Analysis
- max time kernel
105s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 17:16
Behavioral task
behavioral1
Sample
2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260730-vs48lacg82
- SHA256 941c2fcd81c728f12ad9399d5f5a7e1c1872fca474ce79f5c36c006f1cd5efda
- MD5 9dd8fa943a455b7c22b51026c5ca59b5
- SHA1 11771563a2db64310e8daffee84a351eb346b602
- SHA512 f813034fc7d3a0e662b3609b7b89307603bda8dbee27246571948fa4a7864299e1b0b42ee7f909c7c88fa9ea0ad8aa9026dcdd6b07a14dd8a31614f7a5153798
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape0znD5TvinrmC0Le5ji0hmxNrMYI:A3k03kHRJB56rTPji0AjlJIUy
- TLSH T163B51816E6644AA5D06F8074CB928655FA333C510FE097CB52D4FA3D2F326D09EFA623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/5040-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b6f1-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000016b4e-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5040-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4912-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019b28-668.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0022000000019b25-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d36-1264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000000143-2085.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000400000001b6f1-5.dat aspack_v212_v242 behavioral2/files/0x0004000000016b4e-11.dat aspack_v212_v242 behavioral2/files/0x0004000000019b28-668.dat aspack_v212_v242 behavioral2/files/0x0022000000019b25-899.dat aspack_v212_v242 behavioral2/files/0x0003000000019d36-1264.dat aspack_v212_v242 behavioral2/files/0x0007000000000143-2085.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4912 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 34 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5040 2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 4912 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_9dd8fa943a455b7c22b51026c5ca59b5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5040
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4912
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 941c2fcd81c728f12ad9399d5f5a7e1c1872fca474ce79f5c36c006f1cd5efda
- MD5 9dd8fa943a455b7c22b51026c5ca59b5
- SHA1 11771563a2db64310e8daffee84a351eb346b602
- SHA512 f813034fc7d3a0e662b3609b7b89307603bda8dbee27246571948fa4a7864299e1b0b42ee7f909c7c88fa9ea0ad8aa9026dcdd6b07a14dd8a31614f7a5153798
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape0znD5TvinrmC0Le5ji0hmxNrMYI:A3k03kHRJB56rTPji0AjlJIUy
- TLSH T163B51816E6644AA5D06F8074CB928655FA333C510FE097CB52D4FA3D2F326D09EFA623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 648213cf1204ae5410df39fc0bf09cad1ace61bb78f0490068bf023ae940862a
- MD5 e4394ecac3bab0dbe4ad25eea86242b7
- SHA1 9b043b49f27ddd74a527256412dff8566afa0d7a
- SHA512 3cfe983d3af9838a7e49ea163028c24888eb5b753c0b424485841abcd3544e6e10789ccdc2eea9ddb56cdcb4bfbe4c01a41326bb51d060a8cf51d57dcabbe9cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape0znD5TvinrmC0Le5ji0hmxNrMYs:A3k03kHRJB56rTPji0AjlJIUyPji0Aj
- TLSH T1FCD51916E66447A5D06F8074CB929646FA733C510FB087CB42D4EA3D2F336D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe$
- Size 2.3MB
- SHA256 35780229db938edc4424b74440a4295fce8f129702858d0aea3855e781e9e982
- MD5 746cd130d41a9a2b9c0dd52c4f1193ef
- SHA1 73a930c059c46fa43da2c2e7c65c2bc0c8607e25
- SHA512 e9d579eb3a6a36cafa42ca46530dbc12c403fa450c705e8feb62532e1c819b3f46d33273369e0e2e0a58c6d1d3aab3b04b8a5dee377ecc9047f5337c73aae389
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape0znD5TvinrmC0Le5ji0hmxNrMYl:A3k03kHRJB56rTPji0AjlJIUr/
- TLSH T12AB51716E6644AA5D06F8074CB928655FA333C510FE097CB52D4FA3D2F326D09EFA623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$
- Size 2.4MB
- SHA256 06a6d7e3cdfd2aef12b1fc6124ee8e75d1b5213371922b56feea48fcf79ee0f7
- MD5 5f5b31518d7b0e98a8055a77fe19b2c0
- SHA1 1b2cf6f1f463466d49c3dfb050050a48648fdf20
- SHA512 4248d5e8abcfc86c700bfa47fdc4c9053041cdd4ce081c2367ff6a8d6045f761e39d0861a4f03702ef1ee33adb83f1652816d8e34a66ed05d9ea3ba582c4f421
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape0znD5TvinrmC0Le5ji0hmxNrMYo:A3k03kHRJB56rTPji0AjlJIUni
- TLSH T1F8C51816E6A44AA5D06F8074CB928655FA337C510FE087CB52D4FA3D2F326D09EF9623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.3MB
- SHA256 670490de3d289a0aeb530b4de9c8dbe719f37f3678dcb5f315cc1fbf9bd51ca4
- MD5 5f8f79dd8d782b20c7af2324fab356ba
- SHA1 b80b2d4dadd79788fc6ce112e5159764bdf59b8b
- SHA512 2fbe5304ef7808a81c3e151926dd94dbbbf8585fc986b4dbd1d6d4ea3afed0aea6a61b23f6ec4a3f4f14228ce282d0a543e1d17e7f04159991e91bbe641c288d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape0znD5TvinrmC0Le5ji0hmxNrMYg:A3k03kHRJB56rTPji0AjlJIUi
- TLSH T1DAB50716E6A44AA5C16F8074CB928645FA337C510FE087DB52D4FA3D2F326D09EF9623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$
- Size 2.4MB
- SHA256 ac586a8c90884434e01b805037bc030c23cbf5df95e9327f204966b090e47394
- MD5 2dd7ad06dbac765c40b92459b814340b
- SHA1 98e6b789005e72b513809d2651581eeaf58fd33e
- SHA512 235ee737acd975645adb5fee0f9014f8400826eee7f1a3fbc6cbef8cbe811a0cf9e0e9c0c1df7f6e05c2a84823ce6e680d0ee5014125217fc04a2fa1dcbd41c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape0znD5TvinrmC0Le5ji0hmxNrMYC:A3k03kHRJB56rTPji0AjlJIU+V
- TLSH T162B51716E6A44AA5D06F8074CB918655FA337C510FE087CB52D8FA3D2F326D09EF9623
- MD5 SHA1 SHA512 SSDEEP TLSH