6c4d501b10512e1fccd6a59c6712d75f6f370cd355261ffd28495c37e0bca640

Analysis

max time kernel
106s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.1MB
Sample260715-dgtt2sav2p
SHA256 6c4d501b10512e1fccd6a59c6712d75f6f370cd355261ffd28495c37e0bca640
MD5 42b8ff79f2ca32461a78fecfdf16e183
SHA1 f0e01121e37c84e8991148a0a1c74a88f4e6a681
SHA512 0d022fb55e54ef7767934ec217413bb923103ceccfa2863250f9e99be6b7f7ef31905e62dfa69366c2fa3b6a835129d425161debf794f8cb3fb154ae2b9c20e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoTTicxSD5TvinrmC:A3k03kHRJS56rX
TLSH
T145457B03A6980FE9D11F81749A964662EA777C125F2093CF1354AE153F72BC0AF3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4144-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000700000001b6f5-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4144-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3280-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x005f0000000184cc-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019de8-1022.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001f0000000188be-1287.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000700000001b6f5-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x005f0000000184cc-741.dat	aspack_v212_v242
behavioral2/files/0x0004000000019de8-1022.dat	aspack_v212_v242
behavioral2/files/0x001f0000000188be-1287.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3280	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4144	2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
3280	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_42b8ff79f2ca32461a78fecfdf16e183_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4144

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.1MB
SHA256 6c4d501b10512e1fccd6a59c6712d75f6f370cd355261ffd28495c37e0bca640
MD5 42b8ff79f2ca32461a78fecfdf16e183
SHA1 f0e01121e37c84e8991148a0a1c74a88f4e6a681
SHA512 0d022fb55e54ef7767934ec217413bb923103ceccfa2863250f9e99be6b7f7ef31905e62dfa69366c2fa3b6a835129d425161debf794f8cb3fb154ae2b9c20e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoTTicxSD5TvinrmC:A3k03kHRJS56rX
TLSH
T145457B03A6980FE9D11F81749A964662EA777C125F2093CF1354AE153F72BC0AF3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.7MB
SHA256 a49269bf030b70d1f2c9e39dc91930a55436f6f80f3d81f2d6be03b6d1b77771
MD5 64c5974f257ef2b6d15bd66457211b21
SHA1 2766f8cc80b5cb550ccadac528ac4750d77ac391
SHA512 a1d634b541599f59c20fd04b3f11059e8b976044dee1b509c0613a71d089f1acd2fc3584bf6bab2dd9fc68afe2d30877a8944f7b19117e3afd9d2a5c4f3814b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoTTicxSD5TvinrmC0Le5ji0hmxNrM:A3k03kHRJS56rTPji0Aj
TLSH
T125856B16F6A44BA5D02FC178C5D2965AEA733C421F3087CB1354DE283F67BD19A3A362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe$

Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
Size 1.6MB
SHA256 19bb20e7b04e8d1c15b99ac58d756c303fda23daa97bf20d0912f4e4622306f0
MD5 03a3772f0951e9a35a9dfd94072d9bb2
SHA1 4557a5cec3b6a79ec0330e37b908119efa757745
SHA512 5e682e43f172280a1725d2390540ca8de16af04536452c1a5f61e6e5a75c424873d4f60055a6e43628a52a27d623986aa1702369869b2fa5002383e8c66a7fc4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoTTicxSD5TvinrmyUOlZ7q/c9:A3k03kHRJS56rjUOlk09
TLSH
T1AC757C17EA584EE5C12F817896968612E6737C120F2097CF6368DA293F337D06E39B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DW20.EXE$

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
Size 1.7MB
SHA256 9ce139e66b462237bcb9a4162462106eb789ab48461fbb7a3327c2c24de355eb
MD5 b22fd404bc3aebb0ff8c8829f21177b0
SHA1 e38d39c22630edb780e0ada11ab0ef4aae0d75f9
SHA512 342afb6192ffb298d34c1dc9e073aa1d21ac8fd80498982956d0b0c2a746be494d9137bdff2624afe23ac79719b24fdf5ad369be60b8674771767ddd1020bd92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoTTicxSD5Tvinrme3N+tCn50ChWdAr4:A3k03kHRJS56rB8tDZqrKV
TLSH
T100855A16A7A44BE5D11F817486A68672F7B3BC411F2093CF1354DA2A3F336D06E3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 1.2MB
SHA256 c8f570c827c28ab96891e59a02ba0dcf8a915755bdd161c5a851b55ab3391b0e
MD5 fa7112bf08a2834c84b608bbd3fffd30
SHA1 d5feadc546cdb78908569b320b38854f0ba565fc
SHA512 289a71ec1b2678e9676788b4b10244119f213631bb012c783436051cddc58c57427efa23d2e8f1d62b0d6482c135ce2993f156c1c996883f2687492aad98afd1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoTTicxSD5TvinrmgF:A3k03kHRJS56r9
TLSH
T1B4456A03E6950FA5D24F813499968622EA377D521F2097EF1368BF253F327C0AA39357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4144-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4144-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads