36964d9e495947a150d075c1ec5044a1e67170954439c818a8c9d3530251de70

Analysis

max time kernel
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 906KB
Sample260709-vtl4eafs5z
SHA256 36964d9e495947a150d075c1ec5044a1e67170954439c818a8c9d3530251de70
MD5 692401fea173cf3e1b8fdbbd4eecb380
SHA1 3c33df946812e44c06138981e151494197f6bc7c
SHA512 7e5a059105e379510ce168e39b87df4c3a9b78564642b6166a6e4fb8e67e7dc9a7049ad8d298760ca7b9621120c3fae673918dc7535a50cc4d1b8c92fe422dea
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFQyaEBp:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBp
TLSH
T188155B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/2152-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c513-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b2cd-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2152-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5408-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c89-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-556.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-654.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-764.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-845.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-985.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1040.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1066.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c513-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b2cd-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c89-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-446.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-556.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-654.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-764.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-845.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-985.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1040.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1066.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1128.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1153.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1325.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1344.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5408	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2152	2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
5408	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_692401fea173cf3e1b8fdbbd4eecb380_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2152

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 906KB
SHA256 36964d9e495947a150d075c1ec5044a1e67170954439c818a8c9d3530251de70
MD5 692401fea173cf3e1b8fdbbd4eecb380
SHA1 3c33df946812e44c06138981e151494197f6bc7c
SHA512 7e5a059105e379510ce168e39b87df4c3a9b78564642b6166a6e4fb8e67e7dc9a7049ad8d298760ca7b9621120c3fae673918dc7535a50cc4d1b8c92fe422dea
SSDEEP 12288:A3ZUnXoZPXZNYVLeyUji0h90ZD0wxpGZIVuKrHsJaEoFQyaEBp:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBp
TLSH
T188155B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 1166c24d415da1b450d352bd8aa405989dc432179837719d5cf96e3ab80b717d
MD5 d1f5cf79e1ca9d9b12ff38d9e56c56c3
SHA1 18d679b638c59d37229338f5e01dc07aefa59333
SHA512 5021eb5bb5b2832da090dac01d177c392a0332d22f94a4d691e23a7a5f8e9f3e9fee983f7bd040d349e9d1f4a90cdcef80302722eb5eea7b92d86152b24842ab
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBV0Le5ji0hmxNrM:A3kqPji0AjRPji0Aj
TLSH
T122653A16F6744371D073C0B9C5D2A69AEA7234821B308ACB4395D76C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 921KB
SHA256 7101cd41bedec4a5948a62f813e124bf679fe55074fbf5eaba9f3613a649ff85
MD5 ed61efcc6059cf7dbea7ef208e0108ad
SHA1 75fd4ec688d48b0f591758b6dd1615717da337e3
SHA512 d026344e6c0af41795ecb2f7ca0f6b5a8ff67446e70e902fdeb43090821c403536d13e87d8b0c40c9977ad43df164dd3d526a975ca22f0973dc7d143041e63fe
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3a:A3kqPji0Aj
TLSH
T154155B16F6B44371D073C0B9C5E2A69AEA7138420B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 954KB
SHA256 3f721aa7fdfbfd53e9718e58faa8085b43abfa4a9514e7e6c230ba6a8ee3072c
MD5 04c118ceee74fe19bbbd9e73922d522e
SHA1 3a80940df41bd8750460fba03da12949b81932c2
SHA512 95cebf0d2c1c5c6032caf46e5741b1b9930cd1a5fbcc75f0ff73163b1942d153d99ad6fa101c06aaaddb12dd7fd4afb5db5fcfbd87405c1241b05194515ad809
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB0b:A3kqPji0Ajgb
TLSH
T1BF256C16F6B44371D073C0B9C5E2A69AEA71388217308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 930KB
SHA256 6365a4bae626083ee34983dd1ab6308b2deebb3564508d5ad53aeb30169af2e2
MD5 bb71271b5dfc3c0ab09b1970b639017f
SHA1 49d9fb3e519b5d36f6380f717d58a5b6c95f9b6e
SHA512 91a4b7d0fd74ea7d0c6d17c0434a05c572a11eb0212421817e8eed481f6a59faf3add367f7cff9fdb31c4780af4c2a3060f327db08ff99edcc3762da2c3e315b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB26:A3kqPji0Ajd
TLSH
T1D7156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 930KB
SHA256 e1d60033989be54a450f56b43f3987739b2dfac6fdbd5544d2011dd09c20c7fa
MD5 6420afda74e831b0e09a5c94d94f952b
SHA1 2b7dd7e0c433bef6a0db90414e6fd58a5a7e953e
SHA512 76633d9cd6f34b6a3d8c51daf2e5ae7495d3194bbbd52d21f8b5fceb98690abd619f8e4f2aa67c76c556337a46e7f9b44a3066242c9c2275a42c8a8711eedc63
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBmN:A3kqPji0Aj8
TLSH
T122156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 930KB
SHA256 f2dfef370a21b386c647d8857ad046e7626516b57c014a6e995db50fe058f286
MD5 5b257f08fa3eeb6506047d6901f14394
SHA1 5c6005a233ed67908fe396c2f3b07a24ab552ea2
SHA512 667ebe7bbdcc809ec42f0f0e2ea2daebf1bf59fe1f1781b434ab88b5b1c4cb1f1109d84d68e367610ceb4962b71fcaf0b718dea625a7425c50b8f305e652f4b5
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBkf:A3kqPji0Aj8
TLSH
T196156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 930KB
SHA256 938282a65ed5a4b3c6bd7a9e1c693f25455ba97dad15870deff50dcd2db9270d
MD5 c9c1af5f94864d67bf7b92857d0284dd
SHA1 4d5d21e04e6f31476712423351d922fda2012dde
SHA512 24681d64beb4d2e23bde4d4130ae5c52c4d220ec7caaac877c51d1bac164e6f8a7d2ea1df00f5256ef6237ee72163cc06b39fbfe37b04babf84559f8fd769b74
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBOo:A3kqPji0Ajx
TLSH
T1A7156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 930KB
SHA256 d34e5d5557191356c0f71be40676166f838991c6fff45154714caeb5f45d841e
MD5 d8fe3b13687e344a7bac366330e062e0
SHA1 f706241173842c6bb08d8d2401955efa670e3558
SHA512 017a7e4e0f574b8244ba925997e0062830d1c0339dd989b43bcd01b571e05ba84df82ffb84154d3b42924fbb5513ac2e5632763098995761432c78ff17fd671a
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBiu:A3kqPji0Ajj
TLSH
T18E156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 930KB
SHA256 5401896376286b4bbfe6fd0ef34831cbec772915f599a4bf5d9937bb11207f4a
MD5 b5dbd352bf57cf9fa54e9c8a95923775
SHA1 78335c4fe017a4903ef116304a6d975223f339d7
SHA512 cf89c5cdfe536cdfda0e243309dc7b909bc422cff1dbef61be1dd6aa6481973bef9dd6ef14e2811700df947cb4090a58e27aba2757084d96a8158afb0dd3bce2
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB29:A3kqPji0AjC
TLSH
T1D5156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 930KB
SHA256 24f63bf70fae6c9333cd07846b20052d0c08fac799bb4618177f9167b3df229f
MD5 346f92bc72ad0933ac98ce9627ec8883
SHA1 801acc68653fb93e81911e4d404e32afd0d2c0f1
SHA512 75db9442465608c6c8e28477040e27f41e617f7365d4b970fbe0be0ac30975dcc21a8c9057c75edeb4fd0b047cf4598a36afafa3719e67fa8991702797a49887
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB2c:A3kqPji0Ajv
TLSH
T13D156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 930KB
SHA256 ebb1a4c9eac095c180f9e818cde42d82e55305c8c60efe0d9ce8625f6c79da7e
MD5 5566ae028195dafc8a0abbc6a149c552
SHA1 abd60ce57fd22363e2b26bb01bef07f2139d46ab
SHA512 9b1f6a275e51a943c7f1be1c6f09e417c89a2e109b1413650a733306a143abe4c9061cd65e4db22af6fe116c21e6ad52bb7ba06347247d41fe1934c5a19b7e99
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBvp:A3kqPji0Ajl
TLSH
T146156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 930KB
SHA256 73da0ebb8c2e1264d8563dbb93486ae00ebf225db2dad7ce96a5b0a2164ae07d
MD5 277504fbe36beb97b49d488c50c61798
SHA1 ed2be9f7ceb04cdc42b095a5cce8770a5619d2e9
SHA512 7e52fe8fd8e397a4e6cb0adfd509f98461dcbb78fd1cfd185076a1754aaa863e62943f8f0d7f965b5fb5ecfa1da04fa2a834859374efe69b84955868b03eb26f
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBQN:A3kqPji0Aje
TLSH
T184156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 930KB
SHA256 87825af6018391719030115c90a6b535f9277397c21a0e66918609abbf48eb16
MD5 186da619f56c6ffef25526805062ae05
SHA1 b9b71af3e263beb0b1a08251f88deeab88e8a47d
SHA512 23130bec32875dc27e6fa0af194001a84ee9a7771ddb392ff9836716e822e54ba82e4e4fe7b55e0461935d688538bb3b88189740970a4c848fdc3f2ee85904db
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBYF:A3kqPji0Ajc
TLSH
T12B156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 930KB
SHA256 121bdd2028b9379ec9492aeee61f0ee5eb150286463d09f58dce9f5a1b46674e
MD5 6e92721464c4bbedaaefe97031cc9292
SHA1 29b1c2b077710e30df4388218dcb50940d40fa43
SHA512 3fdd45e5a6395558630bd971985a1fdcc4da4dc17c4b21126ea18eaedcc2917317b9e94f8550f3b954d0cd4b1d086cd2068f8e6a796e1d1f7cdea9f3d9e756ee
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBNC:A3kqPji0Ajo
TLSH
T1F3156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 930KB
SHA256 ea8b34d5a90cd590c3a28a4dcf28a2694438056a38d4b9991d790f24e29d1d4f
MD5 3c500fdd40a2181df51852468ca94468
SHA1 05bc4ef6c582bd9f5e71ed27318d6658c7e6a734
SHA512 4bc7abd95dff915a2a569987010c3f90233e2ba778f60711094d26b93c1701662318df30ba312f03e5f45925d7addd7f9310b484d03d81707a19d415d020c81b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB2w:A3kqPji0AjF
TLSH
T184156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 930KB
SHA256 9caa413dfd5de5557d55cd6fba05ec0598108881c5153d2ca7eb1ca70cd4869a
MD5 9d9b4f7e06ee68137b76271d068a488c
SHA1 d9a47ec6b32197e02210cdd6c01b65654c578ea1
SHA512 16b11e3229229aa9602bc3581659854edecdec23278ae671648b0a68691c71d125a7fcbee3255f5d5bb1cdf2547b22e13a062e756edf43400b30d7cbc14dd8a5
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBlT:A3kqPji0Aj5
TLSH
T1DF156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 930KB
SHA256 aafa2e9a19605bcddd9116cf5b3ebd79edd66001aeab6d07bfd0eb32f5897f79
MD5 1a288d80294b085d2a83b1ddae255703
SHA1 664be4ff4b3dbb19c0b01f0e787c74f099a70798
SHA512 243cc61a5c6af0a5274466309421441d96b7c41090f0606ee591f237f15bb81b89b6c1668d240a6fc8930a179ea317228ef35b7c45d0b310be9da1e79bb2ecc5
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB7u:A3kqPji0Aj+
TLSH
T135156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 930KB
SHA256 bfee023baafae9177d48921cb7918beab530a6afb17ddeb3a160d034f83affb7
MD5 e0b595ea944c430e30a05ab3fd29fc2b
SHA1 0293e0e19b01f1dd335e79106f59518823aa7a43
SHA512 6500aae01df8120b4dc8081e8a9a46c5b57c31b1a7410060b25e0d054809785ab51ed66d1893b2aa869e46bcf1c6839298fcad73f7c156bb0fe150fe2f1f6ccd
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBfb:A3kqPji0Aj/
TLSH
T10A156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 930KB
SHA256 286b00a67459dd30b7facd9466b371b649fff6c351b19b9b153ef378e7350df6
MD5 a5fb2f25fa98c545df63d2036456251a
SHA1 645a1fc7375c8f4e6c5930589c0436f0d1285ede
SHA512 786f0b9f19b37bf19f054df2edaf2ac248dd55ec4690bbad17a8aa6795d34d3590261c3a9e147d389dcf7ad2d96f4a8542690e0ce1a8e808911a964087da22c4
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBbf:A3kqPji0Aj3
TLSH
T132156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 930KB
SHA256 3e309ab1c74fba325dd84e2790324c3013c349f2aacfe3ecbc2bb2e76f986501
MD5 d30b1508d9d548fa83c605621479d9e1
SHA1 e7f157fe08aac980e86ea3ed00408ebce106829f
SHA512 5ecd8af08d247e352270573e21c74dc133eec36d6d657af750fc94f8e9c6133408bfcd2044b5056e4cede506bac8fb40a675106e45d64507f373b280e69c7729
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB0K:A3kqPji0Aj3
TLSH
T1EF156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 930KB
SHA256 ea1335aa6a690c2264873fb98582dd42f34031b761f837e9b214971d96812ccb
MD5 53ffea911acd87d00220c4364331af9d
SHA1 6eae4de4856c2928c934ae20000c0a1905c45291
SHA512 0f1d9cce89822b55767e213c0a3fcea7e985487d5b6783b7eff609d55b50f448aa91d9324900a70f487c67f5ad37d33e756c21bddf453d8b77280afd9f98e9f8
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBpk:A3kqPji0AjS
TLSH
T1B9156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 930KB
SHA256 ff36008ba7863cc4b4f4e29633e74d87f4494f9acdfb77b07dc18d24a6c8fb41
MD5 00a7585a891f4469e1b201c1a8db2130
SHA1 d4f9cab540a16f59b337cef8cad80547ab84adea
SHA512 c981b6bf55f1217491796276a8fed7118611507c7a31285db430d2088a1b122d7670680484f8fbfa740aff6549729156af953f32bd42e378cbea0e662637670a
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBG0:A3kqPji0AjX
TLSH
T1E1156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 930KB
SHA256 db159c2e800880796085bda55b9d80ab45b1f5c248e55894e3b0efbdc16cc159
MD5 bd3aa8f08719743c0b21fc648a3a8485
SHA1 a075b649589e42185de9984c9bb5032fa1e24107
SHA512 eeb0a9165f59172a592723ae999f3ea294d0892a23386f55ad477ffd8db8a64763ebc8b88a2bef408e6832a1dca7471ab0b644d87d5d93d36b518c946a68e37a
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBVg:A3kqPji0Ajq
TLSH
T18C156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 930KB
SHA256 bdc0af84dec6a5e2ddfdcee1604edd57d518195ea57c2876666740e6688e75f5
MD5 475cf89eed87230074cc0a374413c703
SHA1 7f469a4e9ffac2fcc1c6a939569f6ed4a8c0eec5
SHA512 b3a48727a8ec6e6ef6e77a876a05833c93ae4b21d5141b1c35a43feaf87df7ba3cedbb9c7af8b54f3fc130658633edd13a17fe7d8563ba17a80c511d0cfa1abb
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBkr:A3kqPji0Aj0
TLSH
T144156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 930KB
SHA256 fb88eb93c2f948977d777b2c7eb1412bec2ba6a500242a3d610be8005f9fddb6
MD5 e013a08e3f26c860e281859268ef5ec7
SHA1 e664d89b099e7f0a1ab77ee325c1adea5c0e3ec1
SHA512 685525d6bb2d7d8af4effd4ace857a12848110badadb777928b45810181571bbd33f6db05035af76ee68a8ccf1c5798d3d581566396341ac93066b3de228f1d9
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB6n:A3kqPji0Aju
TLSH
T168156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 930KB
SHA256 d296091cbd9c9b78926f3ccebb9c47336f2ae205ad9580953c62c2d97c9c9233
MD5 54c4ca4bbbc74e9a4b04813b9db8141e
SHA1 8379900414b87f3303606ce72a3468e09f4ed87d
SHA512 cdccdeb219976ac005541bd1f728ba75d12ad307667dad18b91bc0117bc932c387a60b34a2c75825ace5c7d4546c8037ba89769c28041ae7a3378c0128fd4fc9
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBQx:A3kqPji0Aj0
TLSH
T1C4156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 930KB
SHA256 74dbf9a5740742952f4b86d53ebb70eed99eabcc051e6bc48a3822ce7c613da2
MD5 01134b96420a0f62f611208191009e48
SHA1 fd2e06a23324bfc479aff18a7af581f68886a316
SHA512 1b4da0016fc3d57fc637eec3f3c767d066f5ce382530384e920859e79985502536b932fe1a3e6d8782ec39d4aef7c1261f2174a1324d9bfb4cabdaeb2830be45
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBSA:A3kqPji0Ajf
TLSH
T1DC156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 930KB
SHA256 7f9e6dc33f4f79431d02a91a1e73d5c425c92266ddf2d9aedc6ec18422f60d02
MD5 b54a6011429b9a9f373efd2f9ef3d5d4
SHA1 6c878b1cc5bdb451ea742512f4a5fb61b8bfe411
SHA512 765abf1adc933f169ef6f33c634b72db8119756f3facad07fa4e54e7b94cbb0dc34befc57c07af5e5ee87c52311f1ca32fa49954b1ad89268d9dbed45146ae6d
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBr9Q:A3kqPji0Ajy
TLSH
T11E156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 930KB
SHA256 4747e493293b420e3b9cbd9d3fc9224b61420b66b30ebeb97eb9b0bfe7758cc4
MD5 7d296ea5db94f9a20f4c8980f6379dbd
SHA1 b5df36b038dc401215100ee5033b91c0656062a0
SHA512 eadbf7ff0eaccc7a1b44cbdba02a3716148f61295ca3c41bcb51ec2d10b9565d36a00e80c6f6a9f3283bf3b0dfbfcba543fe35b87aacbfd3c806fb2f2a616c72
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBa4:A3kqPji0AjB
TLSH
T1E0156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 930KB
SHA256 dd6c1c95d4f99a2971a8f9a2711fd7274d86151de174becd0023d766101be761
MD5 d4a28ac04e89fb7399c791b3bf9f95f3
SHA1 7037fc725bd44b43a03da8b110c21f60f5b2d33d
SHA512 bfb04b001501efb7a8a71889be2843b8dde644b25faf72dd1053c5f0a13bd3dee1471d453aa1207f621a933cf3ecb2890a15da17f620040eae4dc8e1b1ff1ad5
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBBu:A3kqPji0Ajc
TLSH
T149156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 930KB
SHA256 4c22c962fb7dd1f9ebb8d5780aea4d1303710d2218c10a11f32397f6fdbe1bd8
MD5 2fdc9192281e0efb2b92ad428dab26c7
SHA1 a46b9a395eeabc57fd07a5149bb28eaeb06966e0
SHA512 afa3f5fa662658176053f41949bb1acef66e6b962cd85952d1ad1fa4b38171cfc41f4ba6bf59ed59a926750777e6d984cf3c88a9dba639963b6fa67804ecbcee
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB0j:A3kqPji0Aj+
TLSH
T1F3156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 930KB
SHA256 0de64ba06f7a6784d59a8df4f3db7f86f79be4ec35e4df01bbf4769081cfc625
MD5 94610ad55ad27bb078d8e10610667a2f
SHA1 7ddb1a2cd6662b169452f259cc050df45ac20e60
SHA512 5af9c97a184ed4255d14290803dc1ad86b502afbc0567926817554101a1e109974a74ff3bd1741532f4b43bc88e33bb6c5361bac34635ac0c733f8473a5582d8
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB1g:A3kqPji0Ajy
TLSH
T1A6156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 930KB
SHA256 e91f5bd164f2b6314af064872f8ccb50c42aa1ca86ddf4b1824917e3c8818a21
MD5 097d197ff6f89e3c0a44ceca0b62dac5
SHA1 5905c7d806e0472df30cf823469cb7e151eadd50
SHA512 b3d75d597bcbda6ff6336645b7a81a65586e3c84323f02d44397b1b9d5fdc9abf3f5b2eec16482fdb97bb9e966b48adc944cbde9729d8f70cddc60891f00a3cf
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB0I:A3kqPji0AjD
TLSH
T1C9156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 930KB
SHA256 c8cf594fdb7d97eca670528896ab6a59c2a6aed16138cbc07e38ea6f7ba39e3c
MD5 0bec8083532bc6352798d039139cd081
SHA1 b44359d4d46c44e0dfe8df19284e4a3a3834367e
SHA512 d8cdc8ea67567d2b6162e861f68846df73b980683b96c5048b9cfaef11eec0b0c91b656b5dd6bd1fd4d435715108a4df8862f9a55af47e9b54f9ef07802a87d9
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBmo:A3kqPji0Ajd
TLSH
T12F156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 930KB
SHA256 60257e95df2a499c2a4ddb54ed3818a2af77c5eb00ed1552ed4227f8284ed58e
MD5 90a9e7eaa52476a3424bbc34ad29c547
SHA1 535165b641040d0e6957944aa0e8ec87d6bbe6c3
SHA512 8d8ac2f24c31b8837a333be905cc1044ceb9b35526f25d95cced4c78cce143f61f9002178d022093672a85cdb6d4744c68968e2af2fadf24c5d3d08706d7d626
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBN+:A3kqPji0AjY
TLSH
T1CF156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 930KB
SHA256 f331c8b9c91636d335c325590bf6cb257ed2b57b796be0e851e76e25e01d329d
MD5 b4d6ff77fcdbfa3749c42d80e8d9dbaa
SHA1 d67794206a4d4d959bcf09f19b4820803a88baff
SHA512 28fd37d60533d2b16642e425f3c3c61335224537867521dea0855bb48552485071cda1a4b060596921acd4ece99c4da240ffa27badf0b8462be21138ea75a25d
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB7Q:A3kqPji0AjY
TLSH
T17A156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 930KB
SHA256 cf62656adf38049e43deb6e22e275f60fba0b8b74729b6df62a03e800b191f06
MD5 dba068d6350ec3fa9ffae2e5750aca3d
SHA1 099cdcecaef7888ccf472c50d75c28502ae24b6c
SHA512 8b748ac1a85b9edb7e16aa91bf51c02245c27a7b176e92e1c4a02c7e3e098d887eb7528c0aed3e0100c73d5106b7a9445290b4b364decb23e76c24378fef1085
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBwX:A3kqPji0Ajo
TLSH
T19C156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 930KB
SHA256 0be3031fa1c06742d4e5b0d8ea38486165579e52cf20afd1227a1af3ed7a3b8b
MD5 fac9246c19f84d5699afa8e2cce62801
SHA1 89bf3d94e037b7a32f81262c34408d33b8440896
SHA512 7b760e386041b461f452499302c6812dd846589abeaddbb3aa58b3ac703c524bd3b92beacf61cca4ccb556e650508a9a634b14f035f2aca36ae25ed068a82d0c
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBGL:A3kqPji0Aj6
TLSH
T10C156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 930KB
SHA256 4f7639874828723a7150e5ec1f499d1c36fe79894158e89f3b64879d7d98c2c6
MD5 a408a470ff20074bb29044bab81a6c2a
SHA1 2858e4e98cf578bcea8d25cc62dfeb59b69c7d2e
SHA512 869c62fbc0d39039f99c2980dd84d5a188fc77dcbb6e0a1e91ca826a7594a9bb470b965a0348d297738a3c8a314d7c35d2c4ea2f9279b620019aa51d84642c85
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBaM:A3kqPji0AjX
TLSH
T197156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 930KB
SHA256 89016894b85fb8f4f2f45bbc32b072ed508428735091bc2a871092342fa1ecb9
MD5 3258fb3cf2c780c09ab16cbda7babdcd
SHA1 8dbb6457ef62a2d09d9400403c049247f70df448
SHA512 cae2e6bf6f992ae4c967969483b3490f55212ddfc4e9ab02484852760fc2583e802946a228c5fad82f37c11a027fe81524b470f18367bf36eed18054ccd41275
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEBLh:A3kqPji0AjJ
TLSH
T1DA156B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB0395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2152-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2152-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5408-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads