8946c6bc3679c7eb240af908de06d3b8a64ea13a65b5245a5a799e208623d0d1

Analysis

max time kernel
103s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 882KB
Sample260729-bb2lla1ckd
SHA256 8946c6bc3679c7eb240af908de06d3b8a64ea13a65b5245a5a799e208623d0d1
MD5 7354cf0ad29007bd7c387cc09c41490e
SHA1 e32bedae83b0e358b755c2d0aa2fd6f9e4c90781
SHA512 57df3b6987459b055a1f12cbb7f7beb10b3eed88b9520623d1db8a28449661443235645917718975a2823079a85923088f636b427c8b526d7e594c2f6eac176b
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaG:cuytJJ8y5iT
TLSH
T1ED158D1277E444B2E1A2423489E09766AB76FD610B20CBCF6354975E1F32BD1EE39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5644-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c58c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c9f-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-258.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-439.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-488.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-561.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-610.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-635.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-720.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-994.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1074.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1142.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1314.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1358.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5644-1554-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4680-1651-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
4680	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5644	2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
4680	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_7354cf0ad29007bd7c387cc09c41490e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5644

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 882KB
SHA256 8946c6bc3679c7eb240af908de06d3b8a64ea13a65b5245a5a799e208623d0d1
MD5 7354cf0ad29007bd7c387cc09c41490e
SHA1 e32bedae83b0e358b755c2d0aa2fd6f9e4c90781
SHA512 57df3b6987459b055a1f12cbb7f7beb10b3eed88b9520623d1db8a28449661443235645917718975a2823079a85923088f636b427c8b526d7e594c2f6eac176b
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaG:cuytJJ8y5iT
TLSH
T1ED158D1277E444B2E1A2423489E09766AB76FD610B20CBCF6354975E1F32BD1EE39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 7d7604ea0afa174dbb77286dd0c8b9330cb0c636c17cb41211e6449189b9ac4f
MD5 f3a3eac837cc98f636fba5645ff324ed
SHA1 58c99ede06a380a367a7d5a9e167e5d957991642
SHA512 2939c208ee7abfe69e21e1defb71e580454ea9097a446d6fab43c514c94ae1abd5d61aef475629845b646b6202c7b839d260ac54c45184ffaa95c3c673bb234e
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGP0Le5ji0hmxNrM:cuytJJ8y5iT7Pji0Aj
TLSH
T10C656C12F7A44271E073C175C5D2A75AEA7278510B308BCB5384976D2F33BE69A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 896KB
SHA256 a55b28d2c768e6d9ab9b3f3574e798f38924d0952457f81a8da2afb96efa874a
MD5 8637f5aa0052469fe8e2e2095957a0d7
SHA1 5e13d9822ca26806ffc45207528bb63b390a214e
SHA512 80b4c198b66e6db0afb0b4020dc897365f5c4639443a0070988f654983f7c7ecbb8ab2ff2aac9ecc40ac4a4c44dd7f751a61b5ca7fb0d5436666c8baaed99966
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGRa:cuytJJ8y5iT
TLSH
T160158D1277E444B2E1A2423489E19756AB76FC610B20CBCF6354975E1F32BD1EE3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 930KB
SHA256 8cbf01bc6a7ed09a1b20b3da13a73fc95bd98ba56b61fcd998a495bb912c9c40
MD5 844adbc6efb871fd6dbdcccf9ad97940
SHA1 1e8e028c348d74202aa96615e3e44d0d2bad008e
SHA512 5e7c2ec870213daf851ea24b52f6460c5d3885ecedda2650452399560e28e438975274aaf06be6a283d897feab69b0215e9e1f159ad92d83b1f0de6f7b4727d5
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGyb:cuytJJ8y5iTeb
TLSH
T1FE158D1277E44472E1B2463489E09752AB7AFD620B20CBCF6354975E1F32BD1AE39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 905KB
SHA256 bcc92fb3ed624c6bd4f3ef5ca73f4970262b62c6d29d750a3895f4392bcee59f
MD5 62178f5648119a3049a7e89a12d1db45
SHA1 3dca4a7dc7570d9a041a1a6eb7beec2da5f6d3eb
SHA512 48f9c85a013cc8486014207989b622f5825babd7703b18d894766a6b3889ab768b4a0372be90dc83d9f32ae4139d48bae45996530754424d7956cebbf8bd34d9
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGo6:cuytJJ8y5iTD
TLSH
T160158D1277E444B2E162423489E09766AB76FD620F20C7CF6354971E1F72BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 905KB
SHA256 d357717a36da1b7fd5ae74290537788d166f013cdbc89bb5fc0d3a035278bbbb
MD5 89dec8aa089d4b6e4af21520dc9c1162
SHA1 5e7cab59eac87f9f82db72e2c659ab6721721b4b
SHA512 3cd4d4d549eecefdb534da1b4e530ee482bb80510895b8bc9564eaaedad3dcb9c485b303ac0b84858a1dacb8e1e3424014ed4d72b3677ddfe5b3efcb53cf3154
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGsN:cuytJJ8y5iT+
TLSH
T120158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 905KB
SHA256 afe18dfcad871d9d646092227c3e984526f1aae12b4075c5d36b419cf57323e6
MD5 ff548aa13afd0cdaf6da0db65d3c0bc4
SHA1 a8bc989753fba4f99eed4152aa044d77a81b628a
SHA512 1f3236dd9376aee6fb4f73bd4553d140d1672edfd529640c8c006a3083381b752b4758ba9901783786294d481d58268372c93e20b8fd6a5d1fa54a014b7cc769
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGif:cuytJJ8y5iTS
TLSH
T113159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 905KB
SHA256 d6d3091584188edf917b82c5e9977819aa4efde0e344c6055c2675100bbd30c7
MD5 daa9d37a862e227037c2b7b483612802
SHA1 18018cfd6fa0a9830f4cc94987fe55fae2ae6b85
SHA512 105d3d370d3fc19ebed535382f1fdbf17b6630ef05baf38452ef56d692241a9cb6e697e16bcbc88f23e1fce791bd6c6e06baa607ef5fa274ace58c6958b54c4e
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaG8o:cuytJJ8y5iTb
TLSH
T16A159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 905KB
SHA256 44df8ce17c56c87abf6204bbdb65dae8e56198475faabca1b73d0651a1175d65
MD5 6b1ceb85da069fbdaf7957b8df2779c5
SHA1 b6b3b525044ba3917f04c1a0a4bd089802d48f19
SHA512 096aef79b1011432436b485e02f8e2d79da42b5cd913b63f1ea702c1938f3fe6464e5690d2d822f94cbfbdfb581d5abb83400de4f522066110107d01c4b888f8
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGcu:cuytJJ8y5iTd
TLSH
T159158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 905KB
SHA256 59d7ee1fff86736132413cb77ce8132c0dfe9a7798dca8d54aff5e01c3672ccb
MD5 822785c4c1c6a4900e1b663f0fbc3672
SHA1 c017dc4c9a36690701478de2a88f4e3207c83f04
SHA512 fb7e7417a824bb39c33381487f925ccd5aa427328a1901e074058614438a65cc1d37726a8af163f75a7a4d733543d78dce6db553d3d3fce817d87f6c01250485
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGg9:cuytJJ8y5iTo
TLSH
T14C159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 905KB
SHA256 33dfef7796fcc591a006dcb85958ad2e8434aeaa982896e327d1e47d5a567250
MD5 9ca36c6a6b849b2ab0058d96c158778f
SHA1 21bde483576b3429c1c4d3f7345e77d3b11bc2d7
SHA512 eaf5ab44a14ded4e09c3f316cf161b450551d5c080f56b8adfe581b379b063165c66cd46ad998dbba7e5e1b2f5e0b7bb4e6248eb77cedd43fe456aec30ea3cb9
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGoc:cuytJJ8y5iTp
TLSH
T1C1158D1277E444B2E162423489E19756AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 905KB
SHA256 5fd6a945a869ce64828b23a51e9ed1041a1727842affd6f80cf25e301a2d7e7f
MD5 a2b731e822407162ed3a79aca3f563ec
SHA1 2a936cea4e5813338c405f3ccba8633274b603ed
SHA512 e5d3e93d241ed2cee1d6ae02547a56b7a01333fdc8be3b754ed445a4ebef964334ede900e4fa8865d1d01ce55a0cb207e44d536ae363b0828e1a6d679194afbf
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGBp:cuytJJ8y5iTH
TLSH
T1C6159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1AE3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 905KB
SHA256 5605e365b3a10f7d37c4bac399a850cce436edb16d9d47c84bf267080252ddeb
MD5 63288e96d4953f5c0aec11804dae0c1f
SHA1 27b9c22c74cd9074833dc1f65d4a6d42eb7b5545
SHA512 54c1c4ee442b5a726a11aa854f25a0595864627204d5b90c0a463d58fc589f2fa2fb454da6081e2d2979b19ec851122a89b18baecb00687f2e9cb2330466f3e6
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGWN:cuytJJ8y5iTM
TLSH
T11A158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 905KB
SHA256 40666d4e8b6b038c0002ae935f112aee10f362d9c4f3273d5e8485699241e41e
MD5 ca89e88914e644266fb6dc411a40a0ce
SHA1 36cdadc13662543b41af6f8db7b2bd08b65aae82
SHA512 fb840a717d0ffdd495f9a78e6bf6e752023e7f3f1d0444a1571c8513c308f833baec9e80c9035e9e9c005769c4b9f579104553d4159010261193a88de51e868a
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGaF:cuytJJ8y5iTa
TLSH
T1E4158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 905KB
SHA256 30a22ccdf4973ef9be71ae5c95a02d26baf9412b3c9ae2f5b10ef6d0ebab4350
MD5 4ce0c55665c99dcb449d66b002d971d3
SHA1 4d0bfbd92885597252bad0f6034db56882b1930f
SHA512 221e52d763bae8f5c260026dab7ff4d6a352e9620ae801ee1bd388e99712110f43a8588447d0f2f9747fb8ae1c1e2299174db6ac34ec8f7900b7096518da5656
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGvC:cuytJJ8y5iTu
TLSH
T162159D1277E444B2E162423489E09766AB76FD620F21C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 905KB
SHA256 5b28fd9a5f5bafe333502a7f8dbd2c5733d205a986ad8f4b3600fbaddb421c1a
MD5 bcd9e11ed56c1946b09f8a3eae1558f0
SHA1 89c5c769b41c0379d230ae1e47320ad5b2f1198f
SHA512 45f12ae1f3f74f1430ac96c164f72b4610813be4c2f883aeff144aaaea0af39cfb455f72ec8f736c30ef3f21c1bceeaf48f49e50667e49b9db3dfc5b17dd651a
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGQw:cuytJJ8y5iT7
TLSH
T140159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 905KB
SHA256 d51cbc04d167518c53d745c114f3ac5399015dd40b359c404d303ba8647b0556
MD5 50975f9ce4b1c6f5a2c4707228cf3d07
SHA1 a79248d688f36f9559ec5128d4db75c7209de494
SHA512 2bccaddbfd47308ed9b86bae8c28562b0114769ff8f41b886258aca92cdd1f90cac04f002049650531a2e6e1a6b8569b7b3069e50e3a3cc1943fc038a8fe706d
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGvT:cuytJJ8y5iTn
TLSH
T12F159D1277E444B2E162423489E09766AB76FD620F21C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 905KB
SHA256 bd892cedf277b5b715806afa03c84ebeae02d8423fd280dd7f1b739ef7778950
MD5 4ef4e8c8e1378db5762f8f6dd328b3af
SHA1 cc3707b1df673d230c007f4056e60ce1a9b53f14
SHA512 bdfb9f5fc9b8076117130753ab082d38a1c1f5aec63fd796eeab029b30868f3f935e7aba630105bd4bc0204e813d3a0fdb51cc940b48ac4c0b753e55a8d7dfee
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGpu:cuytJJ8y5iTo
TLSH
T1FA158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 905KB
SHA256 15486cc64a4ed208c19e1cf680fc516c8ca106f1178efb39354a07a1a7084e50
MD5 6b78e6a5f2efbf1159fb6c32e91d2fe4
SHA1 be9d1bb423194cadf2195e9ae1be2867aba015cc
SHA512 246876556f4931b9fdda36b8280306307facf904e3f187ae50771a1a288713a900e3454caf65993693be9db5b325dafb792453e44b041a4ee817e485a60af283
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGhb:cuytJJ8y5iTR
TLSH
T19F158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 905KB
SHA256 ca623f2ebcd8490fcc5d849513d024a5b966f70f008ba2c1158d8bd31d5e92b1
MD5 c90355d492374abd08a5ad04ed2ee378
SHA1 a1d172d1f40df7892a29f3c82da6ad0ad55e4ffe
SHA512 0896eef77d02560a6bb94303b6136045b02d3f3102f8b88d8a6fa39ab674b8d3d18a82e0fe1d806c72d9559cf9e1e01557dfbe71310cebb30060be5406ff5302
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGpf:cuytJJ8y5iTR
TLSH
T17F158D1277E444B2E162423489E09766AB76FD620F21C7CF6354971E1F32BD1AE3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 905KB
SHA256 fcbcba4c5deaaabd09ac8718f770f24c1435c0e9800f63bbc0b6539502e48125
MD5 38ca1060cf5f4ffb889bae29b9ae3d3c
SHA1 3b5c5ef6543c1099300647d57ce87b146f4d4d00
SHA512 a30ef3ada1b2435fd05bca0a90a161698782cc53e1b14fcf4d4196733522a13a87b14dea88fc4533ea454d3ca7f4571333f63ddb88229451a4bcecbe5780ee78
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGSK:cuytJJ8y5iTp
TLSH
T139159D1277E444B2E162423489E09766AB76FD620F21C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 905KB
SHA256 e145b0a724d12e75eb98ed8bcc06e3e0daad2087fefcff2d73a84e335d55d5c3
MD5 86b03dc09ab193d8da64b188991caa15
SHA1 aa084be93da347a980f25ea4750ca449ddbb84f5
SHA512 966b265097d37a4c8463c2f660eeba211ec9c1e7cb49aaef3eb2d45ffa6f74c2fd27cdc86e04db301402824c8a4c054a5f67d9b6dfdaed6a3b8bc2994338979b
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaG3k:cuytJJ8y5iTg
TLSH
T132159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 905KB
SHA256 9c68191b09d019403f4e68c39e852bd07b877507a8b2bf1a0f6ccb0bc08ad537
MD5 5f513793acf39a9befa265f50a7b5bdf
SHA1 b23e081664497fc5a80a32740583ee31d08a4617
SHA512 b53d39838b2a2194b11f804268b0191b1b3d87de6c73c10da597fe5856151385348552b0ff6f476fd49504456d88fa7e91cea936871b12743f526ddad4173592
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGA0:cuytJJ8y5iTp
TLSH
T177158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 905KB
SHA256 be7a8614f3df2022c328ae99f6015d6a3f375f6e510243dcdf0af6de46c1932a
MD5 f07dc0e2a2102f25a21e1c0209fbd855
SHA1 1acad70e976b1fd3f74f44458f8db6c97a0639d6
SHA512 b8948a597c8d3403a293800e513c515d075585676da6cdfb0e31abd0f305d509c8caa6c68b4883d20314ba49efbedb50a1550f6ee2bfe8e54f9bb165787deb47
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGbg:cuytJJ8y5iT4
TLSH
T147158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 905KB
SHA256 aec0fee6cedec77f265f37b86ebb01a1ac8fbb9e237fb9efef4235a0df35fcba
MD5 4afdd792da493413665d7c5df0a3f30c
SHA1 69f50b8938c3207c6a0d55029367e5b9613798a9
SHA512 c65a0bd4971e8a174ae0896794ab197cca5bdd2ea39e936b1ab4f0760368a52fc4532db2d0cd91b580bd5b83fc04e8d160816dbb44a3565e38a2669d548eaaee
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGWr:cuytJJ8y5iTi
TLSH
T125159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 905KB
SHA256 c5ab7957f1134ce0c4e3d7ea0366fc5a2d6ee81667e5e5680cb6295613a090e4
MD5 f11b01c9cb7107292a705283b31601cd
SHA1 42886bce22fd2c0110378345f8bbfe93cfea6d1e
SHA512 efbb75c18c539efeadae259778cbb0cb8f0987daf757cea4db2d1d682c9c39b249c15645710de6c835b692d681d2d868727845da97f8d9e7426209d1389046d0
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaG8n:cuytJJ8y5iT0
TLSH
T130158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 905KB
SHA256 7bead0cb5588262099635edce286c211d97d8585a551592821ec1f9543ec4b1b
MD5 3fb4c449edb3eb506b787f33fd9c2dfe
SHA1 663a3e2dd6c2b65ba52ad1f7d31ba36f53ae88b7
SHA512 40a182322885fbc0e0927c155ce3163642af932c53145e32321c1695f27224d03b275b73b8945eab72e6ac7bf68cb39f4b5db98a1007e4a12d01a4b05384ae51
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaG6x:cuytJJ8y5iTy
TLSH
T197158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 905KB
SHA256 3be7f102f28f231d70495e86d05c31570ae3949e335af9826bce1faeb2c92c6e
MD5 6460c3fcf6ba5b3eb1360d2660d28c14
SHA1 d1b0b22f2cbd79f8306a8f12a91e66cd1de1dcff
SHA512 484de42f487877b18d1414a9e0eef6b427c7effc4b2c064d1d091798886e1dad89bd6510d8729c7601c07a6e832fb54cc0b4c7851fc36db1be34a0b36743dad8
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaG8A:cuytJJ8y5iTR
TLSH
T118158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1AE3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 905KB
SHA256 52b7eacf306bb25812a2d5d9d2be28e9d4073ea6e02a5d049e780bee8fb66ec3
MD5 2bf2c34995b6d514e8865e2707ee6c0a
SHA1 87940223a52f801fc9480f114dd9319310825088
SHA512 735f950cdd493bf78228764e8585b34422c36b50b1c9f8452759bf6385c0771dfd22334675bf6701131f267055408b97ad87641c2f0a9c02a03304035c7d64d0
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGl9Q:cuytJJ8y5iTo
TLSH
T14D159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1AE3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 905KB
SHA256 9e0c43cf11a283effde5849a3406b97899e40a9ca0d98ed50f63d1f55cd386f1
MD5 f8d91b74e046ef1f0ea9473b71a1c6c9
SHA1 75cd623ad6a2b5ef79a30a243305fb5844b0ba84
SHA512 fc83ef7ac3736519841fa914756afb48a0c0d7afe6b35e42741942249549eefb46c7ae1d9427cd74d84ff0d0b644642b3403586f278bf430e6285d296be6cbd5
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGQ4:cuytJJ8y5iTT
TLSH
T1ED158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1AE3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 905KB
SHA256 c41eaa20b1871021165e67b2e9b5cff4fa1e66391faaf091fe447686cea58e31
MD5 59ac743ead4237c79d5481b6c842a8bc
SHA1 3852fe6ceb6085c9c268be22a26513d8e1fae512
SHA512 8d6b05752242cbf08ccae02cd457e4178c397ff5ce3ee0f17c04ce65cc1dca8845c85b9c21367a630a0840c0aa30b0a5f37e7205bbe26eec65c8e88ab7c50735
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGTu:cuytJJ8y5iT2
TLSH
T1CB158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 905KB
SHA256 876892074d49c96a77d77c98fba22e47ec5927dc29ef79eead3da41610cd311a
MD5 83e2292124bb02fdb1a2adaad7610420
SHA1 5d0acfdb857dc1b52b5171fba4b31b30d1a6dd04
SHA512 cc847a1d81524253576eccd0ebabdc4ee1648b4791e64d89425387884bd6b9e8d39b6b0961a3668a605c82407b52bae61b1259990b1d37f0a81b91c973abf91a
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGOj:cuytJJ8y5iTI
TLSH
T159159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 905KB
SHA256 c067fd8d2621899cd7df88c26143eb77a2ae5377f2eccdd448b35c1e1397528f
MD5 c4ca4887c9d8c150abce654b9d4793e8
SHA1 a8ac1ab5f50e4ba67ef9b6e2fef6a56bb0cf6e38
SHA512 ae19dddda1f8e7a3138a01910ae109fb236d80448ab91c412a8dac0111a97846c7a1e27c3d765f02d77ecb46c18d8595de2910907a8714b8200c974f87d1b811
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaG7g:cuytJJ8y5iTQ
TLSH
T1B6159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 905KB
SHA256 e358d4f03576377e06abad4b8aa2b5a8064ef8155f8108869545a90bed6da255
MD5 a70e8c52694e33ec65e305cabfe8461b
SHA1 f4f3797cc1832649fb52a7a34339f954293ae7ce
SHA512 f9f26f96109e76b312da2d6bfda35afcf83389d93c96fe04c6f53dba13571ba075ec75098bf4a7e2fd487f79762e5e4d7342e7b9ad4a8ba1471a0f1f9b5d0841
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGmI:cuytJJ8y5iTx
TLSH
T19C158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 905KB
SHA256 9bb5d6ff3dddff694621a42c96bbc1a434f85814931687de7d5d70b994fb8131
MD5 737b240116e977f0af182fc85ad49edd
SHA1 c6a0b46f98d5e37fe72cfd0952294b39ca17f9dd
SHA512 f659b851d81ab46016c01d4f7bed23678b41b4b1ac1b993e768b669fe4be7681fb04abca36d49386d827d7ef5810193575e134c48e701892161444e821c95ee3
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGUo:cuytJJ8y5iTP
TLSH
T1E3158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 905KB
SHA256 cb55802f3b2dfe7c8255fc0496e754fc83f3ac3e9952ca5e7bd6c51b8cc0a6b8
MD5 ea73e87d3dbc529c02a8c2dd39111bdb
SHA1 be91e9043f5a4cafc7ec20e059a4209cbf984986
SHA512 9d7a69596966f319daf2f2b3cc13d86e397fe5163f29bcaf5fa4cf2fc0cf84d1dcd666e8dcafda93ea41d00c980599f6e7672880d5d5fa0caf1d1f90df3a9443
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaG3+:cuytJJ8y5iT6
TLSH
T1A0158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 905KB
SHA256 74b1b6038119ad8d083a7f56f823d75856290468e470030af08c0240194cfd5b
MD5 3ecbba92e5a6b55be72d87ab2e884bd4
SHA1 bde08a81d9610e8adfbf4c543af8f368287ca37a
SHA512 86a626ce484420398b79d45eacac03a36d4a1ecb1c8336f6975c832dd122e5c0cc1f0180331be1741bd79346fc4d096db87f59e8c3150a0327011f3968d0873f
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGNQ:cuytJJ8y5iT+
TLSH
T157158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1AE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 905KB
SHA256 acff7b29021aab6b4f656fe04b2789e7217a17d55adddac58b1590a171e3acf1
MD5 53d10e0a4e972be3e23e6e89bd1298f9
SHA1 15231bd80da39ead24d040587fe9fd73bd82f97a
SHA512 09fbe6823b1d04527598091fe7ee2d84b30dcecdb07d954638f1570009b969da89fb573faabbd60c905045e339d6cbd89dc20faeacfe76f6d65a4b8d4298d0a2
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGCX:cuytJJ8y5iTe
TLSH
T1F1158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 905KB
SHA256 f513d2556a201b47190a989d4eb5d2788113aa0863bc4ec60bc392cc916540e7
MD5 342b164a23f7d475c5ad979f16662838
SHA1 bf18bedad313c2e0b182d7ac201954a1d1fa5f81
SHA512 f29a56d30132769762bbabb9eadf1b26b7b29bd61a40e0d59486da2f641673b58a3dfbd5117da4c638fa69b12ecb2c8d48a7d86d489d133d06759520f0baeec8
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGkL:cuytJJ8y5iTw
TLSH
T1DA158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 905KB
SHA256 0d6898ef20e2cc9c7046e67ccbe341fd11d31a5eb4d27d450429d2fb317642c9
MD5 298df65adead2438601e35f159494c3e
SHA1 0e396ba73f61cc0773867bbb1b13bf7dd452f4b5
SHA512 6b5b9e57eb1f20359b51cd716675d3bc5d38b3175efe3191a8c58adc372c96381394cca8e52110ec4c9a0976e67f218221ad99e33f66c5bcb3187c7695b5fa07
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGAM:cuytJJ8y5iTh
TLSH
T1F2158D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 905KB
SHA256 c4487ec9234c1fff115b07dc95fe6050f0cdb667be411e1fb0cd4b1d04f67072
MD5 793aea0a0c44e67aad63f8bf0aef8333
SHA1 e8ec14a3973d65ba1d61a7a7e5abcbe8831e6de0
SHA512 7b5b7050338d6de27f00ab08c464f9903161ca6c52ab5da44986bd86220281e6edf0e132883914680f7026dbebd8a8d8d7451da65c1cc15d40019ab15a7eb316
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaaGhh:cuytJJ8y5iTz
TLSH
T1C9159D1277E444B2E162423489E19766AB76FD620F20C7CF6354971E1F32BD1EE3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4680-1651-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5644-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5644-1554-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads