Analysis
- max time kernel
95s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 18:45
Behavioral task
behavioral1
Sample
2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260708-xefdesgs5v
- SHA256 e14dd87b4c1d4e36c2b8b45f608bf020a838c2bfa22343579556e468389bf3a4
- MD5 07ee6f0e5777bb5ed3a5a5c97fe8ea0a
- SHA1 ddd165c746f4936ffea07e193a3fe4aed990416e
- SHA512 a0ca6be68b71b36464f6b3531edaa51ce99338b39977d4cf6b8bda1a0b16c178278ac34953047d3357eac6c738165b69569476a006e48f32259e4a97d9909ede
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahZaFZe0p4Ek4niOkl/A04szE8b:A3k03kB56rMeW4SkZP4sz9Mb
- TLSH T192853A16F6784B62D0BBC079C5D6AA56FA333C455F308BCB03459B283F276D1963A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/3760-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c65c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3760-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4576-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-436.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-438.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b000000019cc8-1025.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c9e-1286.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0026000000011a87-1534.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0028000000011a87-1556.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c65c-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c1-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-436.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-438.dat aspack_v212_v242 behavioral2/files/0x000b000000019cc8-1025.dat aspack_v212_v242 behavioral2/files/0x0004000000019c9e-1286.dat aspack_v212_v242 behavioral2/files/0x0026000000011a87-1534.dat aspack_v212_v242 behavioral2/files/0x0028000000011a87-1556.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4576 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3760 2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4576 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_07ee6f0e5777bb5ed3a5a5c97fe8ea0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3760
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4576
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 e14dd87b4c1d4e36c2b8b45f608bf020a838c2bfa22343579556e468389bf3a4
- MD5 07ee6f0e5777bb5ed3a5a5c97fe8ea0a
- SHA1 ddd165c746f4936ffea07e193a3fe4aed990416e
- SHA512 a0ca6be68b71b36464f6b3531edaa51ce99338b39977d4cf6b8bda1a0b16c178278ac34953047d3357eac6c738165b69569476a006e48f32259e4a97d9909ede
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahZaFZe0p4Ek4niOkl/A04szE8b:A3k03kB56rMeW4SkZP4sz9Mb
- TLSH T192853A16F6784B62D0BBC079C5D6AA56FA333C455F308BCB03459B283F276D1963A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.0MB
- SHA256 08d4e7c9d3a1ea99c5677f31eb11f26ea41a73e87dcd7a25ee99b0caa66eb4bd
- MD5 93eff4dabebedea34c5f1d9763506c76
- SHA1 da01f70c7b343161448d11e4de3d8b0464df1146
- SHA512 e778dcf18c64a32e88c66ab3fe187bd810f98dbfe2ca91b7e525f34bedf87c4e5beaaf7a46981ea0ea3cb23af97f9aa21e3f9b62cdb629f7f3590362088d2be3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahZaFZe0p4Ek4niOkl/A04szE8e:A3k03kB56rMeW4SkZP4sz9Mb6T1Llje
- TLSH T13CA53A16F6784B62D07BC079C5D6AA56FA333C451F308BCB0345AB283F276D1963A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 2.2MB
- SHA256 9d521fb5fc22499986db750dfc2dcfd4cae243e05f08d98880e50d3640020a7f
- MD5 920e97d919b728e8239739c7e18e4894
- SHA1 ba2e69875f1b94ee711471d808c0ed133aa66678
- SHA512 8bc5caa8575b25558fdad96ff8d0e4d7aa29f5a627132e6b81ff3474c62b2587cd0f1cb86c097d48463d52753ba850c1b252878f6cfe2d68c9f902337eb06a79
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahZaFZe0p4Ek4niOkl/A04szE8E:A3k03kB56rMeW4SkZP4sz9MbIT9t2
- TLSH T1B7B55B16F6B84B66D07BC079C5D6AA56FA733C451F3087CB03449B283F276D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 59ebe77b10f9de68cfaee854555e7a8674dc378ac60c8ef423cb9790af96c769
- MD5 1167e6e2b72a3373aea061806bc3352b
- SHA1 ed5bd9ec240c1f254a31cd0778e79280cb03e345
- SHA512 14d00e70b4c262b7214137485af919986fa6e28587b17e3734e71a6369c82ad391f1abae5bd05f71fe84b2a553ab23cca90970a2058ef1e635ec2336f35f85d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahZaFZe0p4Ek4niOkl/A04szE86:A3k03kB56rMeW4SkZP4sz9MbBPji0Aj
- TLSH T112B52A16F6784722D077C0B9C5D6AA9AFA3238451F308BCB0345DB283F276D5963A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 1.7MB
- SHA256 9744f97633065b661cfb410bd4e5904c236b2383e649bed8e515dff7220c239b
- MD5 bb3633b5d32fcf95cd5f0abb23c05d67
- SHA1 3aa66570a871f95ab898d90c41f77ba6b1a76002
- SHA512 57002da892802f7d9b0e80e493e8e0996367490b8569e9b4b107c005f65d99cabaf27f7c28c765bc9c04311c031e08f94958dc5d6ea2ed5526f18ea598ac965c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahZaFZe0p4Ek4niOkl/A04szE8p:A3k03kB56rMeW4SkZP4sz9Mb4
- TLSH T13C853A16F6784B62D07BC0B9C5D6AA56FA333C455F308BCB03459B283F276D1963A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$
- Size 1.7MB
- SHA256 0456868b2123df7309919904b20456659c3071ea321bbfa6438ef58ee57423aa
- MD5 e8d456b72fb85fcdb57a0a2108709503
- SHA1 d77576f9adc8266dfcf0e6e08d93ef99d262e890
- SHA512 9bb28388c311bbed0a16f11b76146b5f39bc3e61efe656b5479f10d50820fa31a46da255daff57e09cd3003f5f9e294125d3bfff0bb42ae4f5404dc930e01fc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahZaFZe0p4Ek4niOkl/A04szE8d:A3k03kB56rMeW4SkZP4sz9MbI
- TLSH T1EC853A16F6784B62D0BBC079C5D6AA56FA333C455F308BCB03459B283F276D1963A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.7MB
- SHA256 38311801a508d1265de832cd78fba360a5536caabf7b9acd9321c7c499c14384
- MD5 267758ca6c35565c546cf92e65307809
- SHA1 d1cf9fc99838c82eb6e7d5b9ce410cb4b392ffb0
- SHA512 d9bc9b5123e431b630c406883984ce29429c7428004fc1138a3a2464ad607777d53a645e0c73cbac7208095dd55f8fee7171b995709dfb7cb919b48ba6b71e87
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahZaFZe0p4Ek4niOkl/A04szE8v:A3k03kB56rMeW4SkZP4sz9Mbu
- TLSH T160852916F6784B62D0BBC079C5D6AA66FA333C455F308BCB0345DB283E276D19639326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.8MB
- SHA256 4390368c82f4dfaebbbe6d6737daccf477a4b6561422d7310b71de6338ebf92c
- MD5 4ceed883d8dd622720752137bb3fb2b7
- SHA1 1d2397fc6d8b954600c77c9be2af166b019f0bfd
- SHA512 cca23a2a734e47143dbfa9aabfa76fec6747051543013a96805bc6345ea7213116f3c9654749cd1bbd6c480f9ac0d5f572c18a51185ee1a632d73269d8ed99a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahZaFZe0p4Ek4niOkl/A04szE8u:A3k03kB56rMeW4SkZP4sz9Mbj
- TLSH T18F852916F6B84B62D0BBC075C9D6AA56F9323C451F308BDB0345BB283E376D19639326
- MD5 SHA1 SHA512 SSDEEP TLSH