6a72538d5ae95f7d0077284a30ebe412d41b050a373ac52395146f2256567e03

Analysis

max time kernel
104s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260720-qc2ejsdt4x
SHA256 6a72538d5ae95f7d0077284a30ebe412d41b050a373ac52395146f2256567e03
MD5 6ffa26313cd2a15cf95daf22c75467f6
SHA1 95d056c49700bbc0343671df723a476c8149df9a
SHA512 77dcef527440e658522defcb020aecdc696f3ff704b731a3ae4c37f3e6194c0fda28f49d84834ce3f8c84a4c3ae922fd1bf24b8b7845c1b80d7ccb039808afa8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasN:A3k03kB56r0
TLSH
T188157B03E6850FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2040-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c52a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2040-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4316-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-680.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c52a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-680.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-974.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1008.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1217.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1321.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1373.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4316	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2040	2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4316	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_6ffa26313cd2a15cf95daf22c75467f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2040

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 6a72538d5ae95f7d0077284a30ebe412d41b050a373ac52395146f2256567e03
MD5 6ffa26313cd2a15cf95daf22c75467f6
SHA1 95d056c49700bbc0343671df723a476c8149df9a
SHA512 77dcef527440e658522defcb020aecdc696f3ff704b731a3ae4c37f3e6194c0fda28f49d84834ce3f8c84a4c3ae922fd1bf24b8b7845c1b80d7ccb039808afa8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasN:A3k03kB56r0
TLSH
T188157B03E6850FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 10ed4d5cd6a9d080e6005187a0b036bf5192d3b8a1babea95c198555402a94db
MD5 9f2b79307e87687d06b110d5080c1d74
SHA1 0a5f278a479823ebe0f3f48a4f42b991f0050e51
SHA512 14768e20f6f6c35c11b6b3a876dd722647e814bf7e7954ab69be3e2e51c8a3b568b9be3e79ac2176ade4b2ecf8f6df47e67a6dc22b9bd8316f679a1f66786500
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasZ0Le5ji0hmxNrM:A3k03kB56rsPji0Aj
TLSH
T122655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 938KB
SHA256 99262ddddffe8cfb2c751c7575fe3857cf8d87a1619ae81f2be8ece3a8abb164
MD5 7d8aec43a22560b26d377b63a9e75ca6
SHA1 fd60f65880507f9815a65e5c45f723297f3d1f7d
SHA512 66a4e0ea576561a6c459a840ac6e8b4badae36f2a4190f02a9130f60e2bdd5cd7ea7d28094329d4c6946193c8709fb2fd18e7e3858870ed39c766bbf7781ecc9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasLa:A3k03kB56r
TLSH
T154157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 947KB
SHA256 41d808dc7fbc435f5e51ae5dfe7f3e301c91983489dd44b00c80e7ae26ed6c8b
MD5 b374b66a98283d08055b7ff39fb76bdc
SHA1 880ab871d4c31602cc12765dfedf573fb9151fe4
SHA512 58b0a5a6f3f3bebfaefdab81f01f07eb58773271b6caebc00e50292d05c1aa8f257f1a54f44847be0229d488a4ea5c9341842870aef85afd28f446ce2da28b5e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasK6:A3k03kB56ra
TLSH
T1D7257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 947KB
SHA256 fab040a1d38dfcb87e8c6aac8de581bd23e1f79f98c2ee35a73162d4f57fd2f1
MD5 64f3e23d175ce1616af432738698b107
SHA1 7a517e82fab08e3b60cc6bdf11965bc6fe0bf5a7
SHA512 456c0d29c28871224231a2aaff8001dca73e95995c5483efaa2b32a8c962d164cdb1e01e993a7b967bd8d6050aed1782866f9fd315d3e1744fe1e7c33364f0a1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasiN:A3k03kB56rT
TLSH
T122257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 947KB
SHA256 4d1ca3249ca12562abe885f2ff670e098d74988827528913b01acf7472b850c3
MD5 154a84b11c201d262663321bab13524f
SHA1 db81a0154f9b40ef294fccea86b248bcddd50a15
SHA512 bd5a79b44a91203faadb8a69bda35e6b0a9e66e434fa98cb4f647351a3129d8e97aa5ebcbc4617e2322508d0af688bf57a4f70b4dd594a4ebfaedaa5ffa7fc42
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasYf:A3k03kB56r3
TLSH
T196257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 947KB
SHA256 957d4a2e791430bffbaf4ef8d7bf9f01f3947396fce6eb794352575e6812aaf9
MD5 e2d3e8e77e4e4f2939fd3897d0d7961b
SHA1 fa761fc50f67ed98118657896c2795ffe594a692
SHA512 0349068e2337ee870c30c68553eb2ff5f96b54c28472996dcbd683db9b014c2ce08300b58989fee214002b8e5731d9af99fdd0e5f045c7c2af9f161e81f2b6a5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasyo:A3k03kB56ru
TLSH
T1A7257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 947KB
SHA256 48f6e20c8729c573a7915bcdf248d730b95ceb864dc1e89815f578c8a2a1976c
MD5 af8ebb910235632fe938566aa3a486dc
SHA1 391db45f916925104ad37ac61728d135b8957e18
SHA512 84a8ca081370b9182b30e24aaee822aeb1015f414848d974950905e2f8689c79c0ff896fc17035ff52a88c2b7ef495f1290cf18a4f9a5bf5fd975b92d2cf1156
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasmu:A3k03kB56rI
TLSH
T18E257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 947KB
SHA256 79d00c0b6363017b08f2cdf0f9bdce61740db80aa0c70b41e3b5df879478b9b3
MD5 b71235dc0dccf36135be53537a4d9aea
SHA1 56c23e7ca6e363700cb94471a61cfd4bd6362032
SHA512 5d5bb09284acdbf4b42289389cd385bd5b23cdef528e7e8f3b1c673174b5886bb8a45132fd164395c1f6dadd850b1d480431035a8aa97934017cbef1b4fab793
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasa9:A3k03kB56rd
TLSH
T1D5257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 947KB
SHA256 513e5b22d2dd8591fff378041c974fe6d74834c4eab457ef4ec5a0958bf100af
MD5 9da0a570449f966b067e77d1b37e9223
SHA1 b43f427a3d7839932e38c68de404884ca24c2d80
SHA512 f7ff781eff3da58c98daa17d9e0126f5b967f4bd24cac8aab89e63ba6114c76848ffb3d7cc12430108954ec9764e72fff0e78b271ae75d14f74c95462643cb7a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasac:A3k03kB56rI
TLSH
T13D257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 947KB
SHA256 ca8926d8452222d2ff9ba1e83094682c9b896779bd58ec7d4fd2c6d60fb0a70c
MD5 df45219e478a10ee95d62b54db3b538d
SHA1 800eb8cec70ce5d85381e12d114517e813bd86fa
SHA512 c60d57194932cdf9a5f74f30f02191fb2e2f89e415a862960bf0b997759c1469a40646d52f5b241d6bb92bce573c87b5390c76f9b1c3373ba1727c6a937abb46
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasTp:A3k03kB56re
TLSH
T146257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 947KB
SHA256 4c5f7f3e1dd9c2f6ad4a26f0d8ef70a41c0d7aa92dbf0331325b53c3917baecb
MD5 906a8f3b47bda8ebf3d9c0f4215629ce
SHA1 d066553bda4e271e38c9c839f950b5890617db9d
SHA512 84e8425b86a9489dfd3b07eb61082bd85c4fe686660b281df22252e0383bd07cbbb71aca3f511cba175fa939e90c72493240f214166ba70db6c7e6407915d21d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYas0N:A3k03kB56rR
TLSH
T184257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 947KB
SHA256 b0a66f14c6cd09356ac1aeab150f7171d833c84c3ef4bdf2ef536dfbc6450771
MD5 0665f235c6d09ef4fcdc9d784a553cb4
SHA1 d3f11640c259f05060f2865fa120361a7405839f
SHA512 fb7c1310e236fcb229f209e651337ac795e8b752e37c2775d26c3cefa40447bfb9767a82f7267c83445461e3a832dff20e25e4ff6a2bb16285ffeeac2e5737e0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYascF:A3k03kB56rj
TLSH
T12B257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 947KB
SHA256 495d07ad8af90787e01c755b8c6e0f057a517f96c7f1543ae3744e71264e3d48
MD5 4c89e29962938fb43a040e926c75ed03
SHA1 9ba588be803b81416056ea1c60962961d4dd21b7
SHA512 31d7a8cdcdf0b7069bc4a4401ba22e48ba8bbe2d7e39d73feb8f65ac47e6042c3a5222339fd19a561d3f8e801f373b644b07d162d797a4f5f996c39ad87b84f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasJC:A3k03kB56rf
TLSH
T1F3257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 947KB
SHA256 3e65150d69ccd913691988211da0bc6d3916b7dc21970147a424d717877e30b8
MD5 fde134a7c73646eb001706c4e001944b
SHA1 a76ad5b6876b5e95d5b7dc1083851c2aced77ede
SHA512 7e16b08761fab491a18ba295c82c5381e1422098f07f022a9dd108d5c3c0a7cc66ded1958e7e302a3e5d6216a6d3c8f887dcbc4b3b5894549b230dcf1b0a7387
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasqw:A3k03kB56r6
TLSH
T184257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 947KB
SHA256 57c5c3be82d8abca1a9611d2e1e2c85e095a2d4c9266bf068b4df209285730f1
MD5 a123538206ddcb7f4d351fae7b020c76
SHA1 17c80ca21a2715c71edb9905812611196e8bb376
SHA512 81525d76120fd952a667f3c8907a32046a1557c1a1d5347acf13d25915e67a7db069bcc937d800d1703306f921a509329bc23b3672c7307f9b2a9ecbd6b2d44d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasxT:A3k03kB56rq
TLSH
T1DF257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 947KB
SHA256 9f4a3e4da25070effc87e86fca520a4ce29e6695bb4f1d14e430a3d227428633
MD5 c70917cde24cbba7926c5f42e1f365de
SHA1 5e033863cfa734ac6ef819589b50d9d214ee9313
SHA512 4af07f584226d286b3e837d054a6349cf01948ebbf3929c27279e0a16b560ce608e4034e0b975b7671c04e56ed02505ca3355235b75e1a93aadf891999cbd569
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasfu:A3k03kB56rl
TLSH
T135257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 947KB
SHA256 732268dea62922ce8a5c0a4ea938e07013c9cba9963377194124783183967181
MD5 5e9db5511bd1d43be56ed29612af1274
SHA1 5d558c6b082854d1df523c241c5cf59279322204
SHA512 2c9ca35788632d21bf69768b45529d856ca9c035fb16d810b06da5456ded461dc2cdefc12601708477ca14368aba7baccb9fbf22d9c5c5652c6cc68a746fb0a1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasDb:A3k03kB56rE
TLSH
T10A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 947KB
SHA256 fe8c59e59cb40528514074a3e72ca299ff8b8ddb502a923266d8b9353d005fe6
MD5 9ce7b682d563c587b7808913cb040a47
SHA1 a75f6a252ff950d36e84ede03a206cce969f6220
SHA512 823d00f595c3a831fe9f22f5cb98d972f4e8f59fa0926c80e3b0429c09d3a4ac2220a16c45f1eda5a56481ad7ef0fea142552b21a6e261abf40e1c47f24e0f15
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasXf:A3k03kB56rU
TLSH
T132257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 947KB
SHA256 c108869ed5d70d79ad0328d4f0f3c89b44b0312d342aa898f157b53d30db7f70
MD5 7cf28028e410fa6524876b7cd4b9b0c7
SHA1 62650b26b4aa2785261f385e199ce570827b2099
SHA512 8ed9b1d8252b4281476c0e70b2f7f15742039021a771da0d54e8f124abb03d6687c341b3c71cdfa8077eafc19bebdb90338d59eb392ff25691fd78485bc9b50a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasgK:A3k03kB56rE
TLSH
T1EF257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 947KB
SHA256 e86e2fa9511f1135775c1774d0f52ee7809a55719767e6c7a701ddc1fb908729
MD5 6d8b30749801429b27e723dd74c6af8c
SHA1 7540d49fe45ef408bf8aa049740d51c56e47caa4
SHA512 a00b97a4af0cf38f258beaf6a94a8635837d52ed4c07044883977728eb6071e0a602b6a8e5f5a0c4d281e36ed37bec39a8a50885a48eae14742e7dc95137d0be
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasdk:A3k03kB56rd
TLSH
T1B9257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 947KB
SHA256 505b3fb55709286bf4f0689fbb796849a08ffd49ff6df6d07673029e1ec4df0a
MD5 502c57dba209c5ecdf8582c3e1f5af8c
SHA1 2df13772e352a59a945b4d4a649497ce1e9a9f46
SHA512 187400c82f0e90a06068ac24fd0ec3e9d941c127f4ddec4f6d4f479245082f59f6b90d7d056370308b34bfd2e2d47069b669a93b5dde74c12db0f0b5d6e0a3f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasC0:A3k03kB56rg
TLSH
T1E1257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 947KB
SHA256 9dcdf13b8684857eec81c14a429cf0e5f04ecfa4984bad1c587344caa7319254
MD5 d8748cd1de0f310f671f3276f12bbd92
SHA1 2913567bda9e767f6d0646b284f1c3e8d549532a
SHA512 de60eb89ff4a77987f7bab821a9718bc166cd2da85a1f270440f7724c02f046d8bfec475987527bc04107019ea909cff63d0682a113e19116d6500370532739d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasRg:A3k03kB56rV
TLSH
T18C257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 947KB
SHA256 b94840a9b099061d68b905eeebd7006cc1af0c9217d3c32c37880f213dc2b4ee
MD5 c99de2abcfd882e160587d78a84bde91
SHA1 218586b0daa0a494019f9eeaf187b17479406e42
SHA512 94a666a2758c6c5b9284ff9a8f1737faa5c6ed194ef801d97cb973dccc3505afa9bde893f393f34b029212ffc71f8dd427cf8a540c58b86a682247ddff389a46
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYas4r:A3k03kB56rX
TLSH
T144257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 947KB
SHA256 add9e57395a575bda491b82d1b30e1609311da4fdfa57d458a8907b5408fd719
MD5 ad6dee626208d889d146b791fa0c15fb
SHA1 1091025d6188bc1eb525dd1f3c2d513ceea97d79
SHA512 0c9cacff4de88409d804dcc7d9b393a051a39678d96e4f487ccdfe7c046cb0f828db4f39778c09eac6f47869c862d9470cac0ccb89815603a5bf5bb474590426
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasWn:A3k03kB56rh
TLSH
T168257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 947KB
SHA256 ba47781015f20a9c17621599858d217536fbecd695313e18f74fb4f28a5d3224
MD5 c22c841448c075efffb49c01020c58ad
SHA1 53c55e8b6adc1962991636ddfa95b8107f7e0cb8
SHA512 f681198c2bbb61cd7c19980e47167436a30be91c78aa9727494868996c13649fc540c68d8da21ea006136e82fb0ce4a107f3d4e5097ac891825924a20a2c0674
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYas8x:A3k03kB56rP
TLSH
T1C4257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 947KB
SHA256 45ed0ee8cb93b526f258842d741de5d246f1e9eac375c2387eeab1bab57aa3e9
MD5 6b20a976f94eecea2d4fde3aa1df6c6d
SHA1 38e2ecbfda52720b0ace17fee87d6619733597a1
SHA512 b4d24511c4f3baac790b4e5493694d9f05671458cef7c07f77e44af49fc50326d7923db362dd127bef74f94e3226c2a0700446bf4b39436168c2fea331d2f70d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYas2A:A3k03kB56rQ
TLSH
T1DC257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 947KB
SHA256 9b0dd909604d1554b4dce6696b5e7b3219435834233a0cae04e3fc41289872de
MD5 79aabb60111675996140d315d92959ba
SHA1 edd2ae45ec3a41a93fd7136e926b153f9f657a1c
SHA512 6cab0b166d1b3e0a5f0934b5a841b72af296ab3527d4a473cfa2e6d5440fa0bdcf88fd846cb882e4f503730c658c877f94d97607ce0f34065c797d7f26b1d887
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasv9Q:A3k03kB56rp
TLSH
T11E257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 947KB
SHA256 a01d7e13d4c05d0f66212a29fc1a6973b1026b0a2ec9eedf635c7863596b1c13
MD5 4582f43f6c86a07bf8154e034a0078c2
SHA1 456c7466765406d316613cdee211804c03fadefb
SHA512 e6912e0e0357d9c12c7816c222862ef260da811b8c3afbb85f48685a042774727136cbbd2c163956db74629e32271f293e7692c3a9662d8bea25739882182f6e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasG4:A3k03kB56r+
TLSH
T1E0257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 947KB
SHA256 959e3c41176cf1c2e3d405e1e304a571c024b245c2a065009bedbc9a08e378de
MD5 b2bca870947f5ed6455b1603942f7703
SHA1 c2e9b9fc8b4695052007531dc6115084c6066504
SHA512 e03daf7e0bc7127e282e7dab8d95599fcf698009ea1da4c770c8ccd714f9e2b890cfc16c3abbd3612acc715418656814f8f2e0130560f1016fbd0e67544cd582
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasVu:A3k03kB56rf
TLSH
T149257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 947KB
SHA256 9ef8e395f623b6a043e46a35f6652ca6628c0206261c9b4dbd97b735872c5bfc
MD5 d6815f2ee36e306aaaa3cd6e43d2e498
SHA1 72facd47f7c6db2b60414766fa7cb1d42db76e1e
SHA512 b19583503013c212b34ad69b5f79adaf360e0bab423c2de38487bdafae79dc03c9ee3cf2760edc3f21d7897659d49951937ac124c790c4fe83e954fab6282f7e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasIj:A3k03kB56rB
TLSH
T1F3257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 947KB
SHA256 46bb8d0bca2e3fd49019be13d9e024b8d75a191f77d4363157632f3406d30b99
MD5 5af7a0d1f764b50bf0bd9b4b0e58ba51
SHA1 4588207df5f3be5cb62794b673f55e9415c04c73
SHA512 51c1bbbea482578756b70ed8d649bbb5582913bd7b3885660aae6b4fce5c047f74bde366e3f1dec86057e54d2a7804aac338c51a962addd7d6c6641ab4b79482
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYas5g:A3k03kB56rF
TLSH
T1A6257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 947KB
SHA256 6dfbbf4334939aedcde3ca84eacbec5193366dbda7752a69249c62ee846dcd83
MD5 a009150394a1f9455f96bb7a63b3c4a8
SHA1 0ba0007e886b12968993bf41b8f15bd6f04f76ef
SHA512 ca667b30e5bcd1cb2f0b6f2b553cb23e1e9077d12b560fa75d9864200b659c3066085791faeafe41335971821d4297779acf91592c74f95bc86664eba582a387
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasgI:A3k03kB56rs
TLSH
T1C9257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 947KB
SHA256 50f63a254c935e91195a4284c4f4e6b5b5e9179bbca111405895330368ea7bbc
MD5 196f7795de7d71ddf48cd0d24e93a44c
SHA1 a682806281611c2e9bc376720b05c2c03fe1c875
SHA512 a1757035d9df6ef85ff7a24057dd5103bd7a2738d26377c79395d1cdfffcab2b4bc4fd8435e8e8e00b38f8eb17821e075b697bff44792f9509eb84a6b95c4381
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasio:A3k03kB56ru
TLSH
T12F257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 947KB
SHA256 52aa49b6b52dccf55217e2ccb33527e542ac277e045b26dd202da3ddee75ded1
MD5 22626b6a1a39ec8a06f88a5b527b982b
SHA1 742df4be366a104f0272dca19290b34a649b2bc7
SHA512 469bb06b9c582fc1f732bdae50008956651ce1ea5cb16b91ec29982a5a8b6d4ae835543d1533d6b79340ad4ab9ea32bb08326bb962ed027288ed3051443d63d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasZ+:A3k03kB56r7
TLSH
T1CF257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 947KB
SHA256 5a96e816d8acd40f06fcd661b70dc7ee5a1c56a9fe24802acd707c60e574ca19
MD5 ca556170bb1887073eef3457b6b0a25c
SHA1 afe3d1f922a1788c3f777b05f8f7ddbe7c70d1af
SHA512 d8392ec88987a12e2e46edb7496ceb7c242e79fded82353b0e15aa253df899849410c34058a7e838c44660bd0f8db0fa9a1f3c5ed0ebabcf73934169d131a179
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasHQ:A3k03kB56r/
TLSH
T17A257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 947KB
SHA256 ddafe89b25d42f0688c2c78fcc39a844ef2b14b329cdf8561eedb1d0dc8d5d07
MD5 1e7a5284e80cb123219a94322838947c
SHA1 6f6489c2bb7bb2f863c0917448bcefc994b01dc8
SHA512 579c4a874af2d6d31e5d3d2b93a2047f8073051c92dc05a0dca5061e7e0722faf1ad564ce97707d20c3eed89ab0d744eaba28f2bd365c194be24e69683612831
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYascX:A3k03kB56rT
TLSH
T19C257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 947KB
SHA256 19db6e158a71b2e63195fd63bbcdc96cc33996f548d3fc914fd8b3aef18f25fd
MD5 e589596e3befd7c1511b911e01fc9f5d
SHA1 63ecbb48e2fc29a157fd4b5065b25352cf2e1fd1
SHA512 73dcf7dea802da2b081fadd70d5cf549968df338472c00286d03133246089a6cac742048f90a180e9f913bb25e91daa802a979ba8fa1cfa850bc487b163a8f7e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasaL:A3k03kB56rd
TLSH
T10C257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 947KB
SHA256 096883ed4d5d4bcd4a095f79dac01166d5bc706c828b687625c8e3f4074735ee
MD5 4035ddc984b6a8e9bdc670bd80a6e0bd
SHA1 a9dac30ff047b3c2945f641483bf63e642d00ec0
SHA512 4b739c8056fb91b984c23cb8723394598476bf6d226298a6b4537e128be88e1b5504aa064709700e237d20cc85069c4bdbb73a479ca554061c3c7b58a0d96707
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYas+M:A3k03kB56rk
TLSH
T197257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 947KB
SHA256 b149ab50b24efdaebb268f120de0782c3ad333b231b5ec695eea5f33be07618b
MD5 b137ea8e51c017409863c7d6418d4d56
SHA1 3114638b29d57614eb4f0891dce3582b665ac690
SHA512 387e504d6fa54dbb28f56e92ccc37b4f6b9f0f39c73086b534b378f95703544e81e739927c3659912d8899e2d35515919a34eb6ab8325264b158e01d73163880
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYasnh:A3k03kB56re
TLSH
T1DA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2040-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2040-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4316-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads