a503b97a5dcd165c94cf15cec0d8b483f5e3c83e4776c79d88a3de57749a79c5

Analysis

max time kernel
112s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 902KB
Sample260715-rjbcdaes5j
SHA256 a503b97a5dcd165c94cf15cec0d8b483f5e3c83e4776c79d88a3de57749a79c5
MD5 68f9be4d2a7211d63734cbc015cf81b2
SHA1 cb06cda5f6aea85aff8f9dab61ee1a5ec9813474
SHA512 b6874eae39bd5c5a9a6a896a36c89d71da886354b7453f71c1ccdfb0c7e2e56a983553c90d7794cd8240bda74fcfb7fbb63f728b962d0d74627b5a37e3e4a2a0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEa:t/sCv7rTiw2RYwZCUsjKp3DEa
TLSH
T11415391766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5704-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5bb-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5704-15-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/824-16-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c8a-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-227.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-445.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-567.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-616.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-752.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-796.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-845.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-870.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-909.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1084.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1152.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1405.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5bb-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c8a-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-227.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-445.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-494.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-567.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-616.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-641.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-732.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-752.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-796.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-845.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-870.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-889.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-909.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-928.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1003.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1084.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1152.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1330.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1350.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1405.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
824	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5704	2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
824	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_68f9be4d2a7211d63734cbc015cf81b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5704

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 902KB
SHA256 a503b97a5dcd165c94cf15cec0d8b483f5e3c83e4776c79d88a3de57749a79c5
MD5 68f9be4d2a7211d63734cbc015cf81b2
SHA1 cb06cda5f6aea85aff8f9dab61ee1a5ec9813474
SHA512 b6874eae39bd5c5a9a6a896a36c89d71da886354b7453f71c1ccdfb0c7e2e56a983553c90d7794cd8240bda74fcfb7fbb63f728b962d0d74627b5a37e3e4a2a0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEa:t/sCv7rTiw2RYwZCUsjKp3DEa
TLSH
T11415391766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 94e2f0ce19c8bf76424bdb214616fb61a29621523b6beb9e06606d69ad6059fb
MD5 f5463748fcd94a0590663c9eed9d47db
SHA1 e5c0502a8b1dda3ee2d2aa592ee2d927d1c5d630
SHA512 d0617bcbef1f87db2394c50bdf56888dbb504df86a22fffb7b90075c929880c4122ce335538ce966ecf52894dfacc1e56c3b6d2afff8b51f7e1596573e1ee0a2
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKp3DEaP0Le5ji0hmxNrM:x7iw2nPji0Aj
TLSH
T13E654917B6A84661E073D174C5E6964AEA72B4461B3087CF12A8C73C2F23BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 916KB
SHA256 a9466a86afe858428552a9bb65f34d44e9ceb1d49d2bb9c237d73843ec1a9785
MD5 9e9c24e416c4eb63b17470191427dec8
SHA1 3d7abff118772a8ae1edd1227c505ac9000c8227
SHA512 a3e4a1e75bb6445163a7bc264d0da0dc8da2cd76b5e7eee68c898bce3b9a768782fae5c24242f9159ef41b4165a069eeeedc670f42e8ea87032c6af8b4a5b2f1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaRa:t/sCv7rTiw2RYwZCUsjKp3DEaRa
TLSH
T1F9152A1766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 949KB
SHA256 280891b0208a7780f9c0daf7e67fe7e780ee3eaca9e40bbe6675a1068b0da1c9
MD5 99cdcc9674064176ad06295fd3e66cf2
SHA1 3aa42c23201b37186a9011dcb90ea48c7f7c0920
SHA512 ad40ca60eaaf068d1a6cc5662dad8882308aea71d2ff0a6418adffe44d1da3a28ae3e49c3dbfe86ee7f476e2c9f3e3db4ddedfd36d9945058a984ea18c91b562
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEayb:t/sCv7rTiw2RYwZCUsjKp3DEayb
TLSH
T1B025391767EC4895E5A6613089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 925KB
SHA256 7693a6a81955696b40400efd904c35e6654b3bd46e10f578d785d6d7678e5aca
MD5 2c4c27382741ffffcc0c4ca238c8d7d5
SHA1 652181d53c313d907397d68d6b46f0959f50507f
SHA512 d250a6650d330ca7ff9f1f9d32391fe16512630165ee6f758cca9378e2c9eb5a8d9003965eadc8857c81b635a30a3ce3a1227e60188911f20ac07c5249fc40bc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEao6:t/sCv7rTiw2RYwZCUsjKp3DEao6
TLSH
T1ED153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 925KB
SHA256 e127da752421f654bb32673c4667cab918ccf4c46ad026742fcd569656965c5a
MD5 85131e1c2cc6d1e2fee58c32e66d8c90
SHA1 50b8938b5de71021ce70b7eac4c52e0a6f2cb62b
SHA512 50f8d0492aed6620af292a41d6e7ef9fdae6f2bc1de5fae6e36a6bfbc33d53c0337196b320541fb620db485e4f82c9f7ce5417627cd0961062eb66b84a3dc405
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEasN:t/sCv7rTiw2RYwZCUsjKp3DEasN
TLSH
T105153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 925KB
SHA256 5ad2a9bbf42e46ff47c6ffdfb5e9ec03cb16581410915a168ee62c72369e5500
MD5 ec4bfbadf454aab86e2c7a45616cf2af
SHA1 11e106620f6232f4c2b14dc63679c4387067c5c5
SHA512 6f03eb928b47b314eb96825825cfac172b8640a7f29260de89293dbc191e2fb1074859b231a8e3bec7d3c919ba3a349e92bc2392e698b357d30d504b8442bf82
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaif:t/sCv7rTiw2RYwZCUsjKp3DEaif
TLSH
T1ED153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 925KB
SHA256 c72320826fdd20c2037aa8b0ded3794f8873d0e6f12673f851d9a4d1703be65b
MD5 8d6b8782dc75507eec7f8962ee696b08
SHA1 39efecd06ac2998b19e935b1c18adaacd3664e68
SHA512 46dbdec00b843a8c880ea5e1e13e3b8f2c7be3f3f21da5e1568b123c66d26382d04df26964bbbff157269da6563b0b59a26581ec9777558f7462a567951db529
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEa8o:t/sCv7rTiw2RYwZCUsjKp3DEa8o
TLSH
T134153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 925KB
SHA256 34bb20cc4f19af2969a064fa59429db2016d09759c6da814211258d0e2322caf
MD5 4146e923042043ea61c4fd9322f0cb59
SHA1 0b49339b4b2f44a28e9d58313baa74520aea822e
SHA512 3ab9911a50af3eaa384dc1be4daa3edc3e2f06bffbad3f57c87e6c5073c41a52b397734cb872bd55b0e3d95552effb39287aabad63e716b6815998160534a277
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEacu:t/sCv7rTiw2RYwZCUsjKp3DEacu
TLSH
T135153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 925KB
SHA256 14012b54372bffa201ed3b472ce5f67d8076c3b82be575e2f5da98f7d66481c9
MD5 52f38ccd8dbedad096b60e79d08b4295
SHA1 838034321ed1376d3017e5d5986d52adbcf6d2ce
SHA512 0c301f70fae1a95a4377e8903c4edc9e8e9dd6fdb470b96fafecf4ee06053d54dfc67e614f82b3c64c44571e2dbcd82a3fda1d2c57e5dba5b8c78bdd395b6c5b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEag9:t/sCv7rTiw2RYwZCUsjKp3DEag9
TLSH
T1EA153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 925KB
SHA256 ad924d1d6bdefac07b5060ea2aade8c176b565ae21fb5db0b6b488fdbbdb4721
MD5 1840a407076aad9374d07d1de5681e9c
SHA1 fa5dc186d1d50170f753d4ec03645653ccf68837
SHA512 d994bdd631544228aec2143262008460bc5c8f2ed611527cdb6b898c52a32031455f4a7c7f56591dd52a97c9f7dc874a9738abe44a0c3bc81a524d0cbc61e021
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaoc:t/sCv7rTiw2RYwZCUsjKp3DEaoc
TLSH
T1BB153A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 925KB
SHA256 64f98c29f3e8104c72026dd43aecf2c2abd8125effe767779d730c2de735be3c
MD5 7eeba2fff13f4da59e4c00614205f8c1
SHA1 eb2289cdbd964777e898a254d5efe26656663776
SHA512 04d3df0445934aa9e15e811cd65b782babf6c9e693ddaa981f2ed77e265f7a86547aec6fa3af9324c6681c50b8af769e3802db7bd861f3788081d6be9bb83324
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaBp:t/sCv7rTiw2RYwZCUsjKp3DEaBp
TLSH
T199153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 925KB
SHA256 f9a1ff27e8f35a0ce9dd480eb669e3b4064552f4095fc52f54f488212e58c7b2
MD5 144e508aef193b214641c4757b5c444d
SHA1 29978c89dc099adc60b6047709e287b30519bb46
SHA512 aff067ec38fb44a0153c98315d1e9596c15e24a7e73bfd41f6319bb052a5097d7572973e51d28cee542d2f4837c68e0956663da7f11915b5e009bb37e2b2ab25
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaW0a:t/sCv7rTiw2RYwZCUsjKp3DEaWN
TLSH
T177153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 925KB
SHA256 1a3712ef4b35cf0ab43b49a8c2fafe5d462d02957c0d9769054bb0b78eb3261e
MD5 131fe0161fb1a989b3d68c768062a26d
SHA1 3f5afdb8fb7153553564c319b7402fa0e399e670
SHA512 2bed8f5e06d634b5f763ddee4ec4292a70473a20f9101006121f6164a26f1940c42f1f6d7499153f9b5ecb95937a8b74e79f72398dc4eb83378dd84f09e7d6b2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaaF:t/sCv7rTiw2RYwZCUsjKp3DEaaF
TLSH
T1A7153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 925KB
SHA256 a5749a9ac3dac1ff71b77deb92a6d6a8cd14c05f55181f7e05d7c67e6d42a331
MD5 1223aeea3e1265b3f7cf45cbc3d9a2d9
SHA1 f43dd91b019e70b3f29d2a79fa781f4692163c0e
SHA512 9da2900436beefb61700ac44405b314d922cc6cc22be1e96580f2d60be4f602dae4530bdf012bc6cb8efdb0a62497d67f8210cc9f2e51242894519b490972626
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEavC:t/sCv7rTiw2RYwZCUsjKp3DEavC
TLSH
T119153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 925KB
SHA256 73b08219e983cbff68a47bc8227b3a40510c805fe0f56de9dd60421a0f7c7962
MD5 ffec0d3582904da50a4788faff46dfb6
SHA1 f3042fdf7a8bd99150694e0e1fface7401dce03f
SHA512 74e027020c2e54e0560d8b4610bd81ef9780c694a9d2a0958ca832e9314be63ac9e2fa85d23a9cfd6aea7273bdb614c6766aadcb98508b548df98e3f198b342f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaQw:t/sCv7rTiw2RYwZCUsjKp3DEaQw
TLSH
T139153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 925KB
SHA256 a64d901695d975400bd85d9ad403d9994a2b687fbf76b3eea613fa2412c653b8
MD5 4bf3858014f7873d559e1353d6a26a12
SHA1 89c6f2c4bae21fed8ca08ea3c041c0427d2a9f54
SHA512 a2d8b01d49e3da8f74efb05123c386ca10f7db2a9fef2baa56b1990b3f77a669ca9763f8effb53f6f6e2e8c0058f61afdfc4df83510b6b64b6ece8df31587e8c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEavT:t/sCv7rTiw2RYwZCUsjKp3DEavT
TLSH
T161153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 925KB
SHA256 4c46f89de2797238b40a718ace3ae5df6fb625fef5cbdcb48c70143cd3c2d5f2
MD5 c850b5cfe40750bd60865eaf2da5929b
SHA1 42565ce24edd0e11c89c85bcd4d271dc19cc5312
SHA512 1ab4a293cae0c1671c43e731e9f59472c4e94f663cb61dcff9aadf2b1b2ee95ee0c2e7db367ba1ea9bcf65499d8ce1234be555c381061d8e41018bd1331513c0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEapu:t/sCv7rTiw2RYwZCUsjKp3DEapu
TLSH
T18F153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 925KB
SHA256 1a94213f8bd9a9b6711b96287f9a03ea6c87a8098ab4cae76a49a585dfd7fba4
MD5 61dc7a69486103977d945f39e3a349d8
SHA1 b8283109e0598caaa7d5ed1edf0bfefa780fd5cb
SHA512 2a2dc8f25eba1fa8043ab8d6df1d8fafb9ee43f09a8627570f5fb30cb01969ccecd560defe60d69949d64799baf4f6dc26a207c51bbce376e4173fc2d07febc8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEahb:t/sCv7rTiw2RYwZCUsjKp3DEahb
TLSH
T127153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 925KB
SHA256 ec14746b7f202d1228d64812b79acd42db88a5b80db0e958c51eb4d9077aa74f
MD5 40f81234ba6886121582b1fda2dc1da6
SHA1 a9495ab6d3303b4d410019f5e7647b4d2558ed1b
SHA512 0c63528d49114c0df3260ac87805f98b66756b099e8177dcd2eef75da83c8eb2ef73303df047fad57419ec97173d4c382b11e72c40d78e59baa52c6806d8641b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEapf:t/sCv7rTiw2RYwZCUsjKp3DEapf
TLSH
T17B153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 925KB
SHA256 680733d398271414faf97f37059ac0b1de91bb0ece7b59473e07a051ed5e33d4
MD5 44914340d8204a7dba28409028fc0095
SHA1 9880453255047c5707189bc3911bc9f98b6055b5
SHA512 01436270613ed344cb59c75be62ac776bf413477c8bd4b55a068e6dbf5ab0306c14c554325131aa7b06c279eb273893292a488ae2c4846f4b26aca998b1a8c6f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaSK:t/sCv7rTiw2RYwZCUsjKp3DEaSK
TLSH
T164153A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 925KB
SHA256 2f775f902b3aa86f4d03e9f31750ad1bd9b8dbc16e9620645f14f8066797e86b
MD5 d9c3c540a15cd89b3096704cb7537ed2
SHA1 c5ae7d9f7ba5c70f5322a2a895e347cb46cce790
SHA512 7954feefeb3f44bb38f54cdcbdc4e96d544bd620571edc49536a9af214f4f9df6e4297d857503f0f42a3741933d310af983236f77d2d38288391bf41df20d7cc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEa3k:t/sCv7rTiw2RYwZCUsjKp3DEa3k
TLSH
T142153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 925KB
SHA256 aedfbc51493e48725207540cfab97818406dda6290704baae2a498fbe96279bd
MD5 e9c92627b41354528e3d0a2761e0dbdb
SHA1 4c49881950059751eb92518a38fbbc98512fe593
SHA512 c55724c6f4f28d0529feef503696aec3100c6c8ebbed2083947b144ecda67f773fef657760043813d2a412537fce1ec590421a4c9a45a43ed594ef306de066cf
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaA0:t/sCv7rTiw2RYwZCUsjKp3DEaA0
TLSH
T184153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 925KB
SHA256 ff410d4d559f75bc5d43f523fab89a93bc76e63d57cde4819df410a68ac71786
MD5 5b026f2890df0186210fbdb02964ed0a
SHA1 0b0dc162c2e9f385dbd2a7c28f45b5e1d8c10f24
SHA512 2bae67b70122d58c4b684a8a628a46be0d0baeaadba04e24e54e7857240e869d8f1b17675de1b483c87438e1c1f6f83be907fd6574652aae832d994617a7e96a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEab70:t/sCv7rTiw2RYwZCUsjKp3DEabg
TLSH
T160153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 925KB
SHA256 2c2f5cb47c841273741bd06c3b54fe473403e61a230c7b7c6a5eb18ee8d20e0d
MD5 822a656680b75bc6ed530f048854a2e8
SHA1 00de7626c06f10509740c0c4e6b6388f790c2289
SHA512 418d188a4b7431649b9dd25ee4e2aba15bfccb777e5d87683fec6a41879560c5018ea5831a7a99769b058d15b53cda8b7ceb910c71141e6d1ce70e7a17317436
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaWr:t/sCv7rTiw2RYwZCUsjKp3DEaWr
TLSH
T1F2153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 925KB
SHA256 6f07e9d8a2aa4a3865b535b4d4b777854ef39772a12da587f21f5abc936fc1f0
MD5 44f41c0fa12d37d7e2c36faf45625b06
SHA1 9ee18f2992c439349856cff1bbdcc772e36c8e0f
SHA512 07529f8d1c613471a5449c1c8053e5122dc50ec690af46556dc69057c95f14be6b48f1590640e0caa4fccbb5b3f3a7bc254ce6f2ef6294961beedc7f0ec88177
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEa8n:t/sCv7rTiw2RYwZCUsjKp3DEa8n
TLSH
T19B153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 925KB
SHA256 195dac0ea458a9574e0aefef6308d8676056173b3b1d46a9e2e244f015990ab1
MD5 f97cd0f9de6eb8378e7ee1edb5471b78
SHA1 e2c70eda3988587094fb0b3e1c9b6483c176b421
SHA512 72dff9bc34f528e2b6e40f0861058852f26e14e50c48e0fbd2d7c9aa3f037b8c7deb9d14b933917025984c2da371d253f66ff7a8cdca7b94119058869ac64d9e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEa6x:t/sCv7rTiw2RYwZCUsjKp3DEa6x
TLSH
T16E153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 925KB
SHA256 e06f65ebbc619d509b31c66489365c3ffe68fb183d2aef6775643949bf4b1c61
MD5 668458b6662d54b575dc312115d8ff68
SHA1 e50ee73ff25d3492aed764212c4bff3272cd751f
SHA512 f78ea68293ed771e7c19a9ece94a371b6ee05c1334a18fe7f90369f98c346bc13eba33fbb1a4755c524c4e6c0118369c3c473e8afb8248190bcd748e434f56bf
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEa8A:t/sCv7rTiw2RYwZCUsjKp3DEa8A
TLSH
T141153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 925KB
SHA256 6bcddba2547db9831ccfbbd07a0eda752c4de4b56c35c9c2f097ef9aab2d3aa5
MD5 5e171291d4b2722f279e5418cc8dc14f
SHA1 25d87e16cb9bccba99000c1cff9a16d3d39e17f5
SHA512 d9b55e7980ea7685205b6d60374d329470b4e49a102f5f01a829ef386a540341c36806d030d0d3dfdcaa6909de2f7ee4e48bc655f33a28886ab1176aaf042a95
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEal9Q:t/sCv7rTiw2RYwZCUsjKp3DEal9Q
TLSH
T12F153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 925KB
SHA256 054deb026997787c7bfbc01ade3586b1f6880cbc85526e891b550c12a0b53389
MD5 2e46203e147b3aedf766ce8842951ccb
SHA1 42befc07014f00014eb382c3cc3366b878c3e629
SHA512 595dc6e6175f46f410d39a23412f519b9a91c6435e847873c35c456c2043f88f719f875aed524f3c9ffba1d4825d103502100d45bb13479f52f258fa5c9b036f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaQ4:t/sCv7rTiw2RYwZCUsjKp3DEaQ4
TLSH
T1D5153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 925KB
SHA256 7013f3f9aa95fdbd631face13880e8d8ec0db6e951f9366d58c3338ecf7d8f1e
MD5 03f27576ecbf08f67d0a6762780c6278
SHA1 f4436fe8311e201d32c9e639763ae13c486e4e8e
SHA512 6efa0ad50b56dfbbce04f6588eecafceb6584237def40f5535bd14cab44d294a624ee3354b349661f8aece79d9e05c55b55dfb808d5f52748bab6465662b78b4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaTu:t/sCv7rTiw2RYwZCUsjKp3DEaTu
TLSH
T1DC153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 925KB
SHA256 3a015cb311d9641f00530750501e79a3ce4d187ef7b3203d773d9acbcc81e6f5
MD5 13a33a103ad87c749eae8f3c3f7495a7
SHA1 52a4771ae4ccd8c2e283c3c90ad62d09b2f0ebd2
SHA512 32c5fcb80cef76ca2bdf666446daf65ae6a539f7eba149fc899d03a8884630951e146dd2093329b22e07248e6e4826a53d4e7fa84f4a079deeb4eae887ab8036
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaOj:t/sCv7rTiw2RYwZCUsjKp3DEaOj
TLSH
T112153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 925KB
SHA256 61d0bc532da3836b517ac218ba1781f910c14b47d75640e94eb9327908b4a844
MD5 0ea73b22452933d1bab1325d7824179e
SHA1 8726f572f0787b51e7a00da997c498b387dffc96
SHA512 8dbf60b78a7efa19209fe0a1c0bce26e3ea917b8455147f3fac5b8862182475d6156d0483957ebd651e27309020bd7cf8b45e8bb4edce183326b0e8467c934f7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEa7g:t/sCv7rTiw2RYwZCUsjKp3DEa7g
TLSH
T16A153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 925KB
SHA256 f0d29692954e43425f3894747648ac857bc6aab72f01e767bf28db357de0c90e
MD5 2182e29bcfaa29a037e273925965c962
SHA1 882bd98232a0576071254944108ffa4bb7e77a97
SHA512 5db82e35195238958a16d8511740e7a33a7648f53b16e95d344f3841c82a57820ebe60e24d35406d61010ada5d90de481b25d3cdf159d257f979d4c318467989
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEamI:t/sCv7rTiw2RYwZCUsjKp3DEamI
TLSH
T18B153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 925KB
SHA256 e857deb66f001c7030992a3f1d192bc39b82a70f91faae6c161b896ca6c736c0
MD5 b47c9946d1c09498da08d7d8791227cd
SHA1 de12a0108f677aa6550c868d075496b0ef9dac69
SHA512 c9a815fc8e09d9f1a453f0df1ff37fd16d2ce60fd90e974faad6a0806c3311a8b1de26f447fdd17e408f05d37652a1f916fd4056ff827dd3f9f10bbfbd2a3531
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaUo:t/sCv7rTiw2RYwZCUsjKp3DEaUo
TLSH
T144153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 925KB
SHA256 6177f4bb77572791f4774079a5655e43ccde66cd97a05a31741adb9a8e2ed017
MD5 74e519a127b732574d86900edbfd68b3
SHA1 70eda4378d3bfa8b3dbfa817ae468974d68fac3e
SHA512 99902f069185609b12f79e9800b715e815fce8c48a2f56da9a11bdf98713ef251f4d199566202c1c32ddaf7619472c9c8360e4b4ff29db6995b93ea5c00ceee0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEa3+:t/sCv7rTiw2RYwZCUsjKp3DEa3+
TLSH
T1CD153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 925KB
SHA256 8facc45f4e99780a2e5d4c9df51a15d86f2445f6d933cac4cc232182c64ff66c
MD5 6830f7ed41264b11f5c5a9c4fed0bca3
SHA1 a5eb1d8a57ffcd40366593396f52dbf3d0b89126
SHA512 5c4af1e546be7da8de39352a9ec90e58083f9c438c7fd56c53518d40e9566b8e4a1c2e59a3dc65b35b569f82548d1f62d46baa56a9a538fcbfdf2f25e021215d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaNQ:t/sCv7rTiw2RYwZCUsjKp3DEaNQ
TLSH
T192153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 925KB
SHA256 4bd62838dcfbbe975a578e8c0b751ef91cf6bf089c9ff2964e109e13c9ac9ab4
MD5 e707191b25c513883ed20bad38b6292e
SHA1 e77826bc03cd9eb965f60dc726cb4ed86a5d595d
SHA512 0f138a9c61a2c6abd50d624ba137ea8cca6bed8273acdab5cc1de283f888d4ec7215dfd532922e6cb61bdf452781a4dcca19cbd1f8432190ff1ef8689617b7ee
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaCX:t/sCv7rTiw2RYwZCUsjKp3DEaCX
TLSH
T1FC153A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 925KB
SHA256 2180eeb5fce9552903ba22d4d7ab15c4b607379af7818e410ef5576f682a1122
MD5 3a85ebe91aaabc3a7d8b68f7283fe1d9
SHA1 2b81958dc2ee549658b93edee2defb8b43f8bcd7
SHA512 9eae18164f59ab9fae1b9571a7db20ded073b8753f4f12b3ce7dfd119f6f4c3e1d32475e245ccb70720a57cdb726d78e0d4e05298715eb2db1f570b3254e4344
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEakL:t/sCv7rTiw2RYwZCUsjKp3DEakL
TLSH
T14E153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 925KB
SHA256 8943bbd4c9f5ea00b7077a4e0b02a8b9050745e94ebf7da82313954de70efcf7
MD5 bdaaa43236a858071aa77d8fcc2302d4
SHA1 c032ca2dd68ada3d0e55f6981dfccc12ba907f00
SHA512 10ce8adeefccbeae7f58f22dcc76ba29288b0e142afe842084d7f366db962eb906cb98628cfd479fc3c0de4b432db79d1d77f3ac19bbc02bb6e0e9b14b125ea8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEaAFC:t/sCv7rTiw2RYwZCUsjKp3DEaAM
TLSH
T132153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 925KB
SHA256 fb6b1ddfcfdc04fb529bb83414b18e0d2d2690226972cda5be545fbd87fe0bec
MD5 1cc659f0ae586e1119961d81dd6862b4
SHA1 e8288029c84397966f9951f7665b1d0228dbed7e
SHA512 b8b1ff1e70b1143245267b7327dfa2d8f3c6d543fa05987b77ccf1dd7f03f0d7b3ae3a62fe9496549c6b76fa8ff278963f87f701490885881acdb15689aa9811
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFP3DEahh:t/sCv7rTiw2RYwZCUsjKp3DEahh
TLSH
T1B1153A1766EC0895E567A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-16-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5704-15-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5704-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads