7be394a87a5dfce3408b223c4ee28b683eb3447eaec335ffa30d2f2a648dda16

Analysis

max time kernel
63s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 2.7MB
Sample260707-v1237saw9t
SHA256 7be394a87a5dfce3408b223c4ee28b683eb3447eaec335ffa30d2f2a648dda16
MD5 e90a97280c6828129b350b92efb6346c
SHA1 4493d327388ca022904033a3360ac934dac5428a
SHA512 ae3ac78ea75d1c4c7036ac7219f9175706c158b15d62a0fab56442e55a4e48da54405a931cb14c1970cffa0a852b41d68f1255c3fcc12cee5a1ce15dee03dcaf
SSDEEP 49152:A3k03kHRJ7pYqn56r856rbeW4SkZP4sz9Mb:A3k03kHRp6JrZr7fkZc
TLSH
T155D52916F6684B62D07BC079C9D69A56FA333C454F308BCB0345BB283E376D19A39726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 11 IoCs

resource	yara_rule
behavioral2/memory/5344-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c488-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d7-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5344-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6108-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019e29-1436.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d0000000187d2-1625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018923-1624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4b8-1909.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0007000000000150-2293.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e0000000118f6-2313.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c488-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d7-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019e29-1436.dat	aspack_v212_v242
behavioral2/files/0x000d0000000187d2-1625.dat	aspack_v212_v242
behavioral2/files/0x0008000000018923-1624.dat	aspack_v212_v242
behavioral2/files/0x000e00000001c4b8-1909.dat	aspack_v212_v242
behavioral2/files/0x0007000000000150-2293.dat	aspack_v212_v242
behavioral2/files/0x000e0000000118f6-2313.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6108	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5280	sihost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5344	2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
6108	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_e90a97280c6828129b350b92efb6346c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5344

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6108

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:5280
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:2016

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5196

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.7MB
SHA256 7be394a87a5dfce3408b223c4ee28b683eb3447eaec335ffa30d2f2a648dda16
MD5 e90a97280c6828129b350b92efb6346c
SHA1 4493d327388ca022904033a3360ac934dac5428a
SHA512 ae3ac78ea75d1c4c7036ac7219f9175706c158b15d62a0fab56442e55a4e48da54405a931cb14c1970cffa0a852b41d68f1255c3fcc12cee5a1ce15dee03dcaf
SSDEEP 49152:A3k03kHRJ7pYqn56r856rbeW4SkZP4sz9Mb:A3k03kHRp6JrZr7fkZc
TLSH
T155D52916F6684B62D07BC079C9D69A56FA333C454F308BCB0345BB283E376D19A39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 2.7MB
SHA256 0a448ff96bc0a6b2127b366104be02888de170ee0d34d5508966cb4527bd120f
MD5 8445cc75c7467102b1247ac12e645fb2
SHA1 15d9960f2658a6c7d9fb6da28ff4e6e56afb40bf
SHA512 5934ccaff05df46a70537a4f555a812197c7b68238c0aa0fba0fd958368175d1ee99a712cdfa31f293e2f72688bf84e75ef814e0f9b1b89dc425d311e9b975c9
SSDEEP 49152:A3k03kHRJ7pYqn56r856rbeW4SkZP4sz9MbT:A3k03kHRp6JrZr7fkZcT
TLSH
T19AD52916F6684B62D07BC075C9D6AA56FA333C454F308BCB0345BB283E376D19A39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe$

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$
Size 3.0MB
SHA256 9eb5d196fc0c8ff67f325b970b6156c88f75ef5617b37110cce29b25d6b034c7
MD5 a389cbc691cc19c8ed007be9ec307e2f
SHA1 ba2c3e0f91f6e43970a7cbf7cab11dcf8c8c518c
SHA512 8ccd6d634c910674779a7f5e1633e2156723ef01b9bc89cb8a09f34cf28e5a99b36bc14a6b2a9baac5de235fd624dc63cf52548b261371913d056e5d0ef1cc76
SSDEEP 49152:A3k03kHRJ7pYqn56r856rbeW4SkZP4sz9Mb2eS3:A3k03kHRp6JrZr7fkZcTI
TLSH
T190E53A16F6684B62D07BC079C9D6A65AFA333C450F2087CB1355BF283E336D59A39326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe
Size 2.8MB
SHA256 48947c1af3a4d0e01a5978ec1fe84bb5599dc7780d51060d0debb47142cb487c
MD5 cc154fb0a35ba2d0e74d15663e41cca5
SHA1 5d7ccd851b78b1a52d0e5fa61a046ed2f0e7bcbf
SHA512 a7c0b8244a2bcfca7fc42fcf02382bb48abcfdcb150af57752431f0abbf69801849e97ac140defcf9e8327ae35b3c34fbe82309bb092bed474f4d8a61d0db859
SSDEEP 49152:A3k03kHRJ7pYqn56r856rbeW4SkZP4sz9Mbz7gi:A3k03kHRp6JrZr7fkZc/d
TLSH
T135D52916F6B84B62D07BC075C9D69A56FA333C450F308BCB0345AB283E376D59A39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.2MB
SHA256 f575cb72827bc1807ef3a97cc7cd29bf81ad92b318e0a91078dc58defafb6a01
MD5 0c2f4b753b4121827ee91c6992bce83d
SHA1 dccb2751332c3a0c314d6fc5699edf9825d61878
SHA512 b5e61085b87a3f862693f87e8f8389ab97db4bed7018861cc5a4117f05e5828f8a87b7ad94ebb18b4c4608bbf455c5cd13ed2e01ae88eefc9a3b4fc69e257d99
SSDEEP 49152:A3k03kHRJ7pYqn56r856rbeW4SkZP4sz9MbBPji0Aj:A3k03kHRp6JrZr7fkZcRjo
TLSH
T1F8F52A16F6784B62D07BC079C5D2A65AFA333C451F308BCB0345AB283E376D59A36726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xlicons.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$
Size 2.8MB
SHA256 f5c176ed6204acdee3cc6a910d632d339e3b823841d92d7403f3165a4bd2d292
MD5 af7ea7299d0b4a77e81361d429aa5802
SHA1 a330169c7b8169968203638feb7c2d7940e4cdf7
SHA512 864a014a150c718e770511c4fc0b2e8eacd12433282e142398d430d930de5398c31bc585b0a854ef5ced27881949a4892ca12f20492c8385a16f1081a69bacd8
SSDEEP 49152:A3k03kHRJ7pYqn56r856rbeW4SkZP4sz9Mbj:A3k03kHRp6JrZr7fkZcj
TLSH
T168D52916F6A84B62D0BBC075C9D69A56FA333C450F308BDB0345BB283E376D19A35726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

DisconnectFind.exe

Path C:\Users\Admin\Desktop\DisconnectFind.exe
Size 3.1MB
SHA256 36f20149a530ba05c39f10eb7f866e93d0373b5b56bfd4b075073e02b67fe5e1
MD5 70b2029d9204e7a0f51237c6d94bf2b3
SHA1 6dedd341af568b0d72199ee069ed47a8fafeaf8b
SHA512 7d03980c6a7f6149a437326d01d28a7f5fe65e9ddb1cba8a7596bf8155e9151ceb8179086a60cdb462c6185eb8a77d0c0d63a743a36a77e27d7ba352337b82b3
SSDEEP 49152:A3k03kHRJ7pYqn56r856rbeW4SkZP4sz9MbBxVJAQU9KP6:A3k03kHRp6JrZr7fkZcBxVJAfKC
TLSH
T1ECE54A16F6684B62D07BC079C9D69A56FA333C454F308BCB0345BB283E376D19A39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSBuild.exe$

Path C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$
Size 2.8MB
SHA256 6f01413d8cce0d4d77c97aafb4ac9134913c9d715f4842c77d10df60b269ec6e
MD5 55688bb41d7817a18fa1c4ce7bbf58f6
SHA1 a1bf8e23f9f312030e2c30978dc13669c13d32ef
SHA512 8ec552c2adc69db583d2b58884fef1df9eb3e9fa442ea604a1068513944210aeee9baea42f8969a0655e45b1e67f7f9b060d68885bb43559438e5b6c8e85a020
SSDEEP 49152:A3k03kHRJ7pYqn56r856rbeW4SkZP4sz9MbBV:A3k03kHRp6JrZr7fkZcf
TLSH
T11CD52916F6A84B62D07BC075C9D69A56FA333C451F208BCB1349BB283F376D19A35326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4284-1082-0x0000019106D30000-0x0000019106D50000-memory.dmp

Download

memory/4284-1069-0x0000019106EF0000-0x0000019106FF0000-memory.dmp

Download

memory/4284-1068-0x0000019106AF0000-0x0000019106B10000-memory.dmp

Download

memory/4284-1096-0x0000019117390000-0x00000191173B0000-memory.dmp

Download

memory/4284-1062-0x0000019103400000-0x0000019103500000-memory.dmp

Download

memory/5344-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5344-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6108-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads