7c4a29a8510005ce9a46cb8107a3086988054e15fb7c30da6892e4d232cb40ba

Analysis

max time kernel
108s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 947KB
Sample260707-p4xp1aat2x
SHA256 7c4a29a8510005ce9a46cb8107a3086988054e15fb7c30da6892e4d232cb40ba
MD5 bfe5c1c156b702b0beb88d06b15c6541
SHA1 19f4394343c9400ce8be1a91ac378f025d4ee9a5
SHA512 82fbcb0bae0f73d14934086e831eb24a00f6635ba943c1ac685779a540c00a700ae17caeeb2c638453817fec2faf3cd53a9ad843184360a79fb3142921c1504b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAt:A3k03kHRJd
TLSH
T18025AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 40 IoCs

resource	yara_rule
behavioral2/memory/3992-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000016cd3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000016b50-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3992-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4528-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b24a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001982f-242.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188d4-274.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019833-468.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019834-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019835-590.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019836-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019837-706.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019838-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019839-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001983b-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001983c-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001983d-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001983e-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001983f-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019840-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019841-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019842-976.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019843-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019844-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019845-1124.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019847-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019848-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019849-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001984a-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001984b-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001984c-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001984d-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001984e-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001984f-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019850-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019851-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019856-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019857-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019858-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 37 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0005000000016cd3-5.dat	aspack_v212_v242
behavioral2/files/0x0004000000016b50-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b24a-41.dat	aspack_v212_v242
behavioral2/files/0x000300000001982f-242.dat	aspack_v212_v242
behavioral2/files/0x00040000000188d4-274.dat	aspack_v212_v242
behavioral2/files/0x0003000000019833-468.dat	aspack_v212_v242
behavioral2/files/0x0003000000019834-499.dat	aspack_v212_v242
behavioral2/files/0x0003000000019835-590.dat	aspack_v212_v242
behavioral2/files/0x0003000000019836-621.dat	aspack_v212_v242
behavioral2/files/0x0003000000019837-706.dat	aspack_v212_v242
behavioral2/files/0x0003000000019838-737.dat	aspack_v212_v242
behavioral2/files/0x0003000000019839-786.dat	aspack_v212_v242
behavioral2/files/0x000300000001983b-823.dat	aspack_v212_v242
behavioral2/files/0x000300000001983c-855.dat	aspack_v212_v242
behavioral2/files/0x000300000001983d-881.dat	aspack_v212_v242
behavioral2/files/0x000300000001983e-894.dat	aspack_v212_v242
behavioral2/files/0x000300000001983f-907.dat	aspack_v212_v242
behavioral2/files/0x0003000000019840-920.dat	aspack_v212_v242
behavioral2/files/0x0003000000019841-933.dat	aspack_v212_v242
behavioral2/files/0x0003000000019842-976.dat	aspack_v212_v242
behavioral2/files/0x0003000000019843-1008.dat	aspack_v212_v242
behavioral2/files/0x0003000000019844-1062.dat	aspack_v212_v242
behavioral2/files/0x0003000000019845-1124.dat	aspack_v212_v242
behavioral2/files/0x0003000000019847-1150.dat	aspack_v212_v242
behavioral2/files/0x0003000000019848-1175.dat	aspack_v212_v242
behavioral2/files/0x0003000000019849-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001984a-1219.dat	aspack_v212_v242
behavioral2/files/0x000300000001984b-1322.dat	aspack_v212_v242
behavioral2/files/0x000300000001984c-1341.dat	aspack_v212_v242
behavioral2/files/0x000300000001984d-1372.dat	aspack_v212_v242
behavioral2/files/0x000300000001984e-1379.dat	aspack_v212_v242
behavioral2/files/0x000300000001984f-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019850-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019851-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019856-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019857-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019858-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4528	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3992	2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4528	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_bfe5c1c156b702b0beb88d06b15c6541_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3992

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 947KB
SHA256 7c4a29a8510005ce9a46cb8107a3086988054e15fb7c30da6892e4d232cb40ba
MD5 bfe5c1c156b702b0beb88d06b15c6541
SHA1 19f4394343c9400ce8be1a91ac378f025d4ee9a5
SHA512 82fbcb0bae0f73d14934086e831eb24a00f6635ba943c1ac685779a540c00a700ae17caeeb2c638453817fec2faf3cd53a9ad843184360a79fb3142921c1504b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAt:A3k03kHRJd
TLSH
T18025AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 8b6e642a65e103aa33a8188cd4eb9c69cee93e876208bbdbfcf22fe15236df5c
MD5 8ccb43c80d5d15a4b717a0c5c9c8ee43
SHA1 06a58e9e912c9132cc2f70ef36225dbfef7336ba
SHA512 1a6663dd0f9264e90cb72d3d5c25e1e8bbc7451c5dc8f6316b715eb9a35cffa1789b07dc1a7a0cc038df9d77598de3cb2f5b27e888f1a3b27da25b3207a13539
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA50Le5ji0hmxNrM:A3k03kHRJpPji0Aj
TLSH
T146658C17F6A402B5D067C0B9C5D69A5AFA713882173086CF1399C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 4aeaa773811d4fb1767f22886afd383e2cb966912cd282c915d8969c99d31db7
MD5 6bbf6c61416116fcc46836ea746558fb
SHA1 610ed2b46a10f8cacd98a1e5db03426d83f894c0
SHA512 02ebd8287cc436949755c9c1bcf634aee1e80fb1e516d147664331426d4897a96850e1bbd54866794ea9707e41cad19bb19f920d65605652048aa5c09d85d15f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAra:A3k03kHRJ
TLSH
T18825AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 150959eb4a6423d0757baef6ffee9ac5f0d1b41a2c3ee3763df69caef530f142
MD5 63e7f1027a51aa6e65097818637c5c57
SHA1 4839cdd59ec4db9748e15abd58e1b1e7b0499834
SHA512 d6637e0390f944ec9eb3044697262e15e1e0f89092ae4d8d546fb54d2000b1d593206c5c4fe48c0fbca22ea53e53e3e39003f7eb19f999d2e306cf81ab08407a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAq6:A3k03kHRJ1
TLSH
T14025AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 b24672206122def25672ead624aa24929ee627b2d1361653fdc0336816884078
MD5 74cf03a78e3e3a04d38e38f7dc49ef18
SHA1 4dbf1ef5e9a72c084153a5b35dbcfa3b5d53328d
SHA512 9b2438b35062d54af79351cd9723aa6a8e64d6888b6d7cdb702960bae3b58ed9470ddc8c456a1462055898ac2d8fee1204c0a3d80da557fa15a1ea1c4e9baf85
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAGu:A3k03kHRJb
TLSH
T13025AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 0be65c1942907d66ece3b4866abc3cde54080f60f83cbcff560ba997c1c7d407
MD5 1056ed5a232262039e94171993f44676
SHA1 4e5df57f53404f858c84f052fc0eb7ad34e9a2ed
SHA512 cce230ee1a0c90631b8ab51e22af384df1ca9803403bf07ea3f511b212f7a5ed6da36121054b2693665f2f9f242a25551b6d260fd0f6d05ff6cd2c3a67ec2357
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA69:A3k03kHRJa
TLSH
T1D825AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 3e85736ec1a55cb5dee4d0f66fe3744160a9c997361da44ec40d8fdbd945c472
MD5 4f4332e448a9100c8e6db9137d1abcc9
SHA1 45004a9d8e0a90a985d84a5df79e672d2cf84506
SHA512 c05f47151d29ea138061c8303a4779d3ce53d26cc94328d933ce5c2039b2dc0f19d849b61c527e36b3e3b84c7e3f0861a2cfce4b485aca54492d470a9cdd4b4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA6c:A3k03kHRJ3
TLSH
T19725AE03E79500E9E10AC17496E65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 1d460ee406e32eb489e0970b7992df50b192ea920de6ea227a147f7302671d5c
MD5 430cd697193888ba29c9d5edbae042b3
SHA1 4611af8e7f11f427c2550e465b067f2794f7b756
SHA512 87fd5db6c78bd8159b9bb29c4dd48b07f9df78f887b828785f520be2d5721b543b7ba090d4a5aaca2a9107027aeeab0af627aeb5d15eba9abdd6159661a126c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAzp:A3k03kHRJt
TLSH
T1B725AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 8391ce0d50b61f6281c5620b2764954610341a6d6d6e2d48cdfc63bedee1b104
MD5 f8946fd8e6e040bf47ed61170476694d
SHA1 b167417a49e40b818ac5962348fccf2421c10900
SHA512 62263edf4c6ba0a9aa9c7891544f7e0cb5b1993dd0e8cc9ad07a6c4f1e8c521b2327af21a81b7e36ccead9e90a3682de40b95f5a45fed1512ea57fbf55d670e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAUN:A3k03kHRJW
TLSH
T12D25AE03E79500E9E10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 cc85bb1271360611cce6194f53f20b0ca7238b50838b5c1376f19e60b99a2364
MD5 d8b32825b2d79c9f519b7843a4f75f3a
SHA1 81a076f35524261ffed7289de954df4ae1196035
SHA512 b26b447a13f8b950298d9466cacb579402ecebad1d317c7b5611eb0cb1fb143d951bf158182e2900435c2b49f38c676a7a5cf68b3d25231c587132ec2c6de8bd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA8F:A3k03kHRJ0
TLSH
T12725AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 c07f79e7c7939c097a2e96d1369e08de99e2edffac11e641e90267a9e0bcdd18
MD5 a0984e4b54fcaff8f4ae5a6d01506545
SHA1 31ad31ba9db3caeae2b8ae0341915281ba9c714f
SHA512 1f81471da63f0560d6b27b098858bbd842a4248d175cfe6e13a423afa381bce3e1929a9c08354f0ed7272678c96a283f362fec5100203eb063bfb11810dc091d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOApC:A3k03kHRJg
TLSH
T15625AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 2f894b203dc33ad89cf4c3fe954a8d61b32f912b5d271f4dc3582a76f20c1b10
MD5 d975f41b5ded70c328a202fac314c98c
SHA1 fceb5f7d2ad30c326fb33c298fc9d8c31bcd640c
SHA512 9492f2294582deda299a2a5d29aee42682a473a994cfe25d3f16dc483d4ed1ca4ffa06b9b15cdac5d3201588ff040d1bda217b212ddeac88e26e3e0e14c18fa0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAKw:A3k03kHRJ9
TLSH
T14E25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 c85678b34f226388fad4c229bc1e627285a69090f7903da8bcdd81b6682a4170
MD5 2550b7e15199c710bb6d01fcc43416cc
SHA1 5c57aeab667822da7d7b8a73a4a388dbdda7bb34
SHA512 61eda0bf699c463cfde67fe0f5ba6fb3a247924100ac7a8b2860aa4f971df4996048ad22ad0c7579ddba640a4e6f59fa48e868cc2c3ffa019e4364a9df1bf6a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOART:A3k03kHRJx
TLSH
T18D25AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 c7264d9cc756368f66be9df7c79b574e9512b63da1c0637f5614754b73e1ac69
MD5 1f9352f5048f7eb07f38237ebc6ed02f
SHA1 e7a3fb7293430b0268feebb339aeebc801d4896b
SHA512 faf2ee8bf58fef7f14c843a0e59e427d197e79c0869ba2caccafe445879921543e471eeb801f115418aa6631b2ab4d85667ec01d2a37fc1e6949f2b7b606b1c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA/u:A3k03kHRJm
TLSH
T17725AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 8b2665a0d33e8ade3ad0930f0feaaa6a6548270289fe5277dcc0721917401e00
MD5 82158dcf95f86216b6916ba9972c9ac9
SHA1 43dc952735140458d69b7da4d6c03e3da8478b53
SHA512 cd9ffb54c918fc0a86337813383f6833250bbffc24dfde515a1875833511aea9555d792041fcc9b043d4812607cb8a11f285c33b2f23533102d2b75bd605b06d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAjb:A3k03kHRJ3
TLSH
T1EB25AE03E79500E9E10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 c1361d2c070f399568f34883b73ce8092aa412a15aec4929b3f44d045e0b3f42
MD5 4e5ce02a62118577c310b3a7ef32c013
SHA1 c1cbbac8aefe0d81b0f2b5135fdaf971d1ccbfb8
SHA512 c4d9f2a2d97cc65ccd89ad22bf8f8b1b560ed16c44a909221037418a7da1e0a342506ca1f19668d3512703b508b644e4eb80ca4f262d4e9da07bd7826fb7fdd2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA3f:A3k03kHRJf
TLSH
T12425AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 c08818a30ffb9050a88e93e94130f46db396a6f51d8176056cc4c137e1f2065d
MD5 d76f8f8e2802c93d70a008ff28cc67a0
SHA1 a1c3c650a0dbe44287c046173760226bed8b975b
SHA512 48ea7fe7f97f7246548745b0da990ce74143c592990d00f8afe531cf63fa94e5740c3329a4f4d7bdb89203a521b4dbb196d184a46484816e0bd2fb6dcceaafc4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAAK:A3k03kHRJ/
TLSH
T15B25AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 961b249a174809231b11592d9336d7f8adc8e6277c4defd892c1328b669f333a
MD5 82f7e85286c3988383beff8331da6795
SHA1 fc6043c01de0ad3feb812c2c3a580ef2a62b834c
SHA512 7503450f5b9cdc2121bc874924c9f936833a96b0e739eb54764cdb289ecb61a647dfe02de85be91166d4b7217fd4edcaf67cc4d59f4af02312c867dc324de888
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA9k:A3k03kHRJK
TLSH
T1A625AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 cfe0933d641ac703fc862b73484d6e5a4d51e60b2fd44881959f53d3165de345
MD5 83ab40092a7334c386881223f16a8e4f
SHA1 83afea32f9207784da80e865812b7d47426110ab
SHA512 2dbdb3aa88cddf7d7608b518968172068e23bcfd77c11bd9e5c4d6f965f68161809cb7f4033b1a9e0945f64eabfae12050db1f5207ace89e3160351d5a4e8edc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAi0:A3k03kHRJ/
TLSH
T1EE25AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 348fb16713746edc4b886fd5aeb964f5233c00c38ddb1d5d67ffbad52be89d81
MD5 6e92abeec3e8a8b18e15c3226ddf8768
SHA1 c2810f945ef7fc392e1ce5302f84c29f2ed2f413
SHA512 76021de0dbb892be4f9fe6c39c3bb9a0a31b77ac0117b23a93fee355b3d51fc9c9ff81a304eb55e9d7312e0244c7a1ae44b9cf2e6303728c80580434fdf106c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAxg:A3k03kHRJi
TLSH
T1A425AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 fdf940a01c49512143fe139e39181be3065ef55044d8220f66b675468466db46
MD5 ad56a9b62dc4a88db147363ffdfd98b1
SHA1 dce0887253d6ec370fefca3da1c340ae06cf8de7
SHA512 cbd92f5ebc02ace2a131c4518c07e7bb2ee53aef3d3ee86b676cf5b3966baa80b9ba5fb217ca5b76762b7fdde62e6bffb104d895641cbf6c5c15d56e9f6ca431
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAYr:A3k03kHRJs
TLSH
T10225AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 92c9de22687c5c4be7a4b89e96e136d481a7b0474c75f00711662a5878a3b08f
MD5 3d597fba027d963f766ccf72d5090369
SHA1 d381938df4144b7064b1888852e7c3840068cc40
SHA512 b8e9cf5ac9639be9e4c5ae9d08f13c535e8b38ac2eb75dc1a6ab0c90dfa50e48f503a8b2757f98e9d8eefbabc9b11351f4b919c6cc44dad660f448d0225da469
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA2n:A3k03kHRJW
TLSH
T1F725AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 37186d75853810bbf22071d5dd6f8b984467984661a581518a61950602a624ec
MD5 9af747ea0e90b58865ed08e02b072187
SHA1 d024aadcaab13e5ba7b9ae0d56279dbd621c70e1
SHA512 1bd069fd3b2d53a86536b94c786175283baeebac108ec29c2b048266bc754ce8a2d46109ccf5d26793e05237fe2b378ab7423614e7c72620eb03257f88888172
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAcx:A3k03kHRJM
TLSH
T16525AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 254efb1ffeee60cc549b2f3b17213dfd2e06bdd00a39a774a449def36e0b61cd
MD5 f853fd368c7c21c21ae4deb5a6a5917f
SHA1 13abbc8704cdd6e785879f4b8444be99fce0fae0
SHA512 74de532179d32526aa2045d6d33ad32f3f29d72e0e2f56fecd38fb27957a0404976efcba63cbe1ddba68936219f8acd64e01eaa9c98ff10cd20e1cb36776c6f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAWA:A3k03kHRJX
TLSH
T1D325AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 d124fea23b8211defeaf77b1dd184178a0bb0ba031acd1c8513ef5345d76984d
MD5 fb294960723de123e71793f57ff906ed
SHA1 0695033f80dda23b17daa34ee1c3703054a4d1e3
SHA512 a6af6a9e4e9350b0887ab6cb334ceb5f3b6d825186b4f28108df3c5527fcbd309c191b6a8fbf3cd36f7e3c1255241bf58a8ea0913e58535997bf31717583d4c3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAP9Q:A3k03kHRJa
TLSH
T14325AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 b35bce2bcf4239f3099ee3c5b712b2d93f0951647d47b30e439468f91b4df62d
MD5 6175a4e9ade3cc5a89f1dc4ceb390ec1
SHA1 9af175e932bbadfb7062834935dc96b6224030dc
SHA512 e486a6adc71179d2f97589b08d6c070ea2cd934170b770916804d00278ee6e28c9674986fe53ccd161842cc110d5c214bdd82228f61b1e19abb08202c97ebc88
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAm4:A3k03kHRJ5
TLSH
T11525AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 f3337cf5399a99ebe1057c2fb84e74fcead2bae1ea717d39385127a2f24b009f
MD5 c22b8e9142d51532932f437dce0ba12f
SHA1 8c9211b1fe1b0bd077ee4124621fc7a56929f829
SHA512 3ba538ba56cde75baa0fac48d442674101238c09b54ce433ded6221c1b27601836f278e43e45a813f35dec8839dc482c57cb7c510a99180c4050f68a315e4dd5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA1u:A3k03kHRJE
TLSH
T11325AE03E79500E9E10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 5d6730f6ec54e3b976246d50f9931a3b422172950402eb270459f79da94dd906
MD5 8a48f66275e4042ba9c24f170c64f3ce
SHA1 7adca7ad89c6c6dff093e4b803aab7b46c3441f5
SHA512 8dfc1e1437e11d6b59df3aebf8476dffb53408d6370283f61699a78953446c357e5b400ad90936c3d29f0f7fea38a64fa62fbc6ca4d59388eccc4f0f8d1db0e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAoj:A3k03kHRJG
TLSH
T19925AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 1b7b306cb4e8b8c525506f96ada0fb2f7a9f40582985c103b205199f2998e459
MD5 bad31c7db0bf8f29db8c0f8fe8401964
SHA1 9814c8361f8a913140cd4aeb12f543a9b2e2934d
SHA512 ac6fa5005ee2fc563962cfbe4aabfc515437e0ec05289b4ebb2e1db2831e844b919c4ccfc8795e447b2edc0a9493e6523c69628b551a02d4063fedd01d98b285
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAZg:A3k03kHRJq
TLSH
T16D25AE03E79500E9E10AC17496E65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 2f5216288d1c9c0dc61b4aa505c2fe8a7fb2f677bd20aa050325df31bfb4d163
MD5 501a45f1f32c4aeca0c8d656c20a537c
SHA1 60c032237a53ffa439f6fbfdbdc14ef25ac30262
SHA512 f11e6eea178c7cbb37f03e110e77630a576d6106d06b3a029eec407c58f2f99cf035043fbaa36e3c0bb2cac49321e74448e03404f0f1fa26add63018321e512f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAAI:A3k03kHRJL
TLSH
T1A225AE03E79500E9E10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 765ccfebfffee360c05b34c0df8fe985fe8c08bb9e11f7084d1776ed270f3d73
MD5 3d9a5816653d2af52c64ebd515cac19a
SHA1 d860502eda2cea34e94b928c6d425574c366a437
SHA512 f7a60611b4e1b4ab11d45b3eb680d89a927006ea75cddbb4aae14651460e287a5fa18741ebdafc94b91d09ff56225c25f6dd628b0923fb24364dd264df594c58
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOACo:A3k03kHRJV
TLSH
T1C725AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 4cbb99bfe2e57b6c641fac540088374fa46ee76cccea93012b8349b8b16d74c4
MD5 1133e7b5646c8819c44860d97a381967
SHA1 14c8de4df4ecdbf5ee0f60379fef9946d3863640
SHA512 338d116bf9d8a464c54be91c1b14075e567fa3bd1aefdd44197efd753b859d8729aa54d55f26a29701229303e2e285f85357e2f77d4981440d9f1cef4cd1c2bd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA5+:A3k03kHRJw
TLSH
T11725AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 ef01910754f1fb53da23478c6a2af88235c26ff11fe2117589e37ab0b4afe4bb
MD5 62c0a9f9722718801615a1e1a6ef3974
SHA1 b29d37ff998d3f5de2d0b4e3ad83c65f8f41adbb
SHA512 438594d03079e926146c8f0ecf5e84258b72397932004d598008f62123f74511b9b115dc420865a626ff565d491e509e3c2d3145fc26f73c4c5490fe3e753617
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAnQ:A3k03kHRJA
TLSH
T12125AE03E79500E9E10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 5d30053251e05d24b9ade377c852cd0d828aa377a9618d452a8c66a4ba19973a
MD5 1dfde843ec77e28433da44ee953a3300
SHA1 0973f5fc899fc47b05f51767eb7139ec09305584
SHA512 abd864b8b8d3a1b12fbdc83f9851c2f3375ad34a3e3e8d17f54f37642eda7b52b4271995f42f726b921e39de204af4fad8460f1344ad560d8cb8e478cea5c781
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA8X:A3k03kHRJw
TLSH
T1F825AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 a3b580f3957098db639d4e2c7e30668577044d82fe35a560d507035ab857d83a
MD5 693781f1a5395cceff223a54c59b13a2
SHA1 440fe341fc75af02b52879436b058fdc19671688
SHA512 aec9bf1b70562537be60b5c3da2e41d59f77dbff3701e3d675645c4450a363f282f25ffb67eff0c46e5a43609b81bb76d2e21c430c224ae6e06d629c9ba3f5d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOA6L:A3k03kHRJS
TLSH
T15D25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 fdcffa3876bca8ddda6f5594d38f9642f0f52a5ef11b49621639878210af6dff
MD5 e1020e866efa066c3fa7de5025663c80
SHA1 e430bb095fc1e3b0b6178de61de3cabe5af097a2
SHA512 731a508ddf523856b7504b82d7ca3f115b1a699d849df6d1fc57e4f8f9f7ba752ec45a27fa21984a3d4cfa5e00b8bf021778ac9f4f5a30add0082979807a37a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAeM:A3k03kHRJ/
TLSH
T10125AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 3a1be093dc1806daa238d1f783209676d49aead9067df68d044d473f8b4dfe8f
MD5 e2b3132fb60097543a9af1130dace3ee
SHA1 edcda987eaebce72e2c7e1b729bf453de806f480
SHA512 3071b7ffd5ab5f903aba684d46c6ab90ceb72b3a37181bf28d57f9e1cd8183fd4ec30f0eb006c06da6d1c4fe476bf593916dc2585af099049736731ffd149b02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTOAHh:A3k03kHRJx
TLSH
T10725AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3992-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3992-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4528-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads