Overview

overview

10

Static

static

10

2026-07-09...ry.exe

windows10-2004-x64

9

2026-07-09...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    93s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 12:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_434f404415d1c9c08e81422acef9faa3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
  • Size 783KB
  • Sample260709-p491bsay4p
  • SHA256 e8abf888def763cf3d3199c24e844d0449b7dafa4bbfae4b094c4d8f61dc0334
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwareaspackv2discoverypersistencespyware

Malware Config

Signatures

  • Detects executables packed with ASPack 44 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ASPack v2.12-2.42 41 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_434f404415d1c9c08e81422acef9faa3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_434f404415d1c9c08e81422acef9faa3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:4452
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3264
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1804
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2464
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4212

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 783KB
        • SHA256 e8abf888def763cf3d3199c24e844d0449b7dafa4bbfae4b094c4d8f61dc0334
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.3MB
        • SHA256 639bbd8266e570033703a5ed01695d783fc949ef23c08c7cbbc6d940cdfe998c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 831KB
        • SHA256 c003b7744399b9c5f7c90396ecb3f81458d987361d06f5628df97847623fe1e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 806KB
        • SHA256 5dcee594d2c5ec875aab5c33ac795af064ec828a0d5898fe0dbf7098b2de0f73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 806KB
        • SHA256 8d3bfd5479e366afff4858c9608347f181315c9bec61ad6c9098cb1066d10f44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 806KB
        • SHA256 c13954324a405720db5711761b3f448bcd2398acb2d4122907fb6b716a8bbfcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 806KB
        • SHA256 c0881ce0bfcc776bdf1e0b47d5bfb537fbeac8124e4303a3d7fed27b2534b902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 806KB
        • SHA256 38aeceb7f7a3a65bf7b76d158a8fdf3f2faaa2f814c7a743341f71ef33db1468
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 944KB
        • SHA256 14716f42ee7f0fafb79656a66123df188371142759adacf11be4a2223bab0458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 806KB
        • SHA256 dbf5ca58b80e94ee924f07b5b27300110b57f338c89c4285923065dca6aeee09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 806KB
        • SHA256 bf01abf9e69729d40b7f923a71d6b48e6ddb33cae7d5af4a24cebeb606995b94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 806KB
        • SHA256 820a14b5d82555ff77b06a77dcd58e211c05b5cfd6f92d125d427781ef0682db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 806KB
        • SHA256 8f760d81295967317134c23371158379abc88c574564f7eeddbed82f027a41d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 806KB
        • SHA256 dd21a9d9e953911e7272953e8607ca2bb71861752407f2caa1bc4e3e06ce6f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 806KB
        • SHA256 9bf3c8d77c3d5daef4bb43e7c16dd99c3db578f14fb9fc10ec1e1ca00b8a653e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 806KB
        • SHA256 5b0609c668ef5d028cdec652735ee3412696ac4b7601114bcb9722edd6804754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 806KB
        • SHA256 0b7bc98e26187a125fe9b583f279d55a4077c389efec26d2ee6ef2797210c25a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 806KB
        • SHA256 7c78229cd1c42fde71a949c54bbb5baf053a7e327dbca6f543c42a838421f2ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 806KB
        • SHA256 2427734c117329411223dbac39398442278178b73d5cfbadf550b303bf726653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 806KB
        • SHA256 d484a719a9eaffed1f07ef224446f331ac00160183751b022cfafa4d4e831fb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 806KB
        • SHA256 1df662d249c2c7c918b7990f956422d59d3dabddeaffa8188a97a2dac23f565a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 806KB
        • SHA256 759861240f1be48f5dc5d73cb53abb26553153e8ad6a94ba503a3d58bd0c24d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 806KB
        • SHA256 babbb1f9ed419d73e7bff801425781de2d7e7cd25dac41088c63b5993b39d3e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 806KB
        • SHA256 417ae3deff5b53d03fef64c17ccc103e802089c2a46a27e0030a3872ac1ec897
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 806KB
        • SHA256 baf33643e7d63f825bd7a707da515e01ba9e44f7738f6894b881f94fc9085045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 806KB
        • SHA256 3d80c4e0a357e515841d589b2d3411b2fe66d1496659e2511bdb3bd86fa693f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 806KB
        • SHA256 9a40ba25023867a0311248fcdeabae520e6043933a2b0851c7cf5b6bbd08bd54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 806KB
        • SHA256 d1adb32ce0b67ad3e769cdf878824b9c6ba1c52de4909b91862e498e7ff641a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 806KB
        • SHA256 9b93cd6a570cd66ac60a06bc6e9274d9f7fd6b7856ea5bafb0335cb291d46b8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 806KB
        • SHA256 11626426e3e734ce57eb381f42dec6ddb43dec52e607b734d8465181cf1e0359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 806KB
        • SHA256 3afa5cb3d4d9892dc9622d84e35f167beb9366cd8a4858c6e2b65a4c4e18b096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 806KB
        • SHA256 d0a87f382238041e0bf4504626a512332ed6b7678b498ad55cdd810bf49ffeaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 806KB
        • SHA256 96186aea767046ffbfd2c8317dd9ea51022af240e19e2fc20718529cf9d11467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 806KB
        • SHA256 bcb80a51688daa3dc382f2df9ca73e0463bda626cdfe577292ae036ae7acf65e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 806KB
        • SHA256 6c71ba763ced5ce87cf68fc0950db76ab7aa1cd478a1ccfbe7dc57cbdd3c4abc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 806KB
        • SHA256 7a1837a890fb2c48843b76d94d520238d04ac479b77167bc6165b4e82bdfed8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 806KB
        • SHA256 aee4b4217be54c55e5e15897f976d9e5d8c4fc4d1bd8414cc974ee0d9dc3d45f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 806KB
        • SHA256 4c666f85a3246ea5a30f9346790002884209f691a6116326dedbbbedea079d27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 806KB
        • SHA256 85c8b2956b239cfd82fa91576c8335b4edeacef9d3b742b22cc50bc7df43de70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 806KB
        • SHA256 8a583b15cb7a14f8a18bd47aa8e656444048c7c69021a83f885f776f64e46fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 806KB
        • SHA256 02abb4168e0bb214eafdf6e695fce91939cec66b87446c289b53d550029caae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3264-22-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4212-935-0x000001BD81D90000-0x000001BD81E90000-memory.dmp
        Download

        memory/4212-949-0x000001BD81B90000-0x000001BD81BB0000-memory.dmp
        Download

        memory/4212-968-0x000001BD94220000-0x000001BD94240000-memory.dmp
        Download

        memory/4212-933-0x000001BD81930000-0x000001BD81950000-memory.dmp
        Download

        memory/4212-916-0x000001BD801E0000-0x000001BD802E0000-memory.dmp
        Download

        memory/4452-21-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4452-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download