077ab5df8303869a66376c158a16795305981208aed3b4fae9ac62bfd5fed6e1

Analysis

max time kernel
108s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.6MB
Sample260706-vxwr1sh16w
SHA256 077ab5df8303869a66376c158a16795305981208aed3b4fae9ac62bfd5fed6e1
MD5 f97271b8f2e35196df090351439cc77a
SHA1 797d43036f5d9be818284e8c207594fdef008557
SHA512 7e9b2572f70f2a1b952390aca12dddccb4d1103acd906e264c80e4638ced35d9ef8c0668fa8bc1538f9e1468c5b18011c54b58aa18cb38b0c7ec95598360b57c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsCq6D5TvinrmbP0Le5ji0hmxNrM:A3k03kB56rK56r0Pji0Aj
TLSH
T194753916E6A44FA5D02FC074C5D29666EA733C425F3087CB1354AE283F37AD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 12 IoCs

resource	yara_rule
behavioral2/memory/5028-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c5d2-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b7-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5028-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5472-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb61-236.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019965-540.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019964-542.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019f37-1025.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001ac54-1287.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00140000000188fd-1533.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0009000000000158-2112.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c5d2-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b7-11.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb61-236.dat	aspack_v212_v242
behavioral2/files/0x0003000000019965-540.dat	aspack_v212_v242
behavioral2/files/0x0003000000019964-542.dat	aspack_v212_v242
behavioral2/files/0x0003000000019f37-1025.dat	aspack_v212_v242
behavioral2/files/0x000300000001ac54-1287.dat	aspack_v212_v242
behavioral2/files/0x00140000000188fd-1533.dat	aspack_v212_v242
behavioral2/files/0x0009000000000158-2112.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5472	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5028	2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
5472	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_f97271b8f2e35196df090351439cc77a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5028

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.6MB
SHA256 077ab5df8303869a66376c158a16795305981208aed3b4fae9ac62bfd5fed6e1
MD5 f97271b8f2e35196df090351439cc77a
SHA1 797d43036f5d9be818284e8c207594fdef008557
SHA512 7e9b2572f70f2a1b952390aca12dddccb4d1103acd906e264c80e4638ced35d9ef8c0668fa8bc1538f9e1468c5b18011c54b58aa18cb38b0c7ec95598360b57c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsCq6D5TvinrmbP0Le5ji0hmxNrM:A3k03kB56rK56r0Pji0Aj
TLSH
T194753916E6A44FA5D02FC074C5D29666EA733C425F3087CB1354AE283F37AD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe$

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
Size 1.9MB
SHA256 42c96b3bb398d7e5f463dd354e3800912afe5f4c3a2820467cc9c8a9fffbd466
MD5 54aec78645e294ba8d36913308694e58
SHA1 07503196c151df0e6e932cf60910b72e2aeb07af
SHA512 a79a00fc1698df3890c9475267adebe21b329636b8152edaa6ba803147301b4fe2bd1699c5a4c4f76ae1ef30026b8430bfc9ea469f69003a83db010f19cdae31
SSDEEP 49152:A3k03kB56rK56r0Pji0AjKdjY9L6FtLNw:A3k03kCrnrSjoiDVN
TLSH
T187956B16F6A80F65D06FC178C59696A6EA733C411F3087CB1354AE293F327D19A3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.2MB
SHA256 3e5187f73f68eb2d76992ed0c7fe9cab83672b166bd4b82bbb30933c337477f7
MD5 ef648722040179ebacc257c1381091a0
SHA1 7a4baf6661ddce775d4acc06c066bc95bbf323f1
SHA512 359264e0c6721cfdda9c5e173fa803ac98f18d26ef851f183649f2b12f9c9b8b24cf69a44adb1a419e61a533aa7691e96958117f40ec00e3775c27a1a072b417
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsCq6D5TvinrmbP0Le5ji0hmxNrMDD:A3k03kB56rK56r0Pji0AjKPji0Aj
TLSH
T152A53916F6644B65D02FC079C5D2969AEA733C425F3087CB0355EE283F27AD19A3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.6MB
SHA256 f396aa3f4da055d8e6042cc22ec921f45fc97dfcccc6b0dff31818f36b385cfc
MD5 bd521e9d044afa962799d4d019ddb246
SHA1 d05423665a1f7b079092fb0ffe406c8a451ce087
SHA512 73e9c2ab1558ea36bf0a181d76ecd5d46350619563268eaf960ebd6e6fa7cd1908bc7cb3926bf07bf1689a8bc62ba543f723e2e7eb18b77d3ddc5a5e66b7db9d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsCq6D5TvinrmbP0Le5ji0hmxNrMwo:A3k03kB56rK56r0Pji0Ajc
TLSH
T120854A16E6A44FA5D02FC074C5D29666EA733C425F3087CB1354AE283F37AD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
Size 1.6MB
SHA256 034249bd1874ddd770978e83977c5448d3e65f70e8c622348c15b0fddafda48d
MD5 71051b43f57e3a9bb5628652c0f69126
SHA1 8a7b857616592392e0b77ee95fd5c6474ed548f7
SHA512 f5965fecb3e0e608e1a8cfc2e0cc07a186be508a97a81405af8eaceb2064c0d92b3a0f38537eecd618070f2108c6dd5836b4673410a3fee6afc010ad7ff2dbc5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsCq6D5TvinrmbP0Le5ji0hmxNrM35:A3k03kB56rK56r0Pji0Aj6
TLSH
T1B7853A16E6A44FA5D02FC074C5D29666EA733C425F3087CB1354AE283F37AD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
Size 1.6MB
SHA256 75b34c2fed95d53d9c803db1e525f0dce573faddce2759fc83a7d5aea3a21f99
MD5 b93cbf0289bb442d57b9bde231499210
SHA1 d489a0b5de4f5c1f04e210fba1e8257f3f65cce8
SHA512 9d395f7191eb209b04bf38637da42c25d2b894cd219b6c81f17298753c207e809b27098601152cc337c88630945a8f4b16639d8e39c40aabcbd28dab5a3ce307
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsCq6D5TvinrmbP0Le5ji0hmxNrMoW:A3k03kB56rK56r0Pji0Ajw
TLSH
T15D854A16E6A44FA5D02FC074C5D29666EA733C425F3087CB1354AE283F37AD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 1.7MB
SHA256 0ca6aadbc50e06abf301cf2cf3436a03d366ee1e9cafdaf1391d7722d4c99d05
MD5 ded8ef637d608a7e76947a607fcf30b7
SHA1 1b09c3458a550eec0fd08c41c7daf507c08bfc0d
SHA512 479cffd019f07799a581bd22c598271bf0e9903a32921b8cc8cd50228a75239147968271dda0be7ed7617ffcb28bc0f5c209dd4a4dcaf88e23a146396452750a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsCq6D5TvinrmbP0Le5ji0hmxNrMPF:A3k03kB56rK56r0Pji0Ajq
TLSH
T191853916E6A44F65D06FC074C9929666EA733C421F2087DB1354BF283F336D1AA3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DW20.EXE$

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
Size 2.2MB
SHA256 b8a6e4b1eafe8c7a3ed11a0c9d929f56555d0f306ae81923e8d0b35f6b44a8d4
MD5 529da2f1efe818c7ee518f527957af8c
SHA1 e14279ad09390f2ddaadad589b046185a61bcdee
SHA512 1335461b19f8e4dde770fd663dd1ec9be588387b0dafd238ecc8378ca9992bf255890ae480bcc6a16a2c5ac8c3649230228e4df3cf7a252e599f70f1fa73c9e3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsCq6D5TvinrmbP0Le5ji0hmxNrMRm:A3k03kB56rK56r0Pji0AjW8tDZqrKV
TLSH
T1BDB53916E6A44FA5D02FC174C5A686B6FA737C410F2097CB0354EE293F376A15A3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ComSvcConfig.exe$

Path C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$
Size 1.8MB
SHA256 3636eb8361a963d9afcbfd61537976fe12e66540634784e44efb7909bbe5ff85
MD5 f1579f160dadbc7e93d7d303711a1310
SHA1 54a5b78b1aab8b7237ddc9759b12a58e4b1aa45a
SHA512 4db47da7a8be48d59fa14e919cff525f2dda3632e6ba2f2ea0dd76b7e06e43f0b09a30b4af5e9c9633e8bf2feb5d4440ca1fac367bf0ea5bc4cf6a6c521c5b31
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsCq6D5TvinrmbP0Le5ji0hmxNrMbw:A3k03kB56rK56r0Pji0AjmIiHq
TLSH
T12D854A16F6A84F65D06FC174C5A25666EA733C421F2087CB1354AE293F33BD09A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5028-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5028-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5472-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads