ecb4d98ddbea97d739f48ccab7a8069446db3c3ade2e312630f6b3683397d17a

Analysis

max time kernel
60s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.4MB
Sample260706-2jpj4scy91
SHA256 ecb4d98ddbea97d739f48ccab7a8069446db3c3ade2e312630f6b3683397d17a
MD5 13fe587d2ffc22c4928d8267082b6bbd
SHA1 59c4da0596b55180793db9d5f142890ef82c074d
SHA512 3b13051d1cabf3e15ea32519693646dd7732559d7108d5c009b29be8530ae1b96aa431f045311e594b2a4d1ed100920334bc51746137e0e9a4f43db9cef649b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheLE7i6:A3k03kHRJARJyi6
TLSH
T195653883AB469CB5F14D84349592823DA2737E2D07E356CB235E7E0A5F357C86AF8318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 7 IoCs

resource	yara_rule
behavioral2/memory/2404-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c508-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d7-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2404-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6120-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00540000000184c8-672.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c526-1871.dat	INDICATOR_EXE_Packed_ASPack

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c508-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d7-11.dat	aspack_v212_v242
behavioral2/files/0x00540000000184c8-672.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c526-1871.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6120	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{827CE4FD-CBE0-4453-816C-D131BE24BB81}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3440	explorer.exe
Token: SeCreatePagefilePrivilege	3440	explorer.exe
Token: SeShutdownPrivilege	3440	explorer.exe
Token: SeCreatePagefilePrivilege	3440	explorer.exe
Token: SeShutdownPrivilege	3440	explorer.exe
Token: SeCreatePagefilePrivilege	3440	explorer.exe
Token: SeShutdownPrivilege	3440	explorer.exe
Token: SeCreatePagefilePrivilege	3440	explorer.exe
Token: SeShutdownPrivilege	3440	explorer.exe
Token: SeCreatePagefilePrivilege	3440	explorer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4120	sihost.exe
3440	explorer.exe
3440	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2404	2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
6120	patcher.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 3440	4120	sihost.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_13fe587d2ffc22c4928d8267082b6bbd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2404

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6120

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3440

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2264

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.4MB
SHA256 ecb4d98ddbea97d739f48ccab7a8069446db3c3ade2e312630f6b3683397d17a
MD5 13fe587d2ffc22c4928d8267082b6bbd
SHA1 59c4da0596b55180793db9d5f142890ef82c074d
SHA512 3b13051d1cabf3e15ea32519693646dd7732559d7108d5c009b29be8530ae1b96aa431f045311e594b2a4d1ed100920334bc51746137e0e9a4f43db9cef649b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheLE7i6:A3k03kHRJARJyi6
TLSH
T195653883AB469CB5F14D84349592823DA2737E2D07E356CB235E7E0A5F357C86AF8318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe
Size 1.5MB
SHA256 d082da02e129dc22540fb6ac83851d0afb7c379d1860931e671858a33c81b0b9
MD5 ea0f3f084cf398223e07ca0cbf7641a3
SHA1 8c892cd50acbfd06381ce98f65aa33f7ec730ed7
SHA512 1567ae58695fa539c5aa58f94cc93ee9f3814c734495aa28fb86caf1c8b88d7c3c35cd8459f3a8d869235d58ede2920b32736d294cd51188233784c684c1fbb1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheLE7iev7MFi:A3k03kHRJARJyia7gi
TLSH
T168752783AB469CF5F14D843495918239A6737E2D07E356CB235E7E0A1F367886EF8318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.0MB
SHA256 9ba460873b9ffb8dbada916699e253cd7d45d938a321fd476495260bb0678263
MD5 f52db57b6f7482953e619e0263d02c35
SHA1 d02ba83bd4b128ce2db62fd9787e83adcc1419dd
SHA512 99f9f8026d598a331f56276fafed05b6abcda1631a7b2b79ca12b40e14d64465d77ee357d85c4cc7ea231cf1306c83baf955e05eb40c81a44444d4dc6d9f386b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheLE7iy0Le5ji0hmxNrM:A3k03kHRJARJyiyPji0Aj
TLSH
T1AE954983AB558DB5F05EC074C492923EE6323D1907E386CB134EBA192F367C95AF9325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
Size 1.4MB
SHA256 1272dee0cdb4662bb958840bf36d3576816a978ce9466014d8b83244e1dd3c32
MD5 5db28adadf6e65e5676b063f64764e05
SHA1 57af06bccecf87dc53d1ebf89587a39f6fab1c18
SHA512 7758f68f8d45406d520d093fa5e33386f941c81ab3672fe663f64490426b9da1aae4692150b5db1381e480afddc558e0c156be04ee699fa25df130b1d5833e99
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheLE7iN9O:A3k03kHRJARJyiC
TLSH
T1A8653983AB469CB5F14D84349592823DA2737E2D07E356CB235E7E0A5F357C86AF8318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 603B
SHA256 b162cad3e5056ed4fc0b7ea8dcb12c1ef3631852158a72df85c1ec280c90ce97
MD5 ed07b0e3316b5ee3273a85b1199c72cd
SHA1 7918a417328810df54e05e6b04817d8d5445e10d
SHA512 5002183a1ee175aeddfe27670808bedc79c612300405a852aa0d6ab985192c3bde0dcace48590ad9e0b3ea89daa65315772674f6e7e194bf1663fbb1b73498a3
TLSH
T1B1F027D7D79597A9E413123CCC9665D17531F6A0B98322338041AF5D6D3AB21AE424F8
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2264-1019-0x000001F3B5000000-0x000001F3B529E000-memory.dmp

Download

memory/2404-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2404-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3688-1380-0x000001EF156A0000-0x000001EF156C0000-memory.dmp

Download

memory/3688-1342-0x000001EF03A30000-0x000001EF03A50000-memory.dmp

Download

memory/3688-1343-0x000001EF03F00000-0x000001EF04000000-memory.dmp

Download

memory/3688-1336-0x000001EF001E0000-0x000001EF002E0000-memory.dmp

Download

memory/3688-1350-0x000001EF03C90000-0x000001EF03CB0000-memory.dmp

Download

memory/3688-1569-0x000001EF17B60000-0x000001EF17DFE000-memory.dmp

Download

memory/6120-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads