Overview

overview

10

Static

static

10

2026-07-04...ar.exe

windows10-2004-x64

9

2026-07-04...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    86s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 15:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_596f1bf2ea126aaa55cd5db6f9c2b986_cobalt-strike_conti_elex_hijackloader_vidar.exe
  • Size 909KB
  • Sample260704-ss2flag16y
  • SHA256 5145fd8f5a136f75148375df1d913692ef866603d776592bc2f3e333878289f6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwareaspackv2discoverypersistencespyware

Malware Config

Signatures

  • Detects executables packed with ASPack 43 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ASPack v2.12-2.42 40 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_596f1bf2ea126aaa55cd5db6f9c2b986_cobalt-strike_conti_elex_hijackloader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_596f1bf2ea126aaa55cd5db6f9c2b986_cobalt-strike_conti_elex_hijackloader_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:4224
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4956
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5612
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2460
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4416
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3804

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 909KB
        • SHA256 5145fd8f5a136f75148375df1d913692ef866603d776592bc2f3e333878289f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.4MB
        • SHA256 5bac667dff4e3d29b593cca70a128c9060ad5821f1f2432dffe740efd1911473
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 957KB
        • SHA256 14dfea388cd59a0704236d119d3e0ea4698e4920d76f3534a9809a3095af1711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 933KB
        • SHA256 a38d8c697c351274e54bd833a5af0a54a2bd1f5786aee89429ce03c2a2769677
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 933KB
        • SHA256 ab6a4d6f0760df09a2f13d49d13a0865a1c06c6da0af38afe34004e65007b578
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 933KB
        • SHA256 43a6d20934390c87a491a96ee8d36927f587c12222f28158c3152e9e51c924a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 933KB
        • SHA256 a3681b0fdab33e307bfaebfbc1c9b1c7fe60384afd00babac0308feed6c2222b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 933KB
        • SHA256 6a44bfb9afd5e3adc2c3c05516206c980f229d21d9d45c273db855a96928a70d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 933KB
        • SHA256 7b93169da38eb7cdd4c91abe409a869353321b47276f6c09ab537af2009aeb9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 933KB
        • SHA256 5cdb4d559def152f74cd6f8813f020deb0fc089072f2fcbef3a14483ef180aaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 933KB
        • SHA256 4e2b18709ba0d3a393f26dd591bec449a5734f073d8fe42f755ae99fdc8b1e4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 933KB
        • SHA256 285650a52048366572e2d70dd40332b257c756eb9fc2092adac1d3384239ddec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 933KB
        • SHA256 b488c57468f4fe712b60f51dd7af880b64b4bd26864f3d3cf5314d350581e35b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 933KB
        • SHA256 107b01288d2e8b7ff9c95a1a1d098bc3fabaf498199bdc2822a73b52fc724276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 933KB
        • SHA256 2d7d90d3231051ed2af0c4a029c10326a1f6dadda4c04f307a8de206fc12721b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 933KB
        • SHA256 9d9d66e1768d497276812b288ee2d9c52cfa058095f6b0b02f631af4e24eb032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 933KB
        • SHA256 5e8c38e1412f1bd0946577c577db9d294ea1a0ea06e1485886fa46eca9829920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 933KB
        • SHA256 1f731b9203060cd70df69f1fd98cc5d9d9a044ac3cfd689a0c6518f74dc67eff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 933KB
        • SHA256 de697a4a2b10868af54c171be7e7d2d62be3b3bd2fc7f63a817c320450f3ea1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 933KB
        • SHA256 560bdda0f6cef9513b203b6748389a744178f2a8a27136bbb7e0c746623b9a67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 933KB
        • SHA256 f76e452733b2c2832e660e72bbd8c3abdd2681e4b5fcead9567f37b200f2d4cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 933KB
        • SHA256 538745b88319642e3fed46fa7995975ece6900f5e831bceca62f54ac93af5036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 933KB
        • SHA256 6c8209a50fba349c1c1ae64d0a73fa157b8482444f808f3fa2069a3165ff54d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 933KB
        • SHA256 c459b659f1b33dabb9110112625c2f7ef2d696dab0d5ffe5db28cf00e48b5ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 933KB
        • SHA256 3277da9ac49332ff7147c776398fe25201ec86614ad8cded08fdb1a4122514eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 933KB
        • SHA256 40aa68a253eea41d6056230ff286a917391e48c41d1f469e6b5acd6cee08f53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 933KB
        • SHA256 5631dfc97c589e8417de0108f9efe91fc185fb7e9ab5842d0a15554acf39c77f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 933KB
        • SHA256 8af846d0940b5781b0c1e81280544eb6350a281ac6706618f7bc672da581ca69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 933KB
        • SHA256 c5a02626905c8bef6d2bc1ab6e816118b1802dce6f440a22c2f7ce5da78ff769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 933KB
        • SHA256 ca3599ef489b24cdc30008c1f570e0e4284215a1fece71daa48261d9b6296368
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 933KB
        • SHA256 8b9c0a40085b6e176d39f0417ac6926ccda3062c52c5722987077fe21aa899ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 933KB
        • SHA256 a3b23adf4463079ecc43abafd85078c6615c53987901c3957d41289a6ed671f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 933KB
        • SHA256 c5f8518b5f25b4cc4d06c155c5e4f0492523a01362361a26eec7093d5a6e90c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 933KB
        • SHA256 24708d4fffd84687b1d6b85bdd1c8d6a9f542b526fcdee91bb05c06ec31d7cd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 933KB
        • SHA256 bb5458bc2f95038b00d76120d61630e5a4d3f34988a77c143cf2bb2783a7ac33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 933KB
        • SHA256 18efec9b6e5ff943743f2ec86939a1a19457dbdf32c2b1bc0b4d58795ad77344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 933KB
        • SHA256 b149669526226e26285cde20bb946583e996d90796206a5edf609ef39b546182
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 933KB
        • SHA256 1ee14610a2b8c4d72c65757b83e49d690ac251e9c72b971c0c53bf2aeb1958d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 933KB
        • SHA256 6592bf20cf04881d71816a1ee89fb8a1d23b2ddc3c861ecd84c57f08eb9cd63a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 933KB
        • SHA256 bd50209ff617c904996e8fe09721b3bf58932f69d78bfd70091cd967960b7f90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2460-901-0x000000000E510000-0x000000000ED8B000-memory.dmp
        Download

        memory/4224-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4224-15-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4416-481-0x000001E181E70000-0x000001E181F70000-memory.dmp
        Download

        memory/4416-479-0x000001E1819F0000-0x000001E181A10000-memory.dmp
        Download

        memory/4416-496-0x000001E181DF0000-0x000001E181E10000-memory.dmp
        Download

        memory/4416-510-0x000001E194680000-0x000001E1946A0000-memory.dmp
        Download

        memory/4416-463-0x000001E1801E0000-0x000001E1802E0000-memory.dmp
        Download

        memory/4416-464-0x000001E1801E0000-0x000001E1802E0000-memory.dmp
        Download

        memory/4416-465-0x000001E1801E0000-0x000001E1802E0000-memory.dmp
        Download

        memory/4956-22-0x0000000000400000-0x000000000040F000-memory.dmp
        Download