82a84751ebf06fd53c7bf0b56d74abad38eeb20d9fca4a1b52451b2ce155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 957KB
        • SHA256 fc1b94d42d81160d6ba8442c722ec6da7c9b1f88227ee29d4b2b293f7b32c109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 933KB
        • SHA256 a2416f6ade70a560f6ea87fc891285b496ef88557d038b7dc1db4dd964f20762
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 933KB
        • SHA256 71d82e5053ffe34b34045e47a5b831c8604acf4e15df4bb25bbf93317d64894c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 933KB
        • SHA256 ba30b85d2807c37a88d85a3804a1962484d1b79e139ad91bb20cab6471129193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 933KB
        • SHA256 ee02e82310c2d20b2bfa3b24691256cec6f97fca6df120806df3748900ba617c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 933KB
        • SHA256 e2075454ce59f92b3f57a8b3cfa780acb79ad23008ed31a01085357a75c748b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 933KB
        • SHA256 ff8bfb63db0cb5dbcc50bea4ec5237d62aac1599dd600ddc85c988c15325ec59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 933KB
        • SHA256 8a191ed225468dd9814c00eaac235003f14b4b7a0a87f70c92360bc839a5e336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 933KB
        • SHA256 a76f9cdaa9bac72f5e50ea82aa12ca655d840fa8380281e02c9c371b81151104
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 933KB
        • SHA256 688c9b6eceed3e7dec6820654f28b89cbc4908f605ddf37217b2febd03891eca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 933KB
        • SHA256 92c3f3d2d3485ce04a9923a4abf052548a60855212b05d7d6382972505916ca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 933KB
        • SHA256 6f20e9f346265b42c965a579e570c6fa61bca25a79f6d2be1e01f4d9d82aae0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 933KB
        • SHA256 5dcf6480b4a05a32e46bd10b51ffed0bcb9606361bc590728cc174d918a853c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 933KB
        • SHA256 51feddcc4dd0088d375f59b96424d5f5a0c4dae9cd984769e19fe2dad6205f3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 933KB
        • SHA256 6c8dd84b1bbc4169b26da7545df47f2dc91fd5b8eeb4ff99e0807868e5977158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 933KB
        • SHA256 24d8b2ad3b30c98cf2ece15f5c82926b450a7edc3ba832b63935239d00604b9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 933KB
        • SHA256 79b4c0bf7d6fa6edc4f01624fc8905dc5152fdd26f918227b2571be20daf5f11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 933KB
        • SHA256 ebba83ddb9572aaf281cfe9dc8a0b6aad289875e14e4698869c4a4742e9e1f11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 933KB
        • SHA256 7eec281c490023960b1de4ed86962988ec6294edca92911a1267cd4a95cbe15b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 933KB
        • SHA256 8c312bf46cb9b4a9a3127a5543421a8e0105730e80648b0fbf071bf2e94ebed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 933KB
        • SHA256 a1de6d410599b37e3b7c5966126e605c6c932d0cf3490451cb943c2080c3a0a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 933KB
        • SHA256 767ee64d76532bbb7b4d503d4ac6de9923a762b398efa5c2e348b8932e1533eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 933KB
        • SHA256 cf163f52a59ea52f0c5f149b55189993b3f7727bc9ec86fae141cfb5452681d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 933KB
        • SHA256 389216a26497e678cef75066b3741ece54dd1a2a0261c359ad0ea13927fe8d56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 933KB
        • SHA256 00da00a4e27c4345ea12638824520c1f5e80f1df3ed8fede29676a85155b59d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 933KB
        • SHA256 6e0b1d2031b3a573d0675088a464b2312f413c64535ef4e0f71c682111a84030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 933KB
        • SHA256 c482f5bc10438aad9cc462fd74a40fccbf3da3face2d650a5dc85b3bb0289c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 933KB
        • SHA256 13ca910f244b25d1c2823056576cafe64fbb21c9d412d2899f84340334c0ce76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 933KB
        • SHA256 235125c96a75c2ce366fbf7d6483baf8d754efe0120e2c1651f2410d2782e0c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 933KB
        • SHA256 44e0c228cb70a019847780560f6781b59b22ff08241f83a9f49f78cab167bf19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 933KB
        • SHA256 4c773ee0e202d8bd62d017d433ecaa20eea45d7defa03dfe9b5a3ad055310121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 933KB
        • SHA256 117b066d689e2e5414c2f4901ec0ec0cadf0c34da16e8de368478f0485f43d86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 933KB
        • SHA256 f00dba07169cc2d40c93df549521f651bfe268d0c1e0adfb222f90402be91173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 933KB
        • SHA256 3b90f3f92a0a21e73db030ab0fcba8ca9f596223655f244859dd69da6f975e5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 933KB
        • SHA256 dfcb9906023042b5be0ec07502b01819858f4566a3b314c438d893befbf64535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 933KB
        • SHA256 6896a9f8ae40845c7bb24f1010e03a4ec53d6769b20135a16e11902ab8d6a373
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 933KB
        • SHA256 b19e8b1ce60d60402b3ebf849c129d3ac0c3064a8679087919b3130d3bb26938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 933KB
        • SHA256 7e2aacd5d932eb8c171d1f1ce052717d9da2912749613466fa9cb7fe0462fc66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1604-22-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2428-1097-0x000001F1836B0000-0x000001F1836D0000-memory.dmp
        Download

        memory/2428-1065-0x000001F1AFC10000-0x000001F1AFD10000-memory.dmp
        Download

        memory/2428-1067-0x000001F1AFC10000-0x000001F1AFD10000-memory.dmp
        Download

        memory/2428-1080-0x000001F1938B0000-0x000001F1939B0000-memory.dmp
        Download

        memory/2428-1111-0x000001F1940F0000-0x000001F194110000-memory.dmp
        Download

        memory/2428-1078-0x000001F183460000-0x000001F183480000-memory.dmp
        Download

        memory/2588-21-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2588-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/5500-909-0x000000000E110000-0x000000000E98B000-memory.dmp
        Download