6bf817a5ad273ab03ecd7d4a592ada1b6f0b298604b3790306ca3c61210c11d7

Analysis

max time kernel
111s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 866KB
Sample260722-21mrvaal21
SHA256 6bf817a5ad273ab03ecd7d4a592ada1b6f0b298604b3790306ca3c61210c11d7
MD5 f48658e340154863d3694c106c4dba51
SHA1 3a4bd1eccfd823beeb7ebcacf3d6dbe3a4a7ff38
SHA512 b5d4e3720baa888a84df5533b2d7734705b9066876eb38dbd506a9b07d6792c641a669f5916b417db8da4703d7efa82f667cc21c442942a1621f6a0c8a2128dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERap:A3k03kHRJz
TLSH
T10E15AD03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/1160-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c54e-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1148-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1160-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c89-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-232.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198d9-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-579.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-684.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-825.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1405.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c54e-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c89-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-232.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-263.dat	aspack_v212_v242
behavioral2/files/0x00040000000198d9-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-493.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-579.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-684.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-739.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-788.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-825.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-856.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1153.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1325.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1344.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1405.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1148	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1160	2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1148	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1160

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 866KB
SHA256 6bf817a5ad273ab03ecd7d4a592ada1b6f0b298604b3790306ca3c61210c11d7
MD5 f48658e340154863d3694c106c4dba51
SHA1 3a4bd1eccfd823beeb7ebcacf3d6dbe3a4a7ff38
SHA512 b5d4e3720baa888a84df5533b2d7734705b9066876eb38dbd506a9b07d6792c641a669f5916b417db8da4703d7efa82f667cc21c442942a1621f6a0c8a2128dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERap:A3k03kHRJz
TLSH
T10E15AD03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 ed282592553c72dbab093cd0e86de83acfd1359d33b65507be50d0a9cad14b0f
MD5 170c1d4b3e29c00fcc8c1e416a71ec77
SHA1 69bdf78a48de06011145a6a6c9373a774afc4e6f
SHA512 aaaa71d5e4f8f61bed8d9e83a866ce06b37916cea254b35b529a7fe0be7a1416796db76133c28a1aad349746038f0721544c06660964783e9ca22aaf60441f53
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaK0Le5ji0hmxNrM:A3k03kHRJ4Pji0Aj
TLSH
T10D658D17F6A402B5D067C179C5D2A65AFA7138421B308ACF1399C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 881KB
SHA256 244109909d18c118d231bfaba1a6f440a6e3e3c30e04d01d3d2dde7c0e6b7e28
MD5 f12fff5095f2c52a864070068261cbb3
SHA1 eaf93ea131a40404247a3c271f537e341b1e5be7
SHA512 e70333af8da62b1a627663763d7172d192967348f7cc9a365afeaa3be18a666e7d06df0b5560af4e725a718cf7100ffe34cb5121c3339aaf23a04910fa2d0a03
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaEa:A3k03kHRJ
TLSH
T14715AE03E79500E9E20AC1349AE69A22FB757C12176097DF2368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 914KB
SHA256 60e620c9db77356ffa3bb3409c125901e22ed4f724d17883e4082114c74408c1
MD5 4cf830473a2b0728cdbf4f342897dd39
SHA1 c6ac73f78edfa8a440b1094068fe160b9215cea4
SHA512 bd133ed7a1f8df3fb2e0a939ecb56f6286796f8d06b1101a8aa80f074598a62cb85676c99a09f479a93075da253943848bc10af2152f08af6af8749f05d39a9a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaPb:A3k03kHRJBb
TLSH
T14A15AE03E79400E9E14AC2349AE69A22FB75BC52173097DF2358D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 890KB
SHA256 db1c734c8da477f8fac7f334dc1ac84b4798a7a6ec55fd696593825178647458
MD5 8fab9fde05931dcfd997878755049d8c
SHA1 a304d741951337c61fbf73a68fb446ca764bc497
SHA512 b2e4087785e3e1ea70e3c53c375bb45574941861afba47eea9a145a3b0dcb2801ac33fc5754931e8a64d963ed85e74a4f46f9ebdcfcbc4cdcf16e619206fbcd1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERa96:A3k03kHRJm
TLSH
T12E15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 890KB
SHA256 8b404bc24694832e0208495c5da84a34202bc61801ca6986b8a352dbe712cade
MD5 ca1d5498d497c9029ea7753b913242a3
SHA1 a4c5e382e2876992e02505b3631ae34258ec1c19
SHA512 04ccea8f72bd30802e640c5d74c95d9a250e5f1ceb0983a705d9c20a32e2719dd5105f1f64051fd97b2cd43828497b6afc1728498ccb176d48d5577418ab5abb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaTN:A3k03kHRJ3
TLSH
T19E15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 890KB
SHA256 59d7ad0e6b288026074a5350d5f6d0b40172164332a520cc20f689dfcdea9e9a
MD5 168b0f8416514069630f60d2a9435fdb
SHA1 a29627c5011501fdcd170ae0ad44f7ab4be19237
SHA512 7341c73dc95179f29c5952e074fc5133ddb2d006f4d29df36c10958664c767f472cf5b4565bc7fd0b69cc318672ede279ac009b48cd43131c47d1ce2cfce3c94
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERahf:A3k03kHRJz
TLSH
T1F315AE03EB9500E9E10AC1749AE69A22FB757C52176097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 890KB
SHA256 7757f6d3d325e6c99944659a0934602ca6c7714d0d4cb64c75bf37e2c946c449
MD5 db314375080b59988ef46454ba96bb16
SHA1 580f4e9dae44b178ab28c70957a3b7c866ba6833
SHA512 c9a160b3008617664779c416df7a91ed497e20ef5164820f9710ebb5f2b137246adf72a23dc2b5fe6a3c01873f5145d21b46a24d5502715a63050d60c2fd6649
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaDo:A3k03kHRJi
TLSH
T15E15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 890KB
SHA256 ae5d00c4e65eddfac82ff225db859fc528bf6285e0b3934029c5effedc5467d1
MD5 6349aade6e97e79553b88a0a9bf6d22f
SHA1 e67fe7c7b815cdc09e8aeae7964c236bb878248d
SHA512 9c31ce7b141e47a3b5c1265377bec1c17019b0c97595e37358836c28d9e44628f11e1b85ff6e72afbeaa4c9226988307e6ea258ccce1294da90f33fda5bba82a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERa3u:A3k03kHRJs
TLSH
T17F15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 890KB
SHA256 e5df685d8e9fe6937be6ab133520891feb37b104f46213c0d396808f858ac371
MD5 310c7d2edd2a0ba6672b954aeac13d75
SHA1 f1c0c1017bc1cc389fcf9381d390a5dd2d39e0f1
SHA512 b5ee7afe1d79d6f63c25f24a92266dc5251eb2ed84e6bb988e6e2d9b027bec786e958ca910a69dd107297f21ec7788b3afaa4cb47f3982606ebc5a64b8e000ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaF9:A3k03kHRJx
TLSH
T1F515AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 890KB
SHA256 9c9b77de76c6632241418e4610be7f329532723873d1c03285ba269594282d3f
MD5 fd72caf649d9da6aa0ec3ac8cbbee905
SHA1 cd63db3cf73c903e37875f8b76b211722677ca7e
SHA512 cd42c3d41d1105f8cc0985edd507bba0bf2074532ce055262fcb8e573f069c3e566e0f4f8ee85c70aaf1881ae49b744a9f3b261946f9846d85e8fd14e97f966b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERahc:A3k03kHRJE
TLSH
T1FC15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 890KB
SHA256 49bdae165b8295516fc90a7d342857c0f6483e4ea074b6f6d86e9e9ad5aadef0
MD5 19ae591f643b78ea023224c5503db729
SHA1 0bf875e63b033e3761ecc6065ce7ecfdf5ed6d7c
SHA512 4f3b900c246f2ad32e0c71df97dc0a95dfdc2b67de19462514fa3ffb0e6f147fe1a9890cc87d399e73d509d9d19efa58e8d60c42bf750c2fc6c172ca7731e287
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaKp:A3k03kHRJS
TLSH
T16F15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 890KB
SHA256 17acb3c55902c81f5819be18c885a800269e5abb76273f23d536a235f97ded7c
MD5 d7c320c0140c41bd77213c609b005bde
SHA1 753c018901586be4f96ed9a918bd03d7e458523d
SHA512 a3ac9b0aafc526d6b3ab620c7ad475386dc6ebe17de710d0466f13f4c31a58feaf703eafee23497154da518f43694c366e321b9315e7cb3194534b43843e3ffa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERatN:A3k03kHRJV
TLSH
T15415AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 890KB
SHA256 f17707ff623ae5a9da9939ac00a615979b07d64cdfdc65c9f9d669478f0d4b47
MD5 28bd268494f7be7e13f5235b78fac74c
SHA1 984b3da9e9040e9ca636b6e5438ac402699cac72
SHA512 63ffa33797ffc60bb60cd2455e0e892e5c4f0aee11601c4298dc10497f6f2c9b47ad14d747fa17a718f1b746217c10cb8894f8ab3b2ea2aa5c8c4a4bba401a48
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERafF:A3k03kHRJf
TLSH
T1CA15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 890KB
SHA256 58c2782ad364ebabd3c65ebea6a291df4047afa50e722cd12eef28cde506b9aa
MD5 a33c0c1ae5ff56849dd3ef1656082347
SHA1 ab5d7e97d144cea69205bd1d35c8fb49c28910a3
SHA512 b9deb0deefb38000554536d06a0c6526ab7c7174253ba813e2e921429251e0a8d191f99978ca1b30a7b6985dfd6533bdc407ff88363697f6cba667c718fa1374
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaAC:A3k03kHRJT
TLSH
T14815AE03EB9500E9D10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 890KB
SHA256 6317f267d3337cf105ed50bb542fce45f39dba62364c01e51f653eda4bf5efa3
MD5 444dcae6d08c7ca8608000908940b5e6
SHA1 40f92df937729bbd2b77c851afebb5ce74e4946e
SHA512 40029c4a2dd5280eb67726e6f1645911c45a6e569b4e427bb5b0c0ed4e3ddc4e0f044221aec4c8a771f2603773f09d65670013881a6c9fb36e02e0f1313ba73b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaTw:A3k03kHRJW
TLSH
T1D615AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 890KB
SHA256 4cc1e973ed148cf47ca77354861cdcfd1dba99cc458a78f94ce73a5e1f877f39
MD5 8204af3eefe9c16577abfeb6dbc61560
SHA1 8adde47868c04f986cce016a865799e16cbdffd8
SHA512 551c2624973992b38dac0594d2c0eecbd738c90e90cd2a93ec2b8768e9e73fa53c05f0ef268cc082afb8618a800538801911f336ae416e5612d31f99ce7c15a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaaT:A3k03kHRJW
TLSH
T17015AE03EB9500E9D10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 890KB
SHA256 17409ba5274bd808ebb5d4728104b95b4a5127263a7f48b4192017346b70391c
MD5 3462478a7e14f6b7b7ffadce018bec7f
SHA1 b240244d73fd12f28b31a3664df02dfecc11582a
SHA512 3c0a7c35e7d7aba3ee3b2eeebcb6a5285b43767215e5b0e108098e8df69594fadd74a1f8870bb4c18c21d29c9c6b5e84dd706df6dda08c0033db4cff57b6545b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERa6u:A3k03kHRJx
TLSH
T1D915AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 890KB
SHA256 65dbf13dd2753e423f1abb7aa6ec0619469408e29a66c7279afff7163ca68cfe
MD5 2158cb4d8d3c3fe3f8a8ae1b94f20e3a
SHA1 96790170e56e464a58bb3afb8e9af5bf173ce7e0
SHA512 e1f363968029d9f198a59cfca91a4733b20a5d7511c56c3541c696240e52c858645f2c76da99fd4f1de182593300fc0c637a3d28cd1edb133405bab35817285c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaEb:A3k03kHRJQ
TLSH
T14215AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 890KB
SHA256 ccba77a05e4ea63f8501c3e0675662a38e3300787aa5663bc5966bf1cecf1a80
MD5 0108c2fd9f6da85a8605194f66f6fcbb
SHA1 0ac3ea2b43b915b421544d1575b2e10bd66303ea
SHA512 639d96d244b6e81c79f128b29a02049b435ef07056ef7677271a2adf9f77ea72a9bfb263e5467770a75870800fc419307924808e6b104221b5a10e79087c9979
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaKf:A3k03kHRJA
TLSH
T15A15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 890KB
SHA256 6344ffad7a157db2beac95e5ac1ecfaceb961d32f25dc3c78f18967781135016
MD5 e7bb704f62c1c870c63dc966909be080
SHA1 8ce7c3e5b6445afcebe0a7a753b2118bfdf057b8
SHA512 ab5c28e4a37d3ddc8cfdc4bc907fae3dfa5bcbceb8cf49b97357347d26c3af280229cd4325e15df9fddee92b8a002194f6024a6b0814703a502345e68611a768
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaXK:A3k03kHRJg
TLSH
T17F15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 890KB
SHA256 b88a4f3d4d2c26b3e94ec1338842f547f9cc7877920ed8c0adc53f6ed9212b7b
MD5 314c6de3175fe298573e66394f76660f
SHA1 83918d808f098e2046d21ff00167e350c0a973fc
SHA512 96522ac2bdd959156e1a1091f98a2e0171e1a4f1f51626d76b99b0aec9280ef7ad1407fbf58c0f7b992ae2dfe97ca5d16fcfd50f2ea97ddd2edd29a81c3a11e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERagk:A3k03kHRJJ
TLSH
T1A015AE03EB9500E9E10AC1749AE69A23FB757C52176097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 890KB
SHA256 d82a327d1e79e2d41f20a912d49949d5b01ccb876fa1a7446bbf19b640ab6799
MD5 66b78bba03215f6fd147a2f37d1ed6be
SHA1 bcb59f625114470189260728a57df88d86a36579
SHA512 445c439735ebf92bb47ecbc2fd996fc364483121cb43ef642ee7df9d7de051c99a18398e7532aed7715e440d92207aa2128a16b8bfd9c317ce60fb4d60fe43e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaR0:A3k03kHRJ8
TLSH
T1A715AE03EB9500E9D10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 890KB
SHA256 07f6870906ef35b7ae78eed20ceb1c47651ea57efd1e853eeabdd52352244815
MD5 f0774da52752ee94647fb73885b9c439
SHA1 288178021dbf865755b5ad83c05fe62dd34453de
SHA512 e1481a8d07e1e27dfe5f4e4404acd3928ff7b30267fca9e4e1fed8645c56d9356c406f472b23bc93f79d738744565b2babe1a79a4967fbb179fd1ff6fa1ebf5c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaEg:A3k03kHRJB
TLSH
T14E15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 890KB
SHA256 45315537bb2e82b5e4094ed1b188f0e387a4d3529e54ac00d0d27c1adb0b1df6
MD5 89c4451f5686436a6e34c608a91ccc6e
SHA1 30d5d4f7d45a0d72dca15558250d7917293c95c9
SHA512 6a0a7e42a146560bdfe9381ab28336d458dd3d6e40b6eb5378ca11b9bcb69cc094828a431d851f67b5229b7d3e061e0a5fbcbbb73998eceb93755f772a1b857c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERahr:A3k03kHRJr
TLSH
T1F515AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 890KB
SHA256 d56f5b8c6b88137a1b86238a7a7024888026754562c5be1b75891faff19a0562
MD5 d0249bb705c05aaa1dd5e0229d9713b8
SHA1 e9e1ce33854804ed7b13e5d97a42abe9fd5c4d2e
SHA512 c63318e9a7107c8b4a9ee75acc5e8efdcac5b068b52d688023c47498f8f4cc0acbf4488292294e5de948d7ccd98f01569abdd9439a608713ac1ad157b3c38acb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERajn:A3k03kHRJd
TLSH
T13915AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 890KB
SHA256 384019ff5acd3b0cdb48049834d72175e13fb57d067b4fcdff79ecfeaf74cf5f
MD5 f9137f1ab6e0416d0b28680352498ba5
SHA1 4daa78cc9b9e3666000fcf13289eb2a2dde310fa
SHA512 98fc7f5a091352e57bf72912225b007d4919825174a1f7c398ca12d7923b20368dcf2adaf306465ea67349da39765de6b1218dcef506ca82e0269f211fbeedf5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERa/x:A3k03kHRJj
TLSH
T15715AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 890KB
SHA256 39c81279a466036aa95e12bf5eace50843ddb5e4ceb49cf643276d24540ff6f1
MD5 f4929626fa093101264ebed80d96146c
SHA1 9bfca438a345ea6ff64acbcee10bee427a3f0ed8
SHA512 2eb5d7401f61e944b2c3702459dccde62a129db864587e1b11ff2acae75fee67dd94ed18845dac4b7fd2efba3da12e2bf8906353cc9b7a501fb78571bb62c583
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERalA:A3k03kHRJ8
TLSH
T16815AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 890KB
SHA256 99b53b7cdebe9ec70033a67db2c1fe0f1a0be3e0d47a633c0c60c1ac1db7af1e
MD5 f4f166edc9ed0772d44de24e6cf1a0fb
SHA1 f3789c3aada62853286d5f8ceb3fd5866f6cd027
SHA512 d4d9b634f8d5746f36744e92548482664b707422dcdc7c9cde7c89c7f941726e7ce18428e061327663289b4d76846f945ad2aeea1ce6fcff8fb5d153805943c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERae9Q:A3k03kHRJ9
TLSH
T14215AE03EB9500E9E10AC1749AE69A23FB757C52176097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 890KB
SHA256 19382fe1bf640d172ee5c3c7ec7ae02dcb042e65f2a9accad3f697174a7e668a
MD5 426dd308c219735227c885f589eab36a
SHA1 6c5c0e455553498f01cb53d856372452bfa0b7c3
SHA512 c85e49f673178084afd698c8fc4b0072e3145539466b41def6b09bda4bb959d461170b70944919d3c45d419fe8cfd52c4ec2b6004ea0c0fbd2d68087563f5bd0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaL4:A3k03kHRJi
TLSH
T1DE15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 890KB
SHA256 a07eb4bfc884704f6af972ad3b2f976f212958401e1d6a073ba8129719cd23fe
MD5 041479851f48e344bba58803cfc63e60
SHA1 02a773312bcb33c81fadc4b55ebfeb100daf038a
SHA512 16daae31a74cbbcaa2f6b9752399b3a85e4bbc8ae5e2fbc09ad181da226f7f1a60a54fc7de59e0450809a7bb195d828b0d77079612fb802bf5871dbe83ae44b8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaCu:A3k03kHRJT
TLSH
T19015AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 890KB
SHA256 fadfc9955a58ad88308e67b2b2b8a1a984068942475851d5cc883c966a512d53
MD5 3101cbc8e8a79764f76e367718ec7054
SHA1 5a038142dcd39e06a36ec20f3f3feffa5cb0a1d9
SHA512 89d9811b6ad50a40894d7fd7d250022f0f5f9b5f8181719decd8d2dd8c44dbdc2b5b9f0ed858e879334ca16b84d6ce9f7e9fdb80905907daba17ab6c4b739f20
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaTj:A3k03kHRJd
TLSH
T10315AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 890KB
SHA256 c0fa862fdba8ee94aa70c8b44a48026564417e24c8cd39f862f17a53679e3190
MD5 954a0f8c3583b1663ffd7ad3bf18ec15
SHA1 b0e642a5d90ce7bfda8f4b9fa1f2745e739d4dcb
SHA512 6c4c022c70efed62e15c2ec32e4a8f482b1e9ce398306bde2d3f022bea8b0ce3c3c7e2a8bacf18d8d9f4063f594dedefd84c87a9e91f56d3a40dee13ecee0ff6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaeg:A3k03kHRJh
TLSH
T15515AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 890KB
SHA256 f3885b0d49dc061c8dcb3cbc1714b09b86c9337f6b521096a4f4b51a08b52f71
MD5 31f81de53cf6cb08e7efd28e090fe821
SHA1 1d11585d09c3b0439b926ac201496a28087b6ea3
SHA512 18337a1f282aeab12a17aaf6ac97a9b7286c7154a623867ca30018a6425c609b5f0f7544a4aa52eaaa42e3903b4e7ae20014638c898a2405a9e70c9dc44afc52
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaRI:A3k03kHRJw
TLSH
T13F15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 890KB
SHA256 2c240c6efcb218f38c5c460d24f2ebc8afbb8bdc3f02f4d58fefe03cd001fdc7
MD5 7d74c78a67d5bfc60e43406aaeb9e509
SHA1 a719697648fa8a7caa6050973b3e973bd64647a6
SHA512 dbabc240b4ee58b4801e04f4bd1982ebe6d4f5134c79865724615fa4bda280cef5548e43a109b883d4673aed87531aafc943273b53f67dac00ca0e1b7adc0852
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaTo:A3k03kHRJS
TLSH
T1E415AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 890KB
SHA256 795da7e0bfb9ed5353adbd7fe9019852e641eb1c777fa24ead649324b19fb741
MD5 59ceccdee4a781f6f137fa6d719ddbfe
SHA1 185ed79cd9f282993304dc800a30ce4881309256
SHA512 43dd593a2d84f16bc08210045c7cd58113b7629d9dc36e1bffe31e087de1460466553c893d5996e8bca1b07d4c568a1acb80333b09b49312077bd7eb43f0cdcf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaY+:A3k03kHRJX
TLSH
T1FB15AE03EB9500E9D10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 890KB
SHA256 43e3180c65bd1edb58d0505afed584ac88133af3c0899052edcdecc84e07edfd
MD5 d5bb1c007032bb387119e09697f9941e
SHA1 209d1acee5ef36f1733153042c07f8e3552ae401
SHA512 cbd40ac752ba31c8bb666486ee1fd0cd0b948cce574f5040c2cf937b61c68884d2185363ff03c0be105999ba67b9f31b8bfaad0308be6bbe68271cbf497c3ec4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERawQ:A3k03kHRJD
TLSH
T19415AE03EB9500E9E10AC1749AE69A23FB757C52176097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 890KB
SHA256 9e43da0bf28f38b695dd8d8d07e68b265e6724b3ecb87ac0c0e67347210d3ac0
MD5 fdcfbac5e3be8a4a6f4e22ee832ee3ef
SHA1 5ceed3115e933cc0cbc468cf305270941be1858c
SHA512 053c7576d28a28759e22951f858ebbfb4ee730b27f5668a11e05a8bc9e5f4a49471d2bac9b6fdf682c44f59f5565b642aa294ead840d07b9b0b33b41c8f7a9f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaZX:A3k03kHRJX
TLSH
T13315AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 890KB
SHA256 3257ec220da9adca77eb24aaea84ea333d056d2c26daac0cc0e7931aa40ce195
MD5 a3df32a4cb0b5644d03ad09a425c1faf
SHA1 66d40ad28b3940fee678891aee788add9731084e
SHA512 055b86a927d148c45c82572f9d5b9a8da834725580297d0d2284eae0b51599972323d28d92a856adffc27c289fdebbc883d79523782bb911413938165b0cb6ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERazL:A3k03kHRJ5
TLSH
T10915AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 890KB
SHA256 87e50ee1bc9a85a53daa728da6f89c8998b74a87969a45e5aea959f6c7204f79
MD5 7394c335168e90a80bb1324053dffdbf
SHA1 e4555861a7a81cfdf54b4c5845f7d16be5dc2663
SHA512 10ec7c5bcfa371d06c3d182947c25e2e058e408f4ff0727ade2e8110a62ee9847feafc9da293bd783ca0f6b23f2d5d2d71b0030305ec6fc347324ec1e5942ce1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaZM:A3k03kHRJA
TLSH
T12A15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 890KB
SHA256 fddea9c4c44264cb05d631eaecf84de4bdda7d3c11042d7f9e5d14037ba41ae8
MD5 810232de3710ebfb1060439f45b61322
SHA1 786b439ff4a7fabee9dd304a5057bc28009b79a8
SHA512 a7d657d34c6ce4ad91ffc496c461faa558881d380a0daf6eb851543ee3b0cde9eb19c142b017282f54f376cb5ced2033bab8f062693f3c6ae77d344e0564f9c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaih:A3k03kHRJy
TLSH
T1E415AE03EB9500E9D10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1160-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1160-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads