587105adb6720641f84196fa7faea20013d57d4389a64b04546fac556110df71

Analysis

max time kernel
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 888KB
Sample260714-vf1pmsg13r
SHA256 587105adb6720641f84196fa7faea20013d57d4389a64b04546fac556110df71
MD5 6470487a2bc5968d5f9ed6a3ed50feaa
SHA1 ae670f6774dc5234dd9e15b9e016683e2b26b82c
SHA512 39748676a5cd83e737614e6e7b17e491ca3cb576ca89f9b3ba77c7cccb4c05ceacc1a41d95968688f58987fdc86a45a471aca3bbafc113db56349fb605a98a58
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3a:t/sCv7rTiw2RYwZCUsjwUL3a
TLSH
T1CA152A1767EC4895E5A6613089B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1784-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5e2-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1784-166-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2980-167-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-562.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5e2-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-240.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-562.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-999.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1061.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1122.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1141.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1179.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1216.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1320.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1340.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1365.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2980	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1784	2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2980	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_6470487a2bc5968d5f9ed6a3ed50feaa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1784

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 888KB
SHA256 587105adb6720641f84196fa7faea20013d57d4389a64b04546fac556110df71
MD5 6470487a2bc5968d5f9ed6a3ed50feaa
SHA1 ae670f6774dc5234dd9e15b9e016683e2b26b82c
SHA512 39748676a5cd83e737614e6e7b17e491ca3cb576ca89f9b3ba77c7cccb4c05ceacc1a41d95968688f58987fdc86a45a471aca3bbafc113db56349fb605a98a58
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3a:t/sCv7rTiw2RYwZCUsjwUL3a
TLSH
T1CA152A1767EC4895E5A6613089B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 a0417270bf0bb959395501c7ba36b336404b7ace89e0ff7f697f79dfaddc24ca
MD5 856da9faf3dc34970df29aefa7fb1385
SHA1 e466c650844a4aa5d5a627b531c4167291c9f1d0
SHA512 0a3a0627dfde1adcdca992b77ce37ad447ef9b7b367a92ab1ae653173d4b5e8b31011484745bb4c61a5bfaa0f9f381acf752bbdee63fe38a724e1af9c8820a74
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjwUL3aP0Le5ji0hmxNrM:x7iw2T7Pji0Aj
TLSH
T16D654A17B6A84661E073D174C5E6964AEA72B4461B3087CF02A8C73C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 902KB
SHA256 b26be4c86638d853711cbd9c2a26cf9c19b071e43fdaf20eb1106cb2cd8f55ec
MD5 703510e33767b71593040bd1ad77b48c
SHA1 dc8a478e0128adc581c9818973c4c15e99e4bf51
SHA512 ce9d25f4e5c43d5de05df5662c13933856c1e35cc3ee1fc903edc496a5ff84f4d80ffcc854809f4aa30bccb8c2964699d0e48f68dd082039a3c8c3b68ecaa5b3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aRa:t/sCv7rTiw2RYwZCUsjwUL3aRa
TLSH
T11C152A1767EC4895E5A6613089B58606EB72F8551B30C3CF12788B2D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 911KB
SHA256 28c6ee0ca2b693867c308393c405d9f2776fa7f4457cac190e12dbbbca776606
MD5 7d02ecec00acbfaee2ff09841ac85a9a
SHA1 0e2a3456266cb6d832f16b81bccfac08f20f3a11
SHA512 fd526da710bf6be60116a7e89b7b60553edaa686854cdf4e95cacf9d36d1ba40f1b981530938c0e1b83ab16948cca02cf2f396f020b74ce0412f1fac296154d8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3ao6:t/sCv7rTiw2RYwZCUsjwUL3ao6
TLSH
T17E152A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 911KB
SHA256 ac2904b29c282c4f88f5fc4aae66db6d9abb7798f0498d53cbdc66baa030ac3c
MD5 8630d90677a28f9c3af87b467c151924
SHA1 8d31c17003ac3432789f4dfcc02ed2b4b8e84c58
SHA512 41799ac2ed6b2b270e64fac8a5179101790fc05cd095e0a1f06cbf8a0d23f795ee649bfbc99c94e896dcd67c01bfa2d20040aa382a56b57bac36d72baf17f15d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3asN:t/sCv7rTiw2RYwZCUsjwUL3asN
TLSH
T1FB152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 911KB
SHA256 4026e7acbdd25489e88532d6ce327967e4fec3676c72a8da0f58dad68ed45d88
MD5 a61629fb4dba90da45dad0f168e4ab19
SHA1 b1300936225da4c70e8f6b0e0404d7efd178df64
SHA512 a146ed0a4f00f0e9b2e36f0693dd8b7bbbf2d164c954619280735f5bf98499dc131ef31afcd0165f98e1a9f166ab820a078f7271b40824081e317b6cdb1188be
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aif:t/sCv7rTiw2RYwZCUsjwUL3aif
TLSH
T18E152A1767EC4895E562613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 911KB
SHA256 81977a0cd307d13ce092e80d5311ec798e12615fd9c35cf42079c89b04ddf710
MD5 41f64e0ef2a6fef28fd8d36b042c9441
SHA1 a084d36b01bb3d03b95270469cffded1472f2a55
SHA512 99b9b671e7da84a3993ab6f60a54ce3291068d9f7e3db82a58e15e043fb3cc0e987572ae01eb30cc48d3efd18a1a14764de1be3c2373d3c3c9d4da8f8fbd0787
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3a8o:t/sCv7rTiw2RYwZCUsjwUL3a8o
TLSH
T161152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 911KB
SHA256 2c57897a1ead03a48c7fc643b7eac365ab91fffbee5aacd503b17e8c16e58e49
MD5 2c324837108c818c94a9a953205e7b61
SHA1 f1ead8c322283a4ee2e43ac5c5dd3a1817af3a7a
SHA512 0a739cddedf53dee034d003b66e1bc12c544313fe59753c08b056ed3ef9945d717a96fc4bb3c4e2bb82e51e903c9fb8a5593891c585e17073890f95b22e1c4a0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3acu:t/sCv7rTiw2RYwZCUsjwUL3acu
TLSH
T16E152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 911KB
SHA256 2f7075efbcbf0e5fac939f1494912452bdb869cf39cf6a559c841eaae4296a8c
MD5 66a1306403e2b9caeb897f8aae88d4d0
SHA1 bdf3730305c7ea31d149354c1d703560f76f059e
SHA512 1550d6aeb2ef6e1ffc8f48ae084e679b9f2ef94156dbacb5a865351a2b2387bedda78d513604c8082a3bafd2cdfbed1f1d3982971b7b628d5842416b78860873
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3ag9:t/sCv7rTiw2RYwZCUsjwUL3ag9
TLSH
T14B152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 911KB
SHA256 9e6df1c19011c9864fbc503c849e4525dc5615d151d6f2fe6fb4ed0bf27b7a74
MD5 ec783897a9e01530a6aac0a29c6e35d8
SHA1 3c2bb543fe6afdc1b59b40d34d208d6ee31fcb59
SHA512 ac64419a4e53e0aa3a9356fdbde848e3be0d1d0888d2a9d806812c8cb832f0d1d7aa261e031b55346a5a9489a84abf691d754fef525abc2f914581c592d5868c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aoc:t/sCv7rTiw2RYwZCUsjwUL3aoc
TLSH
T1AE152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 911KB
SHA256 dc112337a24f799c0e029c8b8c0b0364d92ae1317b03c5c4d2d122561d77eb4c
MD5 cdab833ebd4788d3eca64116944e6d2f
SHA1 6e32aef738b17e4776c167aeb1aa70b898b653a9
SHA512 dc0621f24185e7f5addebc0d2df302c94c1b0454aae7c1cab73995dd28d99b372aeb8c502048810b442959a010bffa4e13b8843157e76eb30f8be29fa09437a2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aBp:t/sCv7rTiw2RYwZCUsjwUL3aBp
TLSH
T106153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 911KB
SHA256 0824073555a7ccfeaeb07784a34390d9ed25ee6dc21932c93ae4df96defe68c4
MD5 30b5089289a2365aa2d46366a9a4bb22
SHA1 9bedb2c1d02e7f54f4fa8022768a24c56b45b7ed
SHA512 ac91b3cf7b3fac5b96bdc2a4c5f24b464b55753cd61640ee1c64f2c3561fe8a9ff33d455eb131544bd94ac55a4f5ea69946394cd7986ddfe2e5b9ca0cb92144f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aW0a:t/sCv7rTiw2RYwZCUsjwUL3aWN
TLSH
T194152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 911KB
SHA256 c304fec92bd17f3d772c118ccdabcdd3c257bb3142d7c1b1c84e8ef5f590c060
MD5 7fb8220319d914007095abd8e2da30bb
SHA1 c5891161ee406ef7a23edd248ca626da2896ac08
SHA512 d63867c15f7b749db1d1195823477a7001fcfc055ea8764230c2f7c849672865338793513e2113d1a2088ac90a606cb003ced2954832621cafdd6ec765bc2fec
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aaF:t/sCv7rTiw2RYwZCUsjwUL3aaF
TLSH
T1B0152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 911KB
SHA256 cdc5c0210c9ec446f133adbe830e11c7ceee88df1e61f7da35606e10d9c991c3
MD5 e771165c83212fd8d90678598ee1a8da
SHA1 355cf796efb51f78d5239fbc40bd61475c41e87e
SHA512 c0d9c6d9b7634cf129916ca13bf11c05ef78ab0425d2ab5da0fd62bdad60b80c6d80722f8bccfb1ae0c12eb4bbef83f551f6b32f0398412261ed1cea2c1f55ef
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3avC:t/sCv7rTiw2RYwZCUsjwUL3avC
TLSH
T12A152A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 911KB
SHA256 c2db4a0f037b2fade0cd1b1b6eb369f5be05d31d57b3d33331dbad48b49d3d7a
MD5 1246c196d5eddcd7b61115491c38633b
SHA1 e8640e532f90fd8045c05528f22e5f53dd6db757
SHA512 cbeabb132f57792f9f8e0584e3640d4b998cf25011fed9b29d0be2bb85fe77425f82eba0e82cef1fb39d0e5dab444082c2e2bdfc15be8e0cc2bca38a997c8cfc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aQw:t/sCv7rTiw2RYwZCUsjwUL3aQw
TLSH
T1B3152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 911KB
SHA256 b84c0acd37b219a63ed36731f35f7433a254513c10627fa28ee5d6c6e076efb3
MD5 f47fe118787e77c7552c57d4528f3315
SHA1 f08f5842b53c07999f8f91e681ad455be4329bea
SHA512 ff4082b7203c94f769f7ccb0e930b184b97883b8c0f9ca1126ad49c69b04e0584585c06c44853e1bcf25b9dfadded5dd7261f6652e46cb5b00c8f02f9c128c4e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3avT:t/sCv7rTiw2RYwZCUsjwUL3avT
TLSH
T1AA153A1767EC4895E562613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 911KB
SHA256 34bbe059949fec39be0f9e89deb96621a4ea1479ee92f43ce60171f4e22617ad
MD5 76f3f4a97259b7dfb8dab3fbd4c498ef
SHA1 79207ee7a53bbf9db8e435dc1827ff72afa4aa67
SHA512 6893ccea233bdd377c3e0ef1d8cd65de24bb21e805d714182bd09aa1ad4e51e6a0400107d3765711c498859887201ef9d75bd00317eff3621ee9bd7fc991d261
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3apu:t/sCv7rTiw2RYwZCUsjwUL3apu
TLSH
T1F4152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 911KB
SHA256 6853cfb52081f91040cb3a09120d7020c97527bb21aea4d1a6fb79cfbf93fa0e
MD5 a14cd245e1f90eb2c2ce053a6256d0c2
SHA1 c13eee3751a7ab073e1e085a4ea3f0a7238ddfcd
SHA512 ff35220b3b310937ccee685b1174de13a9ed8672c4a0826e2da64f7017ceb8cb9fe92243ba4a8d3a27324be8cb1f4c67f16d856b2ff540b584d121181ba14f18
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3ahb:t/sCv7rTiw2RYwZCUsjwUL3ahb
TLSH
T101152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 911KB
SHA256 bbdb18a4c90d4ebee629992c33328e0a6c549cb2c1ddf878761b0ba0f0895174
MD5 831b041e11531d510845e69f9f651dd4
SHA1 c6fb1d75d7192db964d1cf193eb0b3095e854f22
SHA512 f8321f3862ee237a6e110002c37b1c7f31da2c42911e3121947277e012fa891621f153e8b120620ee7346e6230b796783f40e403a0d1997193e3430dad1375f4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3apf:t/sCv7rTiw2RYwZCUsjwUL3apf
TLSH
T152152A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 911KB
SHA256 ebb05ade3a6daefa2e46ce8633b0244ce149397f9ba1831171daa2263f718f03
MD5 163e6f007727b990c6b474eede76ac13
SHA1 d34271c04c3e602b59d19cf2ccb3bc7452211d0a
SHA512 ad3e4f77b954bb512f348ab7796f7e3567de7f23621c76616f93644303c24deaf230ec921ef1ee40e0a9ce87b8b8057f1651612a8604c703df389c8a0095a4ec
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aSK:t/sCv7rTiw2RYwZCUsjwUL3aSK
TLSH
T12F152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 911KB
SHA256 2fcbebfe6b7a1651ea148bc8b4f36820c2536cc7de79b04b94017e83ed64d050
MD5 145de7279d0a1d8600c17a8286f0b240
SHA1 683eff8513eadc731a09cc8b5c08002b809cceb5
SHA512 e5f615d3d9196e3552922f157411431ffca6d9bdac5ec334554dc1639a7ddfcf3bde9b6ccde302c99fab9ff9849e76670c14bddc6e9add383bce9ed92f441b8a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3a3k:t/sCv7rTiw2RYwZCUsjwUL3a3k
TLSH
T104152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 911KB
SHA256 6e9631820e3c5c14d926ba4b9cba93392779eb0868794284927d7138c530bb9c
MD5 e1399264a25822189d3342db974861fc
SHA1 372ce6eeb9ac1c206d2fe6c00333fb5b8029b4cb
SHA512 9610a3b33860bb633c45cca9bfc4788d98ae1d68d2175c86bf1adbe8fa15b36640d31a6226cd809672d9e148d21b7da8ed0558e271f6d009122411e8c9409f65
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aA0:t/sCv7rTiw2RYwZCUsjwUL3aA0
TLSH
T111152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 911KB
SHA256 21d54949e72ee1effee8f7d3592ad369f7c5c1377173d7effdd555443e11c4e0
MD5 1cc8c578be7e87b68c92f8a7cc581009
SHA1 48146e2ad8ef7b6bb76ae5bca0773489dbf1aaa9
SHA512 7e79d05881e46b8864c398b89a55b58456f46dba5ed65d62a8730a2ce95c87a863d64247c5059d67366ea985221b6a5699500001a67e292ed37382d6f2d8c717
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3ab70:t/sCv7rTiw2RYwZCUsjwUL3abg
TLSH
T19F152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 911KB
SHA256 357d3867b9c149b2aa44078048c595484f01082555402ce67ddbac2afc83088a
MD5 f9ea72ade96751441ddb5b488209aa22
SHA1 871384a2b9789f912cbd4f3564e8582a51e5bf50
SHA512 73cc5309cb9369b20c476efc17bf2e15c4e23dcd8aec0502df78862cd728c875bf8147852d8b0eb318ac02741e04f853833d77041052b9326c14553d7ab218eb
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aWr:t/sCv7rTiw2RYwZCUsjwUL3aWr
TLSH
T1CC152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 911KB
SHA256 d084c70330863d65460fc03047c2f9f693cce178fffe3568106eb4543a4896f7
MD5 1622d3fd64c123b5c7ae20d8e812ad9d
SHA1 cd7b114150cc7a18b6dde0f43595e38495512a34
SHA512 66f8ea2621f5b65fa34a5ac27f93d82e6583837bc4fcff0003ca18c6ac1343bdb5dddebfd690107f980c4cbeb673b4880b9d6024b7c75c949c68814cd0c71f94
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3a8n:t/sCv7rTiw2RYwZCUsjwUL3a8n
TLSH
T1DA152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 911KB
SHA256 f3513b6e5c518dae3884c5342b1eeb6f4a8752bba076cc8343392896be6021bb
MD5 6817c1782cbc0c6bd4aff71c9854d1b6
SHA1 ec9635b583cd6837f35b6dbbc2674d5c10a69b85
SHA512 303b58f79dc26a757b2071f62c08bb7a3c53d960180287ff0c02c73d1e43c0edcc7701de9e0d85bef5338d6c80e3fb13dc08a47edfc649709bf748506019de9e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3a6x:t/sCv7rTiw2RYwZCUsjwUL3a6x
TLSH
T106152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 911KB
SHA256 c6181df508c6eb2986c9232fff1afa0587fdeb96ec125b7065e5e6123e60b14a
MD5 f8094a86267c17acb608cf765ce38aea
SHA1 0baef1734c3f36ac2193f68523e93569856eacdd
SHA512 440b9ea60c90a8bd120ac8b3da69e61855b603efe42b85a80277417e01622ab4c9155b3a5306743514efe115098880a52f2d13d86753b7f659c57796d05282b4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3a8A:t/sCv7rTiw2RYwZCUsjwUL3a8A
TLSH
T143152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 911KB
SHA256 2561419a81ef5c75312e7c305457ef08cf9c09c9332020e43059110e57e1efcc
MD5 2bd6ba8677bf26d9e3520d3cee3fa87d
SHA1 7927c6affa2c0559e09e68b599f6c0acac20b4e6
SHA512 a2f27e67e190d8edad46f80959aab4188bfa9a49e41a2d2d6fdd150842f56e1306375f70a0bf21a25535de4db515efada0232a51b0d60807610d9ed33afa4d5b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3al9Q:t/sCv7rTiw2RYwZCUsjwUL3al9Q
TLSH
T100152A1767EC4895E562613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 911KB
SHA256 c0c616de846737a72aa53e349110e878065ca05a45c854c556ddd921504f5917
MD5 0a8f46bedaf597964ea1d8b5f6976ffd
SHA1 583f4744c4ef1f770e79b5e397dba03add650aad
SHA512 e1c4f64546ec5e109009ac9205515d26967c3c7539e9886c395223cfbb3661cef20dc8e3fb2d5cde2bdcb41af7591f89bdfff636992bcfee2f70f67808177e5a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aQ4:t/sCv7rTiw2RYwZCUsjwUL3aQ4
TLSH
T17A153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 911KB
SHA256 8fa6850cc8c13b2250eb396405bb9773d2142910b8d05493b4793ef3522a16a8
MD5 7e0df0f917842c43a96691a08e1597df
SHA1 c310c5eacb2d09bbc631ddab596209547f4d8c20
SHA512 423f8cb8361c2596cd388524e6df064c665a94655798a74654cf7b4360b9633190e5b7339e3deb055c644d3955126c3fbef12dee68ef71b9d0ee390587c8d7be
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aTu:t/sCv7rTiw2RYwZCUsjwUL3aTu
TLSH
T147152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 911KB
SHA256 4428b4a77174bf28d3e0a0490469cca34a935b9f439b484079dc7dceba67fa3e
MD5 4fe161544e518bdd625066367ac30139
SHA1 c1c1edd9eaa201bd1a440a0dab23df64119ef76f
SHA512 c6afd7a4ecc3d5e9d0d8a42fef6fd911a918e5bb25f0c3c0495538b218d7aa41abbc079691de6d5f93b097bfb6e43c056209f656781ef62cc3aabf46fdfb19d4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aOj:t/sCv7rTiw2RYwZCUsjwUL3aOj
TLSH
T19D153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 911KB
SHA256 6a67055a443101aa51d5fabb4362eec4382de61ee599ca10778e764b0b80028b
MD5 c4bbd0b488c9b72031f75b511fb87f0d
SHA1 ea7a9c44dbba6c5796a865f825dfb1ee30a411aa
SHA512 e4cc7a7151ef1e0145c0e8a863af7bd0f0761904f39f44c914d3686398be1bbd7000336460de7c73c558c8bf93582802146e7be3891261feecbcab6424602356
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3a7g:t/sCv7rTiw2RYwZCUsjwUL3a7g
TLSH
T144152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 911KB
SHA256 9043819cce6dcdc0f0f7eef068932cf445b4e82d9eba0168cd93f44b2a094932
MD5 81a41210e47d850ae32c54789e5426b7
SHA1 58b2f0719230fdc18c20899ab1d8b6aa523c5d7c
SHA512 a21cd30c7e900cd0bed507ee2606fe9a7632bb7d17409599e00b5b46d2eaa4ea8962c0fd040a673afea43765423c0257596fc629e34a1a203dcdafd9854920ad
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3amI:t/sCv7rTiw2RYwZCUsjwUL3amI
TLSH
T1AE152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 911KB
SHA256 bb1766699448e6bb23083e4d869f8145dacfc6130b9d8b38b76387692290c1a6
MD5 107511cebdde5d3a611fe1105bb2e458
SHA1 149a4cb8cd27c8f0d64c94f4afddb2f1a4b0015a
SHA512 f67683bf96430a9b0adb423772cd9a57fd48f7784aa4656dcdf3083ceda4194ebd17251d91d769af1f1b1ce30592c15b755c8db121901a87506ab65ddba2eba4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aUo:t/sCv7rTiw2RYwZCUsjwUL3aUo
TLSH
T11C152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 911KB
SHA256 c59a8f297ec37bb3a0574c65c94d3a4f5080aa49d60526baf1c8ed784bb27711
MD5 61ea03f6df587014b0f0115c1117f512
SHA1 3c9f83deb6089f0ae30f8282f4c31aa19eb95603
SHA512 522cb34b8f1253b860b73aa291988609e5543aa8b1b704a7b9658e169ca626a7ac9db396a25cf4ea33697379adac73c1f984ccb82ad63deb7dbbfe44a5d8820d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3a3+:t/sCv7rTiw2RYwZCUsjwUL3a3+
TLSH
T179152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 911KB
SHA256 27c5d8cd844823e1a16aeb87469f934c55a0e75ffdf55dedaedebe40c3bfedb6
MD5 c683ed15d6627ac199d550252e115158
SHA1 b0982b88ced4e802645ce2d587c7d26b528c2909
SHA512 cd126038cf1263de58ee1386b50d283317766970362ca6d231bf52ee44a33d086bdfbeccf8a445052b2695e974a4f8b2fe30c451fe4be51245939485c38e639d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aNQ:t/sCv7rTiw2RYwZCUsjwUL3aNQ
TLSH
T152152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 911KB
SHA256 3ec1732c1d70f99b055c1675ef4665fdd1dc30327ed3034d77004d3f56fd86a8
MD5 053f99874c8f599fad89a3aad4acad4d
SHA1 dc45b761fac61e0c1914d5439f4c24ecccc81cef
SHA512 aaf6f26af175890255ae709cf255af190c8b9d4ba90c2d0cb5d635cdfe90f43f4f3f8fd45675c90eb57c104e783dc09c3ac80b4556ef4abc9afcdf4aeba01084
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aCX:t/sCv7rTiw2RYwZCUsjwUL3aCX
TLSH
T197152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 911KB
SHA256 7604423abdded79c449e110e612f5d0a7269452f3e5cef8c90a4bbdfed5c90f9
MD5 3aacf4c5a0b1001c1a4258b3f5ee4da4
SHA1 b02f457df481f2ce94c53dc4dad752886a4eca48
SHA512 ea83bec9c201ba0c25b721e5bfa426621fc3df7bd4384975598b6128a6117d1253a6a8de35a0776caf11f0c971542a93945353ae24a1a3b6d88b39f514bd905b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3akL:t/sCv7rTiw2RYwZCUsjwUL3akL
TLSH
T1C0152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 911KB
SHA256 852bfa6cc657b0e768f5fccdd92dfc931a5e981f749e0083b57f6633225189da
MD5 51aff6725c5bf3e334dfefbaee256fee
SHA1 be5e9b0b083e9eaa7ff5f07a82d74be3a3ca63c7
SHA512 ea89654be8b0d5fab3bf3020562f7c0ddf956098408df57a4fca36b68a4485be8f2dd2ec495740b82180569958f65f2c57cd1333c2a553d8209520ec3e18226e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3aAFC:t/sCv7rTiw2RYwZCUsjwUL3aAM
TLSH
T152152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 911KB
SHA256 33809a3ad247996150fdadc22089f2a12e8ebcdfff6b6a887c548974c55b8ccd
MD5 b078ee838f6707baaa56b7e9d27e28df
SHA1 e54852eb00b12c5fad230b096419387c063a0095
SHA512 4c70186cea113d689b9a2d98145653d6698435db53d6c6c767bd98855f77f12996b2efb0fc8e890e8715ffca820280fce6ae8b64df2ab4411852409379b0f556
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwUL3ahh:t/sCv7rTiw2RYwZCUsjwUL3ahh
TLSH
T18F152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1784-166-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1784-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2980-167-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads