e71ff5cc79a6b35362547c93d93fa99bc3b6769d7d9c95c12f5e73d1e50e0955

Analysis

max time kernel
106s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 867KB
Sample260706-ys2n9agy4p
SHA256 e71ff5cc79a6b35362547c93d93fa99bc3b6769d7d9c95c12f5e73d1e50e0955
MD5 c702cdff5e5d9cab7ba4b13f7682ec22
SHA1 9d4f3f918248256fb1af8621e6cf1c45951f5d0a
SHA512 b1af31bda5e5ed2c91e4679690586844ad2590c6a553c6a876c5fc8df51aa5e7403769b38317d29c6a969ae867f880209c641af4be3a1bcac78a272e730574d6
SSDEEP 12288:NZNlyfPDTnl12y2Uo8PT5vrGENZMkY8pJy6JKpdGyy5ALVTm4kl9aoc:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoc
TLSH
T16C158D1277E444B2E16282348AE0D766AB76FD610F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4988-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000016cd0-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000016b47-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2cb-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019852-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-438.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-487.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a66-524.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-597.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-719.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-738.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-787.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-818.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-849.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-900.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1000.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1142.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1314.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1358.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4988-2171-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5648-2172-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
5648	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Speech\Common\sapisvr.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4988	2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
5648	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_c702cdff5e5d9cab7ba4b13f7682ec22_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4988

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 867KB
SHA256 e71ff5cc79a6b35362547c93d93fa99bc3b6769d7d9c95c12f5e73d1e50e0955
MD5 c702cdff5e5d9cab7ba4b13f7682ec22
SHA1 9d4f3f918248256fb1af8621e6cf1c45951f5d0a
SHA512 b1af31bda5e5ed2c91e4679690586844ad2590c6a553c6a876c5fc8df51aa5e7403769b38317d29c6a969ae867f880209c641af4be3a1bcac78a272e730574d6
SSDEEP 12288:NZNlyfPDTnl12y2Uo8PT5vrGENZMkY8pJy6JKpdGyy5ALVTm4kl9aoc:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoc
TLSH
T16C158D1277E444B2E16282348AE0D766AB76FD610F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0a1a6952e5bc99eab3ab1a4256ee22575ba4435db2e1b8b8bafbd0648d1d4600
MD5 88f2cd0ea4b9ba59fe4922a8991771c2
SHA1 8e18eee43883ef553ea9b603a2a0b83032e571b6
SHA512 c5003180816fe41f347a9cb7e4f6af41a5a82ff13c9b917f8d485908128acf55608873f75efe07d54f32ef79ce6c25e35d21287505316bc408a0021e2cae9445
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaok0Le5ji0hmxNrM:cuytJJ8y5iT9Pji0Aj
TLSH
T191656B12F6A44271E073C175C5D2A75AEA7278510B308BCB5384976D2F33BE69E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 881KB
SHA256 7f47a7825aa45a1ea8b3221ad8230ec9806af7c3c9e2de85231eb9e69824a693
MD5 74f51cc08ee3efa526fe0715879f7903
SHA1 a71a7107c95aa5111ecf1578f98372793bbcbf82
SHA512 6869dff044ae6e6798f2b48168b9707f6d10b33c9806e0149fdea157a2a8c1db624c4e0d6f5f30acf8221145d883a820ac2d4663bdfb12241600da25d3804c8e
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoOa:cuytJJ8y5iT
TLSH
T130159D1277E444B2E1A2423489E09766AB76FD610B20CBCF6354975E1F32BD1EE39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 890KB
SHA256 40372bc5a0168d56a6b082e994af8998f2df403dbc885d1f03a9d65ac3e4c9fe
MD5 25e8daa6947c3f17969793ac6f0b4148
SHA1 e3da007ecfd5e161615e9ee61955cdf1f2cead79
SHA512 c527629cb996805b494743680e5959c9ffdd11c182c3d64e9e0092c1a149cf556a6f08e86333ab7452bdb3f265430c45c8e7504f23e483d8e7838780228e16df
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaov6:cuytJJ8y5iTZ
TLSH
T1E9159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 890KB
SHA256 b97c1adccc8adf1f2b8d42fe95bb560d6efd5999c80f54f2c2b99764279b6a49
MD5 a2bc1d3ac210eaadcfe9639234ee8f43
SHA1 4588be6824942d7f29b4e8fc865eb40609df61aa
SHA512 f6e565a243bf925c1246d9e307df87cc5d206d5ae3ca33684b6f057ba832209a86747b3145738b3f2ec57feaeca90d7d8d15e3d08ea5b95ef6468b86418c147c
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoxN:cuytJJ8y5iTA
TLSH
T148159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 890KB
SHA256 f6f14a54e19094951d86f29f117c8efe482282473185a977d18611e2d91b2e43
MD5 65e9610643b2b1a744526462554e5aaa
SHA1 14ad38699806eb6e2dc87c485fc0e5e51533511a
SHA512 ea263ef4f0df446bdda71e3cba01432eb52d53b931744f54889492d7c85da9d6e09d3271bba253f04a4cc7998ee77109b6d9df9ec8bff46ba6c99b70cd50e3d6
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaonf:cuytJJ8y5iTY
TLSH
T128159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 890KB
SHA256 3e574b5de52eb3f77891569be39eef009c83556ce78bc372c11ae80da124f804
MD5 d39da2e05165dc7588a31b7e0ce15157
SHA1 34cf268c024ab7e4634fc708afd7b97e1b9d3186
SHA512 491beb9e28cee71a662b868cffbe18fcde97876dc2a2751022dd10cb496aa56b405e7c510a6a2d8ed373ecea882cc08a28f99a9ca8a60741edca5ac6d326ede4
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaopo:cuytJJ8y5iTF
TLSH
T1BD159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 890KB
SHA256 bc2b3448e00a3018541597abb6c15671a0bbc99ec04cab122342f5e77c42f157
MD5 3c931bbf2dc2b02586c687332ac2e3c1
SHA1 21069a48c63512b92cfe4e4d22ace424c98bb1e6
SHA512 1b9191fce0e27ceea583ce97b5a810a0703638f56747ab45b1cb76fb5e95308b0b219c730fc2bd86e991bb1f1046e2d813a6d2b3dd223bb13b198f9fb58ec330
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoZu:cuytJJ8y5iTn
TLSH
T1B5159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 890KB
SHA256 18b24b6ea0eeab35cd20ef3849f19185b767a728381543b431373e24bb1b374a
MD5 56b2fcad64b31fcee26ca947b238325a
SHA1 a231d0e3b53b5af5c8f762b28314b912eefb804b
SHA512 07d268c6ef99c1d51455c3ed89845567de93a1b49866faa80a600111ff20cb7f227505566b95585505f834c65088eb65ca6652606c28c4aac23ca1c5914ea6f0
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnao/9:cuytJJ8y5iTm
TLSH
T1B0159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 890KB
SHA256 a3734adfcdc4ca13bc931ca713795b1dfd2af58fa8b514cc358cbd4ab9bc2246
MD5 8ea376ce5e876eeb6022ae9e020aab4a
SHA1 ba70c28e303f6a381040b8545db9a8c74751e247
SHA512 292ab82d530891193739ea3eede3a0baf8e3120df8a311e4d947633cf09e422fd3be44b2502a02bf46e46bf0553f431cb69615cf0e2363bc66f12b0204c6bafc
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaobc:cuytJJ8y5iTL
TLSH
T102159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 890KB
SHA256 d658d98a4fb93113c974aba7793933adbac8435d90f0e61725525084627e2a1e
MD5 e2cc69a5243ad5a9518198b4935a69be
SHA1 3f8383582c1c1aa76e8c720b1b56819944b099c0
SHA512 91eaa2f14c01a2075b55e00c2863eaf14b6a884d6776ec06d9bb7cecb085d9a49502e62a01a4c16e5c087ceff6e31b847d96eeb7839f4cfdecbda071e367db1f
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoEp:cuytJJ8y5iTp
TLSH
T15B159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 890KB
SHA256 ca231309c67561add845ae38ec1560efd49b9ef95f4693b9b3e3031da08ddbcb
MD5 514050e40600a1e14877eb702397b14f
SHA1 aca046f56b331ffbb36d9d6d65eb5c403881e016
SHA512 9043f49ada5925a174bb50a965bdaa76980b7868653c921755d9157a751db39fe0ec61eadb2e32b4bd6c2f77aab91ae108d3f06f416ce930764d30966bf92732
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoLN:cuytJJ8y5iTy
TLSH
T163159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 890KB
SHA256 0b4cbf153332588c29060b9f948ab988268dbbb0ce414291fe45f4ac45b8978d
MD5 0d94ef253c5a13b4cf538f5f5147a0e5
SHA1 b7458c4dfe3676e0bc82a1c0989572a434906bd4
SHA512 8c711a22f0d19226245a05a687a35923876f8ea9bf6b272942a8d98bc7a8dc2cc2504bf449e21e24ce0b6ab2d2a84cf7f77e18e8239b04c5c8a67f3dc156618a
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoZF:cuytJJ8y5iTY
TLSH
T141159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 890KB
SHA256 4ae6dd1a08f6ddf4d2d8a8c84960c873c87973021583d347939d990c62af4323
MD5 040fa1b6a3e19bf10f7669fd8c6b4d5c
SHA1 1d27daa11b69743d75831fc56297c138ae2dcf6a
SHA512 9b8594075f36104381069d4c4c3c712673e7f3a0f0fe79487b1a8c0eb9c8df87273246fb298dea270eca92ad7031f10c9cc17e2f70739cddf5be85f5e69b0f5c
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoyC:cuytJJ8y5iTs
TLSH
T14D159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 890KB
SHA256 fe684b27635fd45ef550a4173bf35af610b67fc92de614aeb8f8263d41d98b37
MD5 61190f03012705e5acf22cec29c1a8d5
SHA1 16532375f96facbb41e03967a17c7f9f44f4c048
SHA512 9300bfe42c14fa670ad44335e71d326e893b0677d1534eaa6c4bf7bf92bb0511dece24a56db399b1bbfbd08e98cb684fc35e75ec78cfb5951710420be1826026
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaotw:cuytJJ8y5iTh
TLSH
T10D159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 890KB
SHA256 99a921e25d56b0ffb377c801e4b0077476b23ab3088de214ff03ebb6389eb2f8
MD5 4762405df9a4570f47f898c63d8893df
SHA1 5c04ac4cef33186577b016d7a66554421d6a5e47
SHA512 1fd8d1f5233c2d364852afc86795ede37860d0f4c2d2da5c68ba5eee1495f662c5e881c9ae826371d190d47fe04732e2ea1353623ba24a1cfc9f6e64745c5044
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaocT:cuytJJ8y5iTV
TLSH
T148159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 890KB
SHA256 867221e19d1a892af33056d1d932e0494193c8bd9efdd64366faf229900ddfce
MD5 0b36c92b0e82aa07c6255b5c1080feb1
SHA1 57575aa7cb2ab28ae3eb58d1b5630c535b3be1e7
SHA512 fb5ca9543bafa9c2c9ea3e713bc25aa00ffd346ad943673ee181bbce812897e9abf7246dde58a861cc8416d8b4db6afc7646a9fda886b43a8269dbf54b12c585
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaowu:cuytJJ8y5iTK
TLSH
T1F5159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 890KB
SHA256 18919f9eca3d00fdf1bc128eab1f7c0e696d53196b2ca3e7b2bb79676b656f62
MD5 b56cec76a4a8364119dca438560568a2
SHA1 9d509ef8e394a3ec2924c2c7b07cbe69d4d516c9
SHA512 6232d7d12cb35cb36430b87e1ea1f4f281bb67c7a7d73b19934453e073b6ff052b320e7793901894354c8fa41000432c263f86c572791b8a45d5aa0969a3395a
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoOb:cuytJJ8y5iTr
TLSH
T1B7159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 890KB
SHA256 a367c3f2af891337165be9c79fbba70af2328b3dda0a84fffcb2b3a5f6f8f6fb
MD5 4e39711f41c27647b39181f65274f508
SHA1 f495f75cf964ae955df9af1f8fe4c4c6942df9a9
SHA512 242dd3012ad573b0f35313603d0081fb423ab9a7e7aaa9e02773adf59f8d2d82bec0ad61806314b22951c3fc271bb3cabea916b4bdcf327ea3bddd698df89613
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnao4f:cuytJJ8y5iTz
TLSH
T1A6159D1277E444B2E162823489E09766AB76FD620F21C7CF6354971E1F32BD1AE39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 890KB
SHA256 627bbb8114658f7726aef18bfcf8e48d93c67063aa76ae4c3476d7e210172ef2
MD5 44f44330bf104e50a21158545e731d4c
SHA1 d382b249eaa2844c2a7b94ecec42cc7407e1f25e
SHA512 643664a2dc41366440bd70e2126074c68171154dd87f8345c4ec77e15ad2e6c4678ae6713d3600ca408ac96913962d20b82a5a91c46287d73e71055b226fa7dc
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnao1K:cuytJJ8y5iTj
TLSH
T193159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 890KB
SHA256 c130216e8af90cca20452262d9801b44513d1c2e1dded5d39383d727a1956141
MD5 0135137b1832ac77a9f87fa82c8b638f
SHA1 d5908fcd03f6d354bf20f4c62eb4a8648fd7e3c7
SHA512 a4d3cdc988f179a4d03c73d5dd9b792fd1549eeffb8467d99d8e1f26b0971e8550a93ae5483db0a237d0ebf6990c20070976ba6d816ca53841bb6b6f0fd948a5
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnao2k:cuytJJ8y5iTO
TLSH
T1A7159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 890KB
SHA256 b3092e58c8d95dabc554c0f17cbc114d7461020e8ac8aa045ae075e2e76325d9
MD5 157020e29d7c2e1d55d87ad52765d3ce
SHA1 053bb98506060126e0ad0353d30f37c7065b7de4
SHA512 2dc94fd67c590fa26cec7268d57c84fc9967a77eee5c04167e1e5adce1b60a00ba29a1f107075efba2108a568e6ace12fc030757dbb10adba3bde27beaed2822
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoT0:cuytJJ8y5iTT
TLSH
T1B8159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 890KB
SHA256 e5fb46676fb4136a6d5828799ff152f82141d77ef34b0fe7bb10af37718b4b48
MD5 579e297c84e8de9466fafb1d815f474d
SHA1 54e863d4be7d5ed32e0bdff70e445790f88f6a47
SHA512 eeb5bf93ab31e762469cfc2f729b79c801b9896f8651043776f9463b1be81ccb97e831370b77629be65ab47bb08acefea4b2490937975619cde8317321c5633a
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoig:cuytJJ8y5iTW
TLSH
T1E6159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 890KB
SHA256 4a622fa87cf64baa14bde1bc103a6e452721d98e5286d6a27857e86d0dcf8179
MD5 962a5796a3318ba5431dbfe108321f8c
SHA1 d76c270645ac91b92c88cbadc26fafb8c9984553
SHA512 d2a4b178be6faca944577e503afeb565fd9926061e18196f627bf13718c6f7c979179bb0a5728c677e7b1d11ff11813843f2009e9b63fbe8f5cae620096f477a
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoDr:cuytJJ8y5iTY
TLSH
T13F159D1277E444B2E162823489E09766EB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 890KB
SHA256 0e384d9cd41c43212a996948c1a5e660167a3da33640555bf65c546a6e285c49
MD5 7bd4c32dac921ed8a718b206f98598de
SHA1 d61362e0787a9503305685d4f02bae740e412faa
SHA512 ba9744c954cf81bab5c42da7ee06cea078e0848a1db0319c9b9d330acdd3aa92816b35c971f272f29d695489940292a9755211a725681fbe9e244c910bd0ab7a
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoln:cuytJJ8y5iTa
TLSH
T186159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 890KB
SHA256 581f7e575e385aee2b9ee772438e29d80155b8925b44a119e0cf4f497e0daba3
MD5 aa69ddb3bfe58555e2a36cf77b683871
SHA1 d53b9b0d25c59d7dcbdb5722b773bf6418725b24
SHA512 a7196d2ce83fccb5db122105c68175b3e7ec152b08ac6f5dd828e8b936dc8fcbe142ca40b57ae60f1a84bd2c30e27b69acc0f174952dab50c75bb4b94cba4bc4
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoRx:cuytJJ8y5iTY
TLSH
T188159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 890KB
SHA256 605671622e61b25d1e8f4e1c4f4f639ca61e1bf57fd4412258a95619d89a954e
MD5 b82a33e83410403825a7b4f0fef8c4c2
SHA1 b76bc55f1226da2758a7f293514170c169f23201
SHA512 014187c663ea439cc3b3115bb9dedde68a1259075e70d3fd8d74576401bea7904b105f9f709007e56681e01c1e6869ba49ed7fae4d9c13ab7665691171a67d68
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnao/A:cuytJJ8y5iTb
TLSH
T122159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 890KB
SHA256 1fa334845e5bd5e821c95e577c38225402714ac31a9648f88d2177ba92717c39
MD5 065bb14c30ec4eaee1b015f26cc62b07
SHA1 1dd2569b8647fe1877a13642cdfd716f7f65adc2
SHA512 fc06a1e484d870c59478b39d4212d44f6eddef81899cd57b869d09e5aa83644cf2d7105e420db4f23d7fc0aba484a8d47ce8b0cbad47c40255e1581539c6785a
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoQ9Q:cuytJJ8y5iT2
TLSH
T179159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 890KB
SHA256 8045fea80c089bfaa1a7400a4ed72fd00667de8dbe5c5cd441feb3e2d8aa72d8
MD5 1fe5fb851ae5915e1dd959860e7c80fc
SHA1 b5d88718f69b938bb67180c443f240b00bb291d4
SHA512 4513267abbcb3347af53e8a6730d00c0526e67da2a06174a4b83e535e222d4272b3315480122d1ad5a30dc7f05f5167b081f2461fb7a194f0d2572e9832801ff
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaox4:cuytJJ8y5iTl
TLSH
T120159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 890KB
SHA256 f9b1a5f8fad5b1fb509ad3d7a4f9f1425467393c9e0e58beca338d9d9d2f166f
MD5 020579b34929d035f24fd230dc998aab
SHA1 ccecbfc4ff1c5daf6ee7585222a095d5a1c1865e
SHA512 16ca0c4a9ebd2bddac9b2047a6409c40e3d2a0df56d4799dd5149a252f3e942404618355d86955151322b834f9513d279b0fcb6a687d237ba70c44c13b0ec7c8
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnao0u:cuytJJ8y5iTQ
TLSH
T1F4159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 890KB
SHA256 95178983c308b0ab9115992741de0b9730bf948a965376c9a9ff90758f3378e3
MD5 91fb98290ad55ce65757961899877b2e
SHA1 3c272c2de4440d2210fd402529d0d471dff7f2a7
SHA512 c6f00132202517b540db2f9980a36ba3c0ebc686ddf23149bb67eac5e28d4023b73b4fbc00b1e9c8976cac3deaf2e3945c1bb0f6b9242efb5f043f209bbb7ffd
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoFj:cuytJJ8y5iTK
TLSH
T106159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 890KB
SHA256 f60f5f5789c7ea32198f18a92e90fb91bafc75378453db79e9310919a9f926b4
MD5 bc1570887e21106f9ff50c2c165cd473
SHA1 618dbed3af540954cde16dad7f78a6b00f5c1d98
SHA512 dc0ccb6d616030d0c509e1f8a644e999e287b7f15803aa0a8827bfc5887f199bbe019a181a22a0ce9db3b6c9f26933d04ec3213fadd8a0f0c80b05769eb8250a
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoMg:cuytJJ8y5iTe
TLSH
T123159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 890KB
SHA256 869acdc9e614e7db500762c0c20797ed146d1b8009b9f197c7538a7bad6f7b92
MD5 ad97b2cf3776cf7f1cdca7e931dbd38d
SHA1 41f31a2f36b4cf4247a1453e4409e134f3082a57
SHA512 839546fdf3bc325963908b67533ad14d4bb23d54f33b4714bf7bf39507a93da624f10bf59fca561c571e97d801e1e995c924233326c9961a20f843c1027032a9
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoTI:cuytJJ8y5iT3
TLSH
T126159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 890KB
SHA256 fb3b83b49cc4b15dfa436877d6603971a3b452850ab9d04cfadebcbfdb7eb819
MD5 4060f85aff501ade118d27f6b9209fe4
SHA1 ffe5a4adf2e621481746e581dcfc87cc76100e91
SHA512 f2a26abc447b8196c65101d5841a4d95b1717b31f30a6b01c8c7aa1fb6240b9cf17ad2b2319d3908f6bb142187e75ec1f87975b9414097ae2d6c882b544b0238
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaopo:cuytJJ8y5iTx
TLSH
T197159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 890KB
SHA256 2bcb31ac399d868fedda96052265a2de3b5a1e9704e0c16ff169347d610b67ab
MD5 e628c26b96effea693d0944bf1ce1c7d
SHA1 7596014c62ebd950a4eb73e572841d4eb29dcf22
SHA512 c8341f55f1f659086ac6c47b629db0ece163b53493374f6687e29a9a59bc7db72ad4d8af2b00034dc3c9ba9ddd38cf178b9c3b923302bcce52e906dd3c7d0109
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoa+:cuytJJ8y5iTU
TLSH
T109159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 890KB
SHA256 5b656303e36df23ecb46c8cd941144390c0e921ad9fe5cee2fc33b2177f7f75f
MD5 a79e4015f74ad13713704e7b2c4544b9
SHA1 c739999a5a41fc10c76bd3c890b3ad7e68c32487
SHA512 bc3a0e251ac0bd26c52e09058e05576517e22d8150d1ff641c04c6c9d758448be9e0369b4a22ca1eab087d029623daccc54927a280ce3ad81600d2c594e1307d
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoaQ:cuytJJ8y5iTc
TLSH
T1C5159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 890KB
SHA256 1a087ad27288c76bb4eafe8897e7f909ed9d64694a89f163007d88d91afc612b
MD5 c5db2165a04e991239bcbe4888705c51
SHA1 229fbbcfebcfc0e82dd1cc4d1731799f519a366c
SHA512 ec23e12fc86a05e54be77a81fe93144ec8a90021fb2f320da6fb8c1b0ebe2011fd50200b448ff12a4d0952b17bc59dd35434944d3a426f0bb80d9e67820ec0f9
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaorX:cuytJJ8y5iT8
TLSH
T1C4159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 890KB
SHA256 f8406d3024ec4cad9c2ca704f8fbbf54f565407470ee3b1c78404520b2821647
MD5 71028335717eb97da002acd30a1560aa
SHA1 fe215c35b719ab3e1c23a6b7ecb434c5389516b4
SHA512 171de3182e8bd7b3b4c988115c74dd70cd82083a71ecb609a76c52b1d4d0a7a4dc9ceeaf08465b212e39a61385952aafd4ae1a35ed6c8869f92a8853af83df91
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnao5L:cuytJJ8y5iTm
TLSH
T157159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 890KB
SHA256 c0dc12275130af8196a019de0429f992bc06a4c74e629f03d3b945435df1dbe4
MD5 3da368b66194eea3969d017f8c91529a
SHA1 c50b12509ceef64bf223af88f15051350107a04d
SHA512 17f69b79e7e3afeec534980a6c0e5c14968ee7f766ccad7d8473a02ece5652194fb59691ae61317bcd364cec5d83d0a3029727da20be54e0cbf6bb35f1c9feab
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaonM:cuytJJ8y5iTD
TLSH
T184159D1277E444B2E162823489E09766AB76FD620F21C7CF6354971E1F32BD1AE39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 890KB
SHA256 ea292f479b021235814b7a7911eb7492c8b58770f6bf9347739e2667d26d90e1
MD5 5ee218a119b252f8ece2b866105485be
SHA1 fa820d3c674a35c9f3efcd00d241f064a14f6f4e
SHA512 81be77f135d4cf3db5666e1b24de35daafb95ee97b2814bf045b374f22e39c463944fca0bbef2dd41f78bfeecfd4c063ed4c46a9545f538573b4f5966ab71f9e
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaoQh:cuytJJ8y5iT9
TLSH
T1F9159D1277E444B2E162823489E0D766AB76FD620F21C7CF6354971E1F32BD1AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4988-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4988-2171-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5648-2172-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads