Analysis
- max time kernel
97s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 15:15
Behavioral task
behavioral1
Sample
2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260721-snar3sbe73
- SHA256 a5405c9451868d6efc665dbfc7a50f304250b7adff3bd5acf7c15fe25baa0549
- MD5 638bfad7e6ca14e3f1f543f6cb4c9a19
- SHA1 05b0681a7e5519e203080fde4bee9664eece2736
- SHA512 055078e5cd5412b06c89437b4fc6aa6897cdbdf9e2937ba14baa9c5d610cd5440714bdbb63e03f14f50a069e26632b0b63734ec10480d72aa62fa6b0a9ae6a0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmeeD5TvinrmC:A3k03kB56rN56rX
- TLSH T183356B17A6880FA8D11FC1749A964662EA737C025F2093DF1354BE253F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/6076-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b815-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6076-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4556-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001997d-502.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019975-503.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bd3-661.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000001ac2b-1261.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b815-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000300000001997d-502.dat aspack_v212_v242 behavioral2/files/0x0003000000019975-503.dat aspack_v212_v242 behavioral2/files/0x0003000000019bd3-661.dat aspack_v212_v242 behavioral2/files/0x000600000001ac2b-1261.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4556 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ patcher.exe - Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6076 2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4556 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_638bfad7e6ca14e3f1f543f6cb4c9a19_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6076
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 a5405c9451868d6efc665dbfc7a50f304250b7adff3bd5acf7c15fe25baa0549
- MD5 638bfad7e6ca14e3f1f543f6cb4c9a19
- SHA1 05b0681a7e5519e203080fde4bee9664eece2736
- SHA512 055078e5cd5412b06c89437b4fc6aa6897cdbdf9e2937ba14baa9c5d610cd5440714bdbb63e03f14f50a069e26632b0b63734ec10480d72aa62fa6b0a9ae6a0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmeeD5TvinrmC:A3k03kB56rN56rX
- TLSH T183356B17A6880FA8D11FC1749A964662EA737C025F2093DF1354BE253F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 fa4b0865064378be334e07e6a121f189e10a1b3b1eb34f7f70ada0e60b4b5e6f
- MD5 ef23ce2615b4ac02ccae340aade0ed3e
- SHA1 b0e4400eff734c3b6f830baec25ba93b5a2fefd1
- SHA512 a28e713d5b71eb281be95013497858031f94d9f287a78cf81edf30441403823ae79d997a2d807274209658b036e7d9b08c4e355fe7c7b1796848b93f13bcd870
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmeeD5TvinrmC0Le5ji0hmxNrM:A3k03kB56rN56rTPji0Aj
- TLSH T114853916E6A44FA5D02FC074C5D29666EA733C425F3087CB1354AE283F37AD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 1.1MB
- SHA256 f0d56324fdc9204960b3e2ff5524b21f1925091422c5074e824e3eba954ce8f6
- MD5 f827c53389a50aad64c379c70f195b3d
- SHA1 cdb0e70c24bc7436159249bce18514e9ed62eb9e
- SHA512 63cb5a24619745cfc625b5ceb6e284335414cda244d42e54017eb9127fb0a90b262e6d7f77992973ea735311cc456afd70e0c84e55a97eb7877ab4ec26d224e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmeeD5Tvinrmqj:A3k03kB56rN56rN
- TLSH T16F457B17A6880FA8D11FC1749A964662EA737C025F2093DF1354BE253F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$
- Size 1.6MB
- SHA256 8e966589d1c3307d06bc3cd91a8e6624252e90694e2df39a6a9e674c9d3f5a2b
- MD5 1ffbf82d306442c068665498c27ba385
- SHA1 b730c2a4d5ec9809119e3df6a9e09b421e3e1022
- SHA512 b47d65c7dd2b1e75aff38d0de44e0ea7438df8dfe51d165ead263c94204a83687850e718c107a6c9395835b3466ee44324526978e4a4e5b629c6309a2541bd71
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmeeD5Tvinrm23Td9CHKy7GZx:A3k03kB56rN56rDTd9CHKyaL
- TLSH T1BB756B12E6940FE4E06FC13489A64522EA737C565F2097CF1354BE253F32BD0AA39B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 1.1MB
- SHA256 a3678e097d7400efa97ee0cb93fea06bf373fc210a5ab9e46aca141f65e187e4
- MD5 2fb67e16632ff475d2ccdbf758f3fab9
- SHA1 80a42eaa00e7e65ca9ee71c76d2ff4f542228a4d
- SHA512 6079d63ef5b2f24f127ac33a28fb4dee010f481171a725b05557f5d6102b673121f1fb3251801e1051f078098e48f06d5020fa51b0e9678d5ac45ab69177c6f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmeeD5TvinrmLQ:A3k03kB56rN56rz
- TLSH T153457B17A6880FA8D11FC1749A964662EA737C025F2093DF1354BE253F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.2MB
- SHA256 7b783d86ce7eb8cd9b3e4e79910a840b167c5cc0c9fe75fa19200eb703387c68
- MD5 ecb0700e89e9e1e4661bc08c460783e2
- SHA1 8449ffa92b10c219b261df22aec1d4474f2a6bbf
- SHA512 527eb9e1d8b917e2490794cccded4d438205620a4ef11c0e66ef395c3ffc9eb8df48f0d45c1618b6a0d5d96e5ece5cdf3128c3f5e063688baf40b3a757960234
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmeeD5TvinrmgF:A3k03kB56rN56r9
- TLSH T135456A02E6890FA5D24F8134DE964662EA777C425F2097EF1354BF253F32BC06A3A257
- MD5 SHA1 SHA512 SSDEEP TLSH