Overview

overview

10

Static

static

10

2026-07-06...ke.exe

windows10-2004-x64

9

2026-07-06...ke.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    95s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 14:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_c55517f81007aaf473f6c0c3c2c277e8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
  • Size 901KB
  • Sample260706-r77eqact9m
  • SHA256 bce742e56e881192b380e535c8c5420905e7eef9cdf00b4ca93a20a718636db6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwareaspackv2discoverypersistencespyware

Malware Config

Signatures

  • Detects executables packed with ASPack 44 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ASPack v2.12-2.42 41 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_c55517f81007aaf473f6c0c3c2c277e8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_c55517f81007aaf473f6c0c3c2c277e8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:3560
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:568
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1380
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4568
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5512

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 901KB
        • SHA256 bce742e56e881192b380e535c8c5420905e7eef9cdf00b4ca93a20a718636db6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.4MB
        • SHA256 0542cb4c0c60f158459e109b138d7987584e7ed9b81f6427af010fb571b7b329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 916KB
        • SHA256 c59330bbe112b370c60c9450fc4a5eef85153ca0027caf9ae762ad18cd9af79a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 949KB
        • SHA256 ac646aee09b5103d9b1ce7a2c1f26daf21cb2d857067d48a7778256e8cedf5e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 925KB
        • SHA256 0e98d83b90cc793c254d727a380e74621ca0a5228f989b7e4eaaab3200375655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 925KB
        • SHA256 10171d1d7bb652ed48f059880830e141c15b74ce982ac3612e4a24ccda729449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 925KB
        • SHA256 48652028471586eda8c16894e8cdec34d8c6255af16d7efd94173122f9390290
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 925KB
        • SHA256 3f5150dbb4203862a70cc25f9d5902e115adc1b3399ea8c1fd4c387689a89551
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 925KB
        • SHA256 3af6d3284076b93fc0bd1b3fc566b44a05aeca9a00bd9288d3d86b6c5530e060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 925KB
        • SHA256 0def2ef4a5dc16f19657dd2d9508d7f3cbedbf1228d3582555e8be0d8cf756ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 925KB
        • SHA256 b4f92803cfdfadd0287fcdf4c0a9ab475eb4938eb8cc416cace071cc7d70d3c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 925KB
        • SHA256 de09cb8160e110362cb24e60622ae2f2604f9c7c46750745868a53dcc584c755
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 925KB
        • SHA256 0d1a579cfbb2b27f1771d4a87c6e5771975da6c3525970a5f3877adebcd33640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 925KB
        • SHA256 6e6cbcc5e7b1fffe647ac1186c5beb625c8928f8a3da1ccca2795360384aaa7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 925KB
        • SHA256 8bbaf96a7621a88d81f1a106d2292546c9ad4c8fffe8466a1fcbb50372e60893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 925KB
        • SHA256 b51a36a61cd9c41d3f0c0514bdb27ca7614cf7fcf0eac0cb08f32f5b0a035627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 925KB
        • SHA256 39703a5bb1b21bd939f3b34d2d838a4bef793a397d3bcd0cdc7a8ba5a0e6a16a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 925KB
        • SHA256 34459bd19b8e3d6544b34055df485a81ccb2eeda9f70022e75d0c5c2e3287591
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 925KB
        • SHA256 07333a22956b3c3bbf22c1115fea8c25b4221d5db10455e6d5ca482e854750b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 925KB
        • SHA256 fe7d81e334922b3f85060dc6d411d5743d1c9a273f24e5850fcea5c2326f4f83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 925KB
        • SHA256 58d76b0f781b9eee9b685622dd2333f3eeb190bf65e1c603e0b66ebe60edfd9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 925KB
        • SHA256 768ad2ccca566b9e9fa90cddfd407b6982e053a0877aab3885e338d0b2dc1948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 925KB
        • SHA256 55d057cd87a5e278611376a9405211e31fb08c0ea6ac46cf08180546b1587c15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 925KB
        • SHA256 5c6a00a6f7c6e8fd52a6a036b988782931f6e58b7dc40ddb82869fe9acbf0cef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 925KB
        • SHA256 4e08e0bf275a2d8ec2461aab42d38a793586290f68ab80af22f3254a9e543fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 925KB
        • SHA256 7eace57d0b7bacf0f521ecf111f9df9978ce7ffc45fc5f5a9b9499ba1235f69f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 925KB
        • SHA256 fd4c172754d93088e43114c7f526828dcf5d180e023a83d709001ec1288abccf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 925KB
        • SHA256 741df677554e91682659a19d47f083a489eab0f47bf00346becfc57c8ab1b116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 925KB
        • SHA256 13888897db05f357599729f2c6f561faa12592981a78cc501921b5e944808e75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 925KB
        • SHA256 83b03d2e0a93f29c232f3be6ae2499ae62de7b918e8388164a0b18b52e66aaaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 925KB
        • SHA256 ade7448c08960add271a9b925b4fbab8113d84c3be68cd309212a68aa7bfd3ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 925KB
        • SHA256 ff13462f4d303aeeb5fd25d70911323ff42dbcb7043642525a158babd05afc27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 925KB
        • SHA256 dd1b6673ff6d312390e44a08bef63e5af3d7c6880154d089187b5c68c341a4ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 925KB
        • SHA256 2b7e5544519e249ab94c6d7a6281a5656b6b287798404fc35c80026427870112
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 925KB
        • SHA256 65652418faa28cf9ced44e198cbe5a13e782917e70d181b73c23e5fc89e06d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 925KB
        • SHA256 6336a4d74e2320ebb1eed08f26c477b2053a7143d31258e5341ca6038dc228b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 925KB
        • SHA256 d01d2b555cb0c3a0dcd4ec77933b107d95da9284ac144d0d4f317507bae0f7f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 925KB
        • SHA256 6ad9706537758abc9f4c88b267aeb77136e91ae876ca10135ee232a2a0c204ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 925KB
        • SHA256 bc88e17d7eace3092c7278eee55525af6d9b6855df0a86f0a762e87abbd26074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 925KB
        • SHA256 72ed4782beacd7979a4e8cd0851d8dc4da8e9fb28cc3d6c0eaceb8811543c68e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 925KB
        • SHA256 965d4a9bcf27b0df527ab31c2d1b55ebe31e1bf9a32c2ae03479ad2f95e1dfe9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/568-22-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3560-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3560-21-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4568-602-0x0000013B82C80000-0x0000013B82CA0000-memory.dmp
        Download

        memory/4568-620-0x0000013B940A0000-0x0000013B940C0000-memory.dmp
        Download

        memory/4568-587-0x0000013B82D40000-0x0000013B82E40000-memory.dmp
        Download

        memory/4568-570-0x0000013B801E0000-0x0000013B802E0000-memory.dmp
        Download

        memory/4568-569-0x0000013B801E0000-0x0000013B802E0000-memory.dmp
        Download

        memory/4568-585-0x0000013B82B40000-0x0000013B82B60000-memory.dmp
        Download

        memory/4568-568-0x0000013B801E0000-0x0000013B802E0000-memory.dmp
        Download