Overview

overview

10

Static

static

10

2026-07-08...ry.exe

windows10-2004-x64

9

2026-07-08...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 14:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_dbb117a79f0580614a0879c57d1aca95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
  • Size 946KB
  • Sample260708-r4b5eahx4q
  • SHA256 a42cabecbe0366d49d2b0339d7f73621f23328561ca6a80c3746efe8d2551645
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwareaspackv2discoverypersistencespyware

Malware Config

Signatures

  • Detects executables packed with ASPack 43 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ASPack v2.12-2.42 40 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_dbb117a79f0580614a0879c57d1aca95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_dbb117a79f0580614a0879c57d1aca95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:4968
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:476
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5344
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5816
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5588
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4328
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:1896

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          patcher.exe
          • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
          • Size 946KB
          • SHA256 a42cabecbe0366d49d2b0339d7f73621f23328561ca6a80c3746efe8d2551645
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.exe$
          • Path C:\Program Files\7-Zip\7z.exe$
          • Size 1.5MB
          • SHA256 3fdcf2ad09fbe52493b62c77b8ed494cf874cf4daf94c6afe013e0f39384bb03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\7-Zip\Uninstall.exe
          • Size 961KB
          • SHA256 89c7af262c0176091d52c634fd37b898f5edb7c9c340a53823efd74f94cb8cbe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java-rmi.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
          • Size 970KB
          • SHA256 e420e4175c9b63036834c8a137434b22beb315a17cbb7fa956de5f4d901abafa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javac.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
          • Size 970KB
          • SHA256 4d5bac7f8b0ffd0fdff2e01975ee0700d589bdab4148bc48694c491168a4b177
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javadoc.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
          • Size 970KB
          • SHA256 ed48d6a517334de9a21e198a9e5a8af5ddd4e76c505c0d4990e7880559900a3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javah.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
          • Size 970KB
          • SHA256 6ea90de0bc4ee6ac6ab3eba8444d343288671616443b57782a3159fac67d800d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javap.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
          • Size 970KB
          • SHA256 b303955209824f73a09060378b0f745f1d8990d19e68c6456080ac288a3ae008
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jcmd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
          • Size 970KB
          • SHA256 0b25362f4aa842b0ab01bf6ff28b10f3c23bd675cd945c26a15fafe0cd91f93d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jconsole.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
          • Size 970KB
          • SHA256 28dc7789e65278503e4cc43c899e34e6abf48f29d0e0e8eae324222e29520f0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jdb.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
          • Size 970KB
          • SHA256 8a647da520a0a6264649b575fc4829031be435e0b746a9f0dc841d6b8d3b3ec6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jdeps.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
          • Size 970KB
          • SHA256 2b8a4034a53e21ae10a177174d299afe5358c40216366cd1d45a044f0fc42ce6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jhat.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
          • Size 970KB
          • SHA256 ca074f044509eba646b38dfd9173ae13808bdcf9634b8c7ca44e08d52ee223f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jinfo.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
          • Size 970KB
          • SHA256 a245be997e49b8990379004eb64d506995a1efad8e47a96e416978b97190c68c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jjs.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
          • Size 970KB
          • SHA256 4f7dea755a20517abb700735d32680415d5670a4d57f94013431cb6f6a26c579
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jmap.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
          • Size 970KB
          • SHA256 618bc4e6fa24dadf15ee0902c8aafc2948e64c9b74e9fcd021ec069345d712dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jps.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
          • Size 970KB
          • SHA256 8b8f6b62bb88f356e75062ffc8d87dc0559d8ff7c6710b8b8d59fce748ab3256
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jrunscript.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
          • Size 970KB
          • SHA256 1d25e3e8fa3e5739f71a1f376e9358a56123c0a13d19465b818f83286b22e9c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jsadebugd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
          • Size 970KB
          • SHA256 ce94bc5d4147121388f53d61fe9cde9b72c1a492c468c09bf3ae395d861de9ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstack.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
          • Size 970KB
          • SHA256 98a4027619a12fdb7e79a68fc2dd55af15553c5b3ed08a42fbc34584ee6075f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstat.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
          • Size 970KB
          • SHA256 4cddae19fb9e8f59560d2013fedb4d8792cfa2714b1144188275b6586232625f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstatd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
          • Size 970KB
          • SHA256 7c3a22d745e6c6edda9d0254e32604a4cfd8468365219b32890885d70ab4aad7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          keytool.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
          • Size 970KB
          • SHA256 9a34ea661399ad6442d9f187cc89b493aa637cc79f7aa9d2d4c330e60a45004c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kinit.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
          • Size 970KB
          • SHA256 e0bbb354cf5e8f817f2913819356fb8b67289c13d59c18069ee175d1243d5691
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          klist.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
          • Size 970KB
          • SHA256 a42df4df2fd092e2897996095d8afaf28f21ebadc4976bc70255071c3f8dbee1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ktab.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
          • Size 970KB
          • SHA256 e820e3b5a5596a6425725969fa9a525881f5abf5b8c80b44b89191c5f284846b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          native2ascii.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
          • Size 970KB
          • SHA256 bc22dea747859aaa746849da57d19fb25c3b9013f89872277b50a8e002af4d10
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          orbd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
          • Size 970KB
          • SHA256 3545d776b73aaa0d10f471a47f711e30a2d5af41bf992e65406b41241729da34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pack200.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
          • Size 970KB
          • SHA256 4582e6d6ed0e864301e8d319fc734b05a558b2f02064a153ebce493236445829
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          policytool.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
          • Size 970KB
          • SHA256 6746f288ac45891396a8f17f8f8b493004cfe36911b92e043bcc0a5dff3adfca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmic.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
          • Size 970KB
          • SHA256 ccd02d49f868d094f15ffe03a7affad4c0a6d5dfd02b1a369a5a24a340a11276
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmid.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
          • Size 970KB
          • SHA256 2c18003c01d714c2465a49a5816715bf9ec4bf31c8cf059dc8d898edf446efef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmiregistry.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
          • Size 970KB
          • SHA256 a931c0147aa0037ac35156b28f0a70d3a83e4c949c752f5589976be37051b183
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          schemagen.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
          • Size 970KB
          • SHA256 8dea6a160f4bf2be51c9f26362110b41d30e32be27747eef0f0ea61e63571214
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          serialver.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
          • Size 970KB
          • SHA256 4256c337a92c1619c8cbb30dacaa4f13c40fdb1e0004d916ceb814dd4704db7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          servertool.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
          • Size 970KB
          • SHA256 b33b9fb63c61e710a45defce2ff61bd6874a7f822fb6a39fa4ce712cc0b82418
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tnameserv.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
          • Size 970KB
          • SHA256 cddbd050a5191bafcd6cb76b913e96fad939726b98e80f3cece8a7c5a6cc5432
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wsgen.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
          • Size 970KB
          • SHA256 08dba04030922f5a9d456114a8a94a5c37ef2b402aa1235052271bdce48b68e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wsimport.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
          • Size 970KB
          • SHA256 0162c9bc9b8b0a9f2ed7ec24705364427e785004f2b56b4b96daa214278060fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          xjc.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
          • Size 970KB
          • SHA256 381d8e88b3eec5fc09cbe80e13a47a85402df88e0299888dba8f57942b61bf11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 595B
          • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/476-22-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/4328-768-0x00000124801E0000-0x00000124802E0000-memory.dmp
          Download

          memory/4328-766-0x00000124801E0000-0x00000124802E0000-memory.dmp
          Download

          memory/4328-778-0x0000012482930000-0x0000012482950000-memory.dmp
          Download

          memory/4328-1133-0x0000012497B40000-0x0000012497DDE000-memory.dmp
          Download

          memory/4328-798-0x0000012482B70000-0x0000012482B90000-memory.dmp
          Download

          memory/4328-779-0x0000012482D70000-0x0000012482E70000-memory.dmp
          Download

          memory/4328-767-0x00000124801E0000-0x00000124802E0000-memory.dmp
          Download

          memory/4328-812-0x00000124946F0000-0x0000012494710000-memory.dmp
          Download

          memory/4968-0-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/4968-21-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/5588-1071-0x000002526E990000-0x000002526EC2E000-memory.dmp
          Download