a8e7905a627c0006f4872f1b2edc621718a745250f7e3a64bcea9b663aec6adb

Analysis

max time kernel
106s
max time network
87s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 930KB
Sample260712-vk4xvsfy7x
SHA256 a8e7905a627c0006f4872f1b2edc621718a745250f7e3a64bcea9b663aec6adb
MD5 5ece19b4ee605a283f0a2aefa9c25afc
SHA1 9a44c11b3b0d81932881b3c281e13eaa437f83cd
SHA512 72ead2ef5122bc8038b0c42d7f8a43e577c1ed09ed2b85ae8591ecccf228166349369a753c357bf9427a6a3114a866b5c3cd41dadf62cd1b2d8397237b5cc05f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasN:A3k03kB56r8
TLSH
T175157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4304-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b6f5-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4304-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1716-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-564.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-656.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-976.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1111.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b6f5-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-564.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-656.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-976.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1037.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1062.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1111.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1148.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1217.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1322.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1372.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1379.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1716	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4304	2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1716	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_5ece19b4ee605a283f0a2aefa9c25afc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4304

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 930KB
SHA256 a8e7905a627c0006f4872f1b2edc621718a745250f7e3a64bcea9b663aec6adb
MD5 5ece19b4ee605a283f0a2aefa9c25afc
SHA1 9a44c11b3b0d81932881b3c281e13eaa437f83cd
SHA512 72ead2ef5122bc8038b0c42d7f8a43e577c1ed09ed2b85ae8591ecccf228166349369a753c357bf9427a6a3114a866b5c3cd41dadf62cd1b2d8397237b5cc05f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasN:A3k03kB56r8
TLSH
T175157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 6f90869438a971f7fd656b9b15abc20e7b6d662af834525bfbd4a94c63318d57
MD5 99b53f9ec112d558c5046bbe492e09e9
SHA1 8d06faf4571b24bde49e0ab5234519d047a7d437
SHA512 f048eadd44170dbc5e92da4fbf6f8a69711e3839f8e0ce464e2f363fbff466c8ae8f352237171af066d1dd97eeb0064e983bc49df22807313d352113d3bdc27e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasZ0Le5ji0hmxNrM:A3k03kB56rEPji0Aj
TLSH
T138654A16F6A44BA5D02BC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 944KB
SHA256 00c2e0b574639232ca60f7a673f978d7c9d65a3a3724ad971da3b3d49ab65142
MD5 c054fdfc75470b604475ccd7112126c2
SHA1 783c67f1aa90eaf4dcdeba4cf26cdf09dad98e30
SHA512 880f8e24daa58207445e40081e0d1d376ec0a9de829a6f50f95f353746d758db95e0664f28ba185510a728bd8dd17c99fef8992b05a3d6a3853ce2130c25c257
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasLa:A3k03kB56r
TLSH
T1A3257C03E6940FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 953KB
SHA256 d68b6cbf82b0964ce83116f47018bb89ad55472dcd0a6c88e4b39bff8016fcfa
MD5 fa69a9a8dd14fbc0c26b74464faa5cda
SHA1 d19253b223a607b9c73c9fb49ba4c15b37f0e01c
SHA512 365c30c3e5532a1c6f12e07cbf74791a384da38f8703ea8634ee566b2e18cfebceb1dc2fa81eef7f0f2e3947a7b6dba712ca0bb1e9513d8c9d1cf483584e92c5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasK6:A3k03kB56ry
TLSH
T1DC257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 953KB
SHA256 f2daba3b2d03b3568dda1f61d006c646dbbddc26fa7e756aae4bfdf75415486f
MD5 1e4d641871024bf57addbbdf4db14cba
SHA1 1f34bf5d840eb40ef31aa06cb61d2490afdc3343
SHA512 364d268191e2bd8fda129d5fcca9b642f916276947b63b12db02024ca0cd6748ad1a9a097dcf4d541ebb6844c842072405ef3372f45e1569278b0aceda15fb74
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasiN:A3k03kB56rb
TLSH
T1B8257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 953KB
SHA256 be0c1ab5fc4ca951e905cf81c1bacd2f1553184fbf82c0841348e74ee2cb9f05
MD5 f719dac87a5993e361831f518bf5f99a
SHA1 86aac7ca853a3b75c7008cfbd9d6fb39d4cc0354
SHA512 42c7ca2649c3c3afd5ae276f74802fab24577482f116cef4cea6bdb6a4f327afc020ce4ae8ae832d06076697fba4cc24574935a926d9135f95677268acb37ae0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasYf:A3k03kB56r/
TLSH
T10F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 953KB
SHA256 82447d9129d8cf644fba96fdbc4886b44c7eb76c9e1ee6f82e65feaea05fcd9e
MD5 7d5251ede5f9f083e5e909ff549978eb
SHA1 9e1c2fbff5d9868bfac30cde6ec625dcfb275d9c
SHA512 a7f81ee7e4251d581e7e765aa693ba4d8670099a63932e61ade8837196bab4c0dfb4af2587e30cca33428ac7c6648d643c328c52094563a2451a6a9be7a19ccd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasyo:A3k03kB56r2
TLSH
T1E4257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 953KB
SHA256 02f9cd02fd35dce0f70cd7e5162cad9ffa2f529a2358d15c1ef08e423fe0e976
MD5 3d1df65c2e9899861ea200ad2f120866
SHA1 14a73f0c38324249c259f37961acada87a655d05
SHA512 d85e53302db2f2b04512410239782143a7b957d8f6c313cfc6b0e5c24231e0137320e4867638610b8dac8508505d1df86dbf4b89a58331d7e659b9ee0e223a59
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasmu:A3k03kB56rg
TLSH
T177257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 953KB
SHA256 5c2b326c0917fd40b2b808a29033280ed2840e495b204df7db094f00b97c67d8
MD5 92297fed576e188cb2316feb90f9b884
SHA1 c3edc380778af7e76a2d58191b06986d0386da68
SHA512 a330a975d260b1679e1673473bf44645ae9dd6d8801c5865382c5821919626fad262d05ce2da692069166ba73d39c03fb0d68561c83cdb12c55acb5a1605341a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasa9:A3k03kB56rV
TLSH
T19D257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 953KB
SHA256 03b1ee8e6596474ca0244f501a43aa1baac7999ebc91c6126c93a6b27ba2635c
MD5 f946be08d8fc62da3046a384f40e8116
SHA1 3207fab2d648803e77ceb2f37d6ffa09322d8df0
SHA512 bd790efeda5886329276fe8366a89f881d85192989c9dc0ab957c723bde22b17206dae05ebe3798e5751b449b023f6483bba18a3443c8d383335cf5ce452f75e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasac:A3k03kB56rQ
TLSH
T1EB257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 953KB
SHA256 7b57041da4b095ef702b61275f41384d6cf6685d36648be537d75da734f6f420
MD5 258a9e55cb3ff427c1843fba7d692a5a
SHA1 8e07a69f7054eab4a70890392469b8e542ff234a
SHA512 0685181a8970555e3c62edaced06adfb8dc5e3884e819aa0dda258177df0f02d3ec0bbbeb9ce91d77e59f7ffb9f284309be580c1b2402dac80326c3fc84c45b0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasTp:A3k03kB56rG
TLSH
T168257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 953KB
SHA256 e89611dc30a217c05daaa80383b397296c0261bc9c55ec1bd8531bcf690dd0cf
MD5 f624f668f92eeefacd24bca4fc69fbc3
SHA1 1bc7301495915f3b7ce94fceb9de4cece3fea7a7
SHA512 ccd05b185f12e24c6935b272a198b4431b62748b2e15034c2a35cfe0ce5077005c3c1cb15002a2712701ee98e0a191088f8d63265bcc3c5de8fc665fbb2629a4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYas0N:A3k03kB56rp
TLSH
T100257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 953KB
SHA256 8dcc1c34494cfaf271393e8fb9196cd0c584d1d887e3f2fb3ee182c84b29f47f
MD5 d10f9ae46f4d09360fb7de77190907cf
SHA1 1bd7f2c99e532cea4c3f70806a54e74ebfda49f9
SHA512 42c8020c856a1aa196dfd86ffab8c49341709612c539d4c5c24f0f85e5d3fec8347fcbf2eca25e5ea9aed92b5f93db4dfa2f6a3c86ab80802a594fcb30f79b1a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYascF:A3k03kB56rb
TLSH
T1D3257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 953KB
SHA256 047124acbc8c9fb9974d9df49c99dce968fff9bd9931289ff54872b6b364ed97
MD5 add2038cf7c6f1a70a80602f3151c1dc
SHA1 d5bcea3a276945c451bf64f9be1e3180ffb7505f
SHA512 b23ea9149f49a97344b00dc8aa6626d66db9b94a7f7227633de05ead64d27ddd3cd0891fa983e349db55daa838fd89ef47f13e7a29945de64fa1c4f2eb6653b7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasJC:A3k03kB56r3
TLSH
T135257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 953KB
SHA256 54a2a6f04e023e1a8fd3f9548e35fb8d026a697d4291c097f60c3534d3d156d9
MD5 31267e35f8ca0eabc96ea15d519627f4
SHA1 ca50d75851e1a8e8018b9a4f0f1f9a17d33ae378
SHA512 d64a0c3f5349120dc1df1e8b2b12596bc394ba28711b0d0620fe46e69cc01129f087fc56d14d7926bb5c3a2eb21f3a403ca332eb8beaa7572d408bc30d7a86a4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasqw:A3k03kB56rS
TLSH
T1B0257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 953KB
SHA256 ca764b16b3b1c94d1b1a93c99f2d67dca1237fbafc0774b5ea8e8685d57a458e
MD5 8b466c794c3ea6e102a2e78380f11d40
SHA1 68621739c3e2267a6ed3726bb73982cab7511431
SHA512 63b595203622a42398afabe7983bfb31f70a14eeb1c828594a08fa94efa1a0292e659623db17a47e7321cf24fddfcc72cd54e2e53b3f67da30bcabf568cca799
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasxT:A3k03kB56rC
TLSH
T152257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 953KB
SHA256 61e4c968292e1c653d0d4c1e0445886a3258c9118f550baebe1634efcd5b203a
MD5 a5abe149247152a5bf0e5da99ef5b465
SHA1 dae0dafe24f6fd9e0aa99993d4281d5ea255d19f
SHA512 b24b010c21d644c7082af0340f9182925350cbb50964baae14d8404d454eee830fce1ee0a2099e56cdafc4bbcc9e3204438a9a9d2b4424c6cb6b86cb30ec1e0b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasfu:A3k03kB56rN
TLSH
T182257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 953KB
SHA256 152dec666849b9b22dcb370e6049198725323d25b4155362411a99adb05115dd
MD5 336ae98723733d0cff4ca9cf1f5506cc
SHA1 a6f2e6330936d309a33dcf3e1021c594cdf8ea42
SHA512 fee9d9706afce8bfe6043e6c839a18984d06f35fbd7237ad1b873fb6a882ae6774be519c695acdcd0cec2fb252458a4b0fbd213096fb107295834630c5020ecc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasDb:A3k03kB56rc
TLSH
T1A7257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 953KB
SHA256 a0894689f58a4c67a8cb6bf3b9d5a6ea7a9bf2205ad88010a753cc8b663c1a50
MD5 aceb013849830660df10472bc16fc333
SHA1 1ea7143211d2f4aad24e8ae35ca15dcfb69d679e
SHA512 29824e2199aa89dc80e384e88048bbf226a8073960d17cc0f3735de98801d9c3d64dafebddfcbc012da047b17d771906bccef0ab8b3fca83db82ac805c3211f0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasXf:A3k03kB56rc
TLSH
T14C257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 953KB
SHA256 039c31b3058d2960d9e7b3a3c9dde869425f68d217bf9ec69f90ecc1236be4b8
MD5 2f236266118b8baadfc11a1e02835fa3
SHA1 29ff161f77d1a0e4fe74e674fe478d1cb0d791cb
SHA512 31d4592c638bc67c111a73424654531b21847a73a3054c9471529eb26b3dea9f5df27eeb5978d9643c262afb50bc9b866b0495ebc9338fa45106ff711cf6c0bf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasgK:A3k03kB56rM
TLSH
T1B1257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 953KB
SHA256 02e06c1f4867013a53cb842c174ee88839fb3873616908e7919c57aac7ca63af
MD5 4c4e89755ff7d539940d68c6d2cde3a8
SHA1 fd75c1f9da2dc48a2d4dba8223f0f717a2238dae
SHA512 c67802827f09d7bd6a02662f631d8e26e0e97848e46e9a84b5cc9d15dae8226b51430e20b56c808cd73e9461dba803338ec9acaef0b407cd5dcec4628e697b2e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasdk:A3k03kB56rV
TLSH
T196257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 953KB
SHA256 3ed0cc7f1a06dca357e9abde5b36a529452794e39567010fac10a9ec413a7445
MD5 0b87a6eeb3d4e62bce7bf71725c9a717
SHA1 56df738d54e49584467d95571f668c7f41f855a0
SHA512 39e3aed7f2879c4d41e20da9c4d51686e369e87b0981df93956fe98ca9797a25cef6989e8ac20c57fd76109e662b024f2815683e032455a16828ccc690f4b96e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasC0:A3k03kB56ro
TLSH
T10F257B03E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 953KB
SHA256 ed6d63520248a99dc501af595f312400b9a714dc8a50f207746e346d1583bd5f
MD5 723b7274493323481b03a4804180ebad
SHA1 42bf4f2a6298dcd3434fe48ab0c7925de30478c7
SHA512 05d2e7138cf3323459b45e7abd3b6305cf7538720c47b916209d7407403574281a165cda85fd1fdc208c6c56ec9f7ada2d60ae5af39ca33e76016103cfe2b7eb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasRg:A3k03kB56rt
TLSH
T104257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 953KB
SHA256 a3eafdc88b4a85d6f2cf4c6fce406bccbe4181fcbcbfbef7585f8d2bcc2c5a8d
MD5 7c7d7fc8e2de33cc29be26be3baf960f
SHA1 2485498b8b5d4e5583eae4d426c503166ff88054
SHA512 65ae5e6986daf6f599926ca3e69b594a04035dd9895083d2885739f8f40186b8de6eca855eec6216240b9124886ef851d021c86104c78c70f44a32a0ddecb628
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYas4r:A3k03kB56rv
TLSH
T15F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 953KB
SHA256 2f45ab1c6d9f57c92b92fd4ebf3796d740ad9133788cbcd04cfe89f6f85978b2
MD5 4d5345c5989df4e20cc9e51de676f17e
SHA1 392121a48e107f122523d381acf906e4514e4ab5
SHA512 a85557f435af8cc219532144a362d137f1edb5ec30e5f2cb634a413eb06c6b773e8d1c658e37b8b98239fbe6234a4e34287704430c25b058569bad90e7123664
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasWn:A3k03kB56rJ
TLSH
T1FB257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 953KB
SHA256 d2ef39f63f1587337dcc941d6de72c4ba44c2ea196e552e7ca99cfa11415d9ab
MD5 f55840680ffd49fb0414c37fc254fa35
SHA1 9fd4e8885dd3ef4547ed93ba2089ce8439cf7b52
SHA512 957db653e20e89e0bed1044ff9f836ab79d46897ce2b57bb8e29e00a0747d795e117caac40f367025e4ef85f0ee144f522eefc727bee634747984e75cfd6a5da
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYas8x:A3k03kB56rH
TLSH
T1EF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 953KB
SHA256 7d89d2cce90d665454d2455af45149c7d062250c1b7908e93f69aae945a1588d
MD5 7e7e14a3f6c87704240ffe0347038e86
SHA1 2b246d18c993c33d70d4d1c74460f84497098d6c
SHA512 98a66b1e51dc7414091ccb41a287e90cc587a47c25b727a821ada41ebbed38c9a43fca708713d7d901dc1f9205ea0265931faa9edff118f61590ee7cc0c29af2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYas2A:A3k03kB56rI
TLSH
T12F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 953KB
SHA256 595854b4029b89d58a2fac3ded52df2effa9f6db0bb504158c4025937c5dd18a
MD5 ed73d42d02553fcd79e761dbf41ed473
SHA1 08372c8e6ac071bd4e6284f5d0f433128a355a60
SHA512 ed90d9f1f18370776648f276905c1ffdc79fa8507e11f1d23106abfc7d4d99822f1e270ac9cb7115a48a3c7921faa7b6e5ad52bf074ac0f91e217aadd57239d8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasv9Q:A3k03kB56rR
TLSH
T1A6257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 953KB
SHA256 447d60211434ed0418ac8ca54d78bf74dfed4ca41ee0ede6c59df8ec373ee9eb
MD5 b1909506a80a16fbf68786a8e474bb43
SHA1 e7cbaa21f94daabbd48467565d490788ff15d3fc
SHA512 fa1848af5a35b2ad034783a17c34ca8e3a10319b4c9263519d850b43a1924346e4a8089d5655cf29eaa4baee4154bc0477ce37b812731c906d6a0bb211dc729a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasG4:A3k03kB56rW
TLSH
T1D0257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 953KB
SHA256 fb7f59aa4a69029916781d9eaa40641a2deca2399c503fba0ba431ad75677a85
MD5 3eb626096916cf6d54a74784d9ae2325
SHA1 a7bc6dd83d326bd56d5dba0f5d8b9024fa4d88a8
SHA512 8b5693e9b635d4574c0fa7a5ec9d12309143ccb021205678a153bf1137d6290bc8b5e371aa82b60c505c339bbabd20c3ec9dbf8a083f5e3599849a8421c50585
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasVu:A3k03kB56rn
TLSH
T12F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 953KB
SHA256 4f748dda19191494a99b5aadcae197520dd1f4bb9d414ff49cf2d77ea50892e0
MD5 fae50a6b7ae71ce1ab794e165e7804d4
SHA1 17f598a8756a00b9ab7dc59647675f646b469f7b
SHA512 a18fbc6059ea16cd3c50203693dc2d631d5054fa744887acf5267a4f09299d6c8170643c739dd67162e9303d913a5b3c2e904e63030c0526b1a0853d190dcd61
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasIj:A3k03kB56rJ
TLSH
T184257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 953KB
SHA256 27e6d9182c27db62df08f341883aab02ef3fdd80c30c629732d3bce8d0a068ab
MD5 0a8a0d2a7c38a1d64607c584fcaefbde
SHA1 c30b0d7458bdf503d449f8e3601ddf65658a8676
SHA512 0bfc3dde23ef1a4516b54d7109b5573c1ee67afd24529f75723950a1e5edf13592462a39e0466af46459dac2aa0a4d8f8df641b9c2e30d91e233c930204a31a3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYas5g:A3k03kB56rd
TLSH
T154257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 953KB
SHA256 7db008c733d7786a8d124600fb361e1c5c9812abd1fb189157e83c4b7fd6eb1f
MD5 9ddaf60f3545d95d9b46609b28196305
SHA1 c53b58f08a9a6cb70eca5b086a535eb98f4d01d6
SHA512 5edfb319391c88ccddd6feb5e454800510ac61510e2f4ae7c8c6c6aee8155fe6dc44c9132e74049bbaef877cbbd240698b9b22b6278336502042ecff1aaa8ee7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasgI:A3k03kB56r0
TLSH
T1CF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 953KB
SHA256 d8116a0237e7d584166036de7090e397c88ce11743b90cc4f446f35ead938ecf
MD5 a8210410ca96ee1dcbd75d4fc04f1e5b
SHA1 2d82d48420b8cfc9bbd123e7091e225d6da0357e
SHA512 fbf8eb9030f007477b82de8e08089b4715cad7fa49f7cda2876103bce28aa25a1afe2565d82f825e199603262200fcfc1c0a79ffdfeffc8da28e2878feeb4035
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasio:A3k03kB56rm
TLSH
T162257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 953KB
SHA256 b481a12fd1237fdf8a11815315d69b4dfdea82cc145755fb46e10ebbc6e894dc
MD5 90396cddeb305713312b58bb20bbb959
SHA1 5e913b67883fec21ac6abe2132dea4be43c8dde2
SHA512 04f837bfea30c299eefc79d6ef7f525a5474fc41e0c62f590ebf892a36981c5e63c17fd3125e8cf5e610ede0d2726b1ef035681be0f2ba97ac0c81db24d7377d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasZ+:A3k03kB56rz
TLSH
T15C257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 953KB
SHA256 6ec9189592ca3d8fcbc7728474317de060e0f29afebda0df5ad9dabdaf096386
MD5 ddb2902eb720ecf84f196393b5456344
SHA1 d126b035e8d4ec084bce47a31c5b6e2b50d3e36c
SHA512 6887887784933fce5b2e758d03e99bbba6b10954c237a18efc98e28bbf1ec4fe5d11cd27852a2758506ca910ccd81c746e17a83818fd84756ec43ee79b20aa40
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasHQ:A3k03kB56rH
TLSH
T11A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 953KB
SHA256 42cd06215ea1cbaa52d57af1e20def70eb68ae7c29e9823c964cde7e80a945fd
MD5 d3f5666b673110cdc94f00a81789680a
SHA1 4cd19e56749488268537c847e2a5f5752c1d2a64
SHA512 701be9d2ecb041d28f7435379f12e845cdd44e89f2f218f07efa4adf15aa5e248583c0e39ca7cf39f0b7f227bbc651c1bf3abfc522453bbdbf2a46624607fb66
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYascX:A3k03kB56rb
TLSH
T15B257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 953KB
SHA256 beb15425930a7d8a613638f153ee439aec7c2d053874bbcc0e08a3883026ce06
MD5 fc7f7c2f62f0c4ea85ed332c36717876
SHA1 897ba796222173b3f23f96189c7f295e23750aae
SHA512 3c9f361de3ac48de412c6452cfcf740977ef46e38dc831d39c7c19307592fa2a7bae0ff5f84df85242219446a84e4bc298a4ce031fee6679aea74da625b9c89e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasaL:A3k03kB56rV
TLSH
T19A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 953KB
SHA256 7d808cff615b114f5e04cb61addf90ea465339854cf08ba30c1e783f748b0594
MD5 8d0aae4334d61a1f93409d21d27ee93b
SHA1 945fa0138e743663a67c0c70a7f304ea7c865683
SHA512 1d75671aa5762b7b060c049f0bd9b41496731527d05ac19d0ccd916419f8fe150c179ec96e1550af298ec1fa969e0d4ac04fa58c68074dee03ca57f92abd3032
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYas+M:A3k03kB56rs
TLSH
T125257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 953KB
SHA256 577e63d67b85bca29fd78104e4bfa347bf6b3cca7ab414473fa7fe5e8fee9745
MD5 745adb026dfdfc0354460b1d00e67a71
SHA1 74f7de030d9086fd7931a1e6eb558f97fb36a977
SHA512 366e3a703a625839e730990c90326ad854b30a81b3c6ac89c569906f64eac4c3c62176f127b5449f71ae327ea2b04fe460ddea8561ef73652b5c734da1157853
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiYasnh:A3k03kB56rm
TLSH
T186257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4304-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4304-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads