40db5e302227ebed68210ab26b024f5866abaa7b839ed191863510176e937a32

Analysis

max time kernel
107s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 939KB
Sample260802-12razssgqd
SHA256 40db5e302227ebed68210ab26b024f5866abaa7b839ed191863510176e937a32
MD5 0a580549b056c263977e8f778a1055e0
SHA1 81fff93684cad1a45678cbf6cb7a85eade889a44
SHA512 1c3af633e4000664fc8eb47389335d4a30e06d5632b7b65544bfb7686462478450c92f8dfed376dbaa6a17fdf8536453a5a457d20a76dd1075c417ed4d1c5dfe
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kp:A3kqPji0Aj0
TLSH
T182156B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB4395D7283F67BE5963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/1492-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c57a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1492-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4324-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-589.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-705.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1110.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c57a-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-441.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-589.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-620.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-705.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-981.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1042.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1061.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1110.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1141.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1181.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1218.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1321.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1340.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1365.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1378.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4324	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1492	2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
4324	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_0a580549b056c263977e8f778a1055e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1492

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 40db5e302227ebed68210ab26b024f5866abaa7b839ed191863510176e937a32
MD5 0a580549b056c263977e8f778a1055e0
SHA1 81fff93684cad1a45678cbf6cb7a85eade889a44
SHA512 1c3af633e4000664fc8eb47389335d4a30e06d5632b7b65544bfb7686462478450c92f8dfed376dbaa6a17fdf8536453a5a457d20a76dd1075c417ed4d1c5dfe
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kp:A3kqPji0Aj0
TLSH
T182156B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB4395D7283F67BE5963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 e9174dfdb939426494cb943007726ac77bd56bf1888fffc56936de1b648081c3
MD5 9a57a0de9afae46a683d0b46eebb40b1
SHA1 72e6999c78c79eb2edef238cc38e321ab622d151
SHA512 7d090368712423ce0e537429305adc945498aae7caafc6ae8f6705488a4d77f54346f9960878263b5f4c338261403a7fc4d152ad4678e95a6f5bcbc4dc90aacf
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KV0Le5ji0hmxNrM:A3kqPji0AjsPji0Aj
TLSH
T19E653A16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D76C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 7e48ea9a31def66f61f57aeec2dd5a2eef75cbf3000fcf8d5a3f74e3f3aeacd8
MD5 7c31189a93f9ed60024d2541dec5fd7f
SHA1 78c32978e09add44742e0dc4c7e912f7c43fffa5
SHA512 7b786d7125b249bbcb7fa8c4f2d38169ad31b7b5a51d705b09bdc0dbe3af969716ab3cf1a9ed5d8fbc3738dbf9122cf4cf9eada29cb7a3058644beccace797dc
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K26:A3kqPji0Aja
TLSH
T1D6256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 962KB
SHA256 fcd43c3c9cd3114827c1e3e6f3d3a439acfb0a89bda7520f85ba0190cedfa7d4
MD5 2cb3f7f3b39533686bd7981733ddfaa3
SHA1 1e03c9d8729b2ce0d05d83d51fe5c4d17ea02d43
SHA512 2d655eb574f16564956dd435960adba7d735578e12fd34427fc5579946bd0425fce92ce4f1f0127c3cd98630882f2c4229b07c3c271a01d4a9fef1f94841c8fc
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KmN:A3kqPji0AjT
TLSH
T186256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 962KB
SHA256 48f0055ceaa73008aa9c000f50262ae6079cd564d795886adf4be8ce20d6426d
MD5 dcb62c0f5b8bbbba10c0dbafedbc314e
SHA1 101a86093da828f5820ed3f7653bc5afdcc622b8
SHA512 b24222270a320b5926345d54335a52717179f86cfd1a605e853433fc9a26067e5deb344c362d759f79061a8843724cbc6756e119a4c6c1cf8fff44d01a5c42f0
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kkf:A3kqPji0Aj3
TLSH
T1AC256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 962KB
SHA256 cc3d6031f7f4e79b797d7ddbec319604d99419c99b302a92c37874eed2d7fa30
MD5 1ab012de69d3fc50829198a00bdc198d
SHA1 add0a25c73760c11a81cbc6cebcf79391c6bc385
SHA512 10a1b256ab3348361b8b77e04f956db71f1b682e5f41d9ce9bb9e99c6b9f133ff79054740aacb8ee89cdfe16298c284b364b5c4b05d4684d98ba927665d22e86
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KOo:A3kqPji0Aju
TLSH
T1F2256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 962KB
SHA256 6b520b5c6046d41cd67257c941a7c0172ae8e7013525c435516f8b3859f5a191
MD5 98b0afca59386c2c236bd86408262eb5
SHA1 48fe934ab97080b48c7568ced01e3d84bd00c4d4
SHA512 4451e4b750ec106e8ebeeb101d40541178362ec68032d5c2de368a87e12735e268bb7b347b3e790c17ea4d78db386f94ea33d2cee791bbc1123fb6acdae3e005
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kiu:A3kqPji0AjI
TLSH
T149256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 fd59447e42971eabf7ce483ae9a4b11ea2d91490c48d05e9fb6c135d2cc4a56b
MD5 b4c7e1244bba47fb4dcd48e544814850
SHA1 eb22143fec075de5c62257ca4bd4048fcf19dae8
SHA512 21c39f3108d6f83f0b0448e9a6e560897be23dc1ab7d8d23aa4b29c9c0e9224ad64d7c20f759b73bae330035a2a7e9bbd80b3332c8f6176194cc20cdf59a367a
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K29:A3kqPji0Ajd
TLSH
T1EE256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 7a61170dcf6c62475fdef29b85f54dd3f1807fe0fa4da163593047c9562cacc5
MD5 88e72254d26d1bc1c734ac27a232002c
SHA1 d1e417ebc5b024968fdf8cdc8a79b8227eafb755
SHA512 38865eef8f1009fe6ded4215ffdfc31448a819c2a1e3fb2a74bdb8b1aee24907d5e0b48e742dd2500c5c3b21c351b4857229cee0c65fd3a1baad10f94c607ae1
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K2c:A3kqPji0AjI
TLSH
T199256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 9572f72f609bf6c5427f2458d5670b80b7afdff7a2bd8c22bda02ebe561790c1
MD5 02ae98e0e59e1748989503b6657b96c9
SHA1 768d217487a8b3c43f91cf9390193a2b93b2ea4f
SHA512 55c702db118b47b3065b5d8c0bf3dd8c55976b488c42252c4ffcf6d023ba58edfc5778bc72f3f47444df390e8f939d3ded336cad02bb21a8b87d35dab8df045e
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kvp:A3kqPji0Aje
TLSH
T1E3256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 d4a4c17476d1c3fb5f5c0e5393d53d4494ea6f56fb0c888f7c7b5a1fd5cbe09c
MD5 96bcb0a0813619b784ace4c164d9e1f9
SHA1 93e01d05bb41293e0ee13bbd941f891747e85016
SHA512 300f692199afff9f32750f8e81d7c4fa371dd428a9174da5885001ebf6af1929c4fe24b247920d7128142ba6d5ef8ec047d0219a407782ae5b18ffcfd44733bc
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KQN:A3kqPji0AjR
TLSH
T1DD256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 a3a9930044e6d4901a4ca2041a6cb4be683d049ddd358f21992c68d9e77dbdf8
MD5 b3b90dbac9c3bf9ad4b2e0af6f2e84cc
SHA1 acab068747b84334bb73e4fbd55149fa06d46ef3
SHA512 bf016e2b43880e8882126467ab34ccbb67267ed29385225022250ea829813f7e6d3bb301fa7704945ded24a8513f9e994567f1adb9b533f9641e2029f356e7cc
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KYF:A3kqPji0Ajj
TLSH
T159256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 3d69c20539c9cabb5118b4173e94477ac86d3bdd04b4e842fe7ec259628a47f5
MD5 e3497660872226f3f1a76a4ea577dc6d
SHA1 33e2e46a2a21803741e849e2bd9fc9d4ed6cabbf
SHA512 74411609e8ae38623fae3170054fdb6a4eaa1312f4569bd294b0bc6fe57964e330e3ad516efecb146fd5eee54d8524f1448f6006fb8cb78464b2ccbd61a50bd4
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KNC:A3kqPji0Ajf
TLSH
T1C6256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 a865f561c6e946de60449f638d4764b8b06129b0495d9d2b617e367006601d7e
MD5 529a0cfd674558c006c95698eca4214c
SHA1 15a8d6bff0303f3ab88eae260e3a1d6d0e56651e
SHA512 ffa142eb94b095013b6b21f182fe3998b87abd200e89fab915a574be7e42fb681fb835ae1f4549e925c243b8080dd478fb4bebd1592abb3d97b714348c8a3ce8
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K2w:A3kqPji0Aj6
TLSH
T150256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 654923de0d95edcc546e695d523fb52a06000e19a1075f2d059d2dfb5f6569b3
MD5 37ec6844f2f9696f3a2b767a398690ab
SHA1 998f0a40b76070520a8acced191e5754e0b3e365
SHA512 735eab415ebcaa079456964f8a9babe56cf9e7632c71952175fb878b5db40bbf80492d185ca35709e65e1c041e64eddd9462f995769ee8c21500ec38cca1a85e
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KlT:A3kqPji0Ajq
TLSH
T1FA256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 8954895fc8ecfbcf9cb459808008733e1ed76d6ae378940ff000f3eb31f75f44
MD5 0b4a705b5bf44ce5de3d0e183e2e0fcf
SHA1 d764d99dbe42e3ab8f879a6db1379480930383fc
SHA512 8485e398215e635fa408568d7d0805bcf877866a28c930b21edffb1bd914101cabd11de73f4aad1b399fe9515e86b431cb106a217935be734ab9e113bffd1cc8
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K7u:A3kqPji0Ajl
TLSH
T12D256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 706f49899cab65eac1999a353e3a27e35383ff76aeabd8c7360b66705f925f40
MD5 495395980a835627a7d23ddddd095772
SHA1 b2ee54fd3a176d8dd8715e3bfaaaa02458b41947
SHA512 3d7a36e6ce878271469f3f2928a92e51ac4db05caa57ffb31c60f9216da0ec3c53061b76787d8e3cbdb7079aa7fb1b7cdd2c658012e65d85f665034b818201a5
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kfb:A3kqPji0AjE
TLSH
T113256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 c7e632aa6884d48e927bbabdc4f816d133cdeefc22e18d6dde3a564913e3bdd2
MD5 9abedd232347588f64797871dd56ee26
SHA1 c27fb64512075e913efd6d5b150c306e8ad6770a
SHA512 f5f74913802e6335f92656f144e29741c6ad1c439fffb3ea2852bd918afbfceaa215049748bc6ea5b643f9a24028580150df8a9af11ce9b3fca57a773ad134d6
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kbf:A3kqPji0AjU
TLSH
T1D9256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 d67e5188b8019574e4a4986e63cab1b7fda4d7c55a308c8520dff08fb5c8e25b
MD5 03ad4c9e53cbf9fda4f7d61c535cb470
SHA1 1c3e2890e840b0b34799b37eefdbf234542fee80
SHA512 60bdbc6d823b4d667a0941e815feaabdec4d12de89613a6f59375bb5d657d2a0c97425d40fc19e9a14ba28c374b24af103d64d85f0dc785ffba3babe4918c9a5
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K0K:A3kqPji0AjE
TLSH
T126256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 fb6dd5cbd49c79d52557b9982b86ed7184c4ee38fae1c89eaafe0b97b30beb39
MD5 174a7c71c4b3f2adb6a333eedaceadcb
SHA1 1bcdcfd11351bb8ad61c0689d561ee1ae5eba2ba
SHA512 a1728a5d91a8e6afb320e4de66d93a6009c0b0d07526b0527009edf7ef398e0417190c2331bb823e2e67bf6f2f442004a72000f77a79c9b95d207ae742a49134
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kpk:A3kqPji0Ajd
TLSH
T133256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 48317958d2e24304b3bd8c5795008d2d977e9c679eb9bd449998ab3bed8497d8
MD5 0c856e32143238258947d8ce6646f236
SHA1 4c159f49373404a049db9da24e508e52bdfa92aa
SHA512 8c1acb43c316cd3f65f364bbdcbbf6d31f24d42fbaeee9a76437d0aa6ce4fbf59c79aaf587d0fafe47b31e008e158d19b9b8203a8645372cb5a771ce713ad220
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KG0:A3kqPji0Ajg
TLSH
T189256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 614005545d93f43262b1a033db6cec876c350fa9c6122ad9d3bf81905c020102
MD5 d30594d8378374f17e96ec174e635eff
SHA1 f9995d43e34678afb8e504517b6d2e4ac9f39603
SHA512 9f6993573c1f71ec7757951c0797a3295c6a2a800440dfc7319ec43553c150eb0ab97f442973dbaf8f21c6b3d29caecb7656dc2e49f98c5baf8daa522a8007b3
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KVg:A3kqPji0AjV
TLSH
T154256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 f9dc10d264e8427c2668cb6b3893203e9336dc4ac6709bec74d3616d50fbb0a6
MD5 c7bbedc47940571c1ccfdeef2689271b
SHA1 e0db47ba11dac0bed63f921cc771a43e236faa2f
SHA512 3f8aaf34c88dceef7a19c55e747d4e17d945bf621623d28757ada7faf22bcdb0a1b78c4f48224c5c57b97fb8ec5639544cb46e7616978ffe5fe5495dde0b6376
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kkr:A3kqPji0AjX
TLSH
T1A2256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 240ee20b1ed0883ccc650b42b06ea2a2525f68495456c4a744f238a0a3317ce6
MD5 3891834d33c7503ba22671444b8d81df
SHA1 384ac760cefca4be3486e3600cd83f82a77bc29f
SHA512 695cf7866a22bbe065ab86eec807319e98b2e0fa5080e5e59b778abd260478a7c37ecb3df1d88e0a14702066814d368f37d7168f512bedf762a289f63c255d41
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K6n:A3kqPji0Ajh
TLSH
T178256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 275dde38a9003eb74d99828b519c2c33cb018e8d43829453149df9fea34c6f51
MD5 923bf86e7bf29324c210531566c4ef7e
SHA1 5f716e7b4829c8b3f6678bd42150528a1cf218db
SHA512 f7ef14be0e40c43c34982f4da0aba969d6552186a7f7860a3b7f587a0d47d5d5c80fe03b626d3a0302de0997391c91f0a71ae79183b61ae26d23ff433bfb3bab
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KQx:A3kqPji0AjP
TLSH
T1AD256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 a9928f0242b447d9537cb116e6449c5a7be585e935abd0314b69141a55a5417c
MD5 d6e1c0c1c0898021a536b43ef10bee2f
SHA1 11f23ef642273eec08b6f52f4476923497db3f1c
SHA512 3328dba13180a42dad3d20818d78b42ec3ac861abd60ccb798e056af35e5168af31f2a0aafb990dbbda176007a3e69748b3acdd46784bc62046b0cf846d2f5f6
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KSA:A3kqPji0AjQ
TLSH
T1AD256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB1395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 15e36d5a21bde62f68b2cb4692b9c5a646c210273ea7cf6c7707cee1da152795
MD5 546abac01e21ce68efc8f1846d0e6f12
SHA1 8aa0a3a1bc77c049c631e6797c34f5c2fa169a2c
SHA512 43bf0e1c91a1693c44aed2ed5ab4d85b50b67ed76ece253917ddd557dfa90c2b183fd34eb1f8edc9f73a15a0c680a779e3d3134b293a728be7a2bca6151bee98
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kr9Q:A3kqPji0Ajp
TLSH
T13F256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 4a56892f01360765aa55c34f90eec981122e3088ac7a405f5833afc5cd549ce9
MD5 5603b5b1979aae197082f22d2224f48c
SHA1 2df998ba3631cc8744a1013196d759c88dce2209
SHA512 00cf8446b58eda3bdf3bb0cb79910051766a15d99c057ca148f99533f8e541907582360b6d75672facd749272e8fe695afba1956531404d1d0e347d51fa5b956
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Ka4:A3kqPji0Aj+
TLSH
T1D9256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 ff4bb5367da0313099cfdd8e599ac1d68ee7d0712460a61a32497ae0fe098904
MD5 d7451cd5947fb404949c09e1eee7b398
SHA1 0f5fc2a73e403c4cb66b0eb340489ba462ccaea0
SHA512 65f66846ce847585b7126a7df58d1d11b5fe0bead31fa06c212db4eb7a8b91ea5cf0b415ed66b582c9e16384fb8631757d519233847801d3f4f020d71e883090
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KBu:A3kqPji0Ajf
TLSH
T1E5256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 0e541f481188c07a681a30ea27b5e01173ec5a66b48f637d16093031b61be01d
MD5 c8a74a246b4082d8bace2a77f4079ffa
SHA1 b999030d70b363e4c6c4803457f5aa36243f67de
SHA512 e477cd644fe98eb6fe6c904e135bd939ff933eafd5cff79f1b896f90c8aeb5aafef227481ffc2f7c4b236bab2c2719d40e25c67aafac410e05c3a8ec909134ee
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K0j:A3kqPji0AjB
TLSH
T113256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 da757ceed552af342c3c425b4e87bbeca49ceeaefee961b493f70007dc9aa98e
MD5 aecfa06f75e36e1e3a53e9b01b568f39
SHA1 f1736b90e0fa7d81dd494d9efac327918714fd91
SHA512 35e0d02bacd163f553ac7c6a03e9f78ce85644eea2a5d677b7bc93ed2a8c219e823fde0eb85bae0097ec60044e6920fe401fcc6e28e7f7a8aae704ac96aa5519
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K1g:A3kqPji0AjF
TLSH
T1F2256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 a0c51b40aa80e04023d1ee30c9128a8ee92c0db0614952e585d97cc52bba18ad
MD5 fa77ab3550903647b54dac88f527c79e
SHA1 514c19b6cc62bbaa8d8b46c208fa7920dccc4369
SHA512 378e9b628b683a9d7f81a23cf45c203114ca0774a099d4b2bf5709b7fea62f664d759970f9413dedbc835bd26e9f3927a57f575d601fc87d6e2d4512598bbd39
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K0I:A3kqPji0Ajs
TLSH
T1EE256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 1a04c285645eff3b2ce1eb0875e3ba25bade47b36d5939e53175544b5a18183a
MD5 1f0db5b1e01841ec71abba395e57a1e2
SHA1 77566392178374a313257e912fb2ac57610fe36d
SHA512 b1362de68d68f8ac54cb47ffb7292d57ce70b48756abd3f8a0cbecc12bd93dcc172aa4d4822e097de2a2f9393ff8e3686e0a639c26dcf5f75ce6df51969b056e
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87Kmo:A3kqPji0Aju
TLSH
T104256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 f73a38663e20590e3908624d6d53f7268a87efecd2083fb1b86af5da26d08356
MD5 931836d3773cb9e1933784c8a739e469
SHA1 27782d334bfb8724764226d38cf6d750e244325c
SHA512 e3e9bb2001d0623382860bf968014e6c3d6d58c7692ab1ecdc14b1237b98929724350f7f444c0bf26145edecb9094fddd221779232705d3d558c35b343b46fa2
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KN+:A3kqPji0Aj7
TLSH
T18E256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB1395D7283F67BE5963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 e163c5e65bfe95fccf7df6eb1b9f57896040e8490dbf0ca5e14b946c7eb18e24
MD5 0b0810771244bc26ac6e4d97d00c7b11
SHA1 1350a160d29ae94b254e3270cef844afef482c3d
SHA512 93b8f2f4f3199fbe714ed93a3a276c9a6f6fa9392a2e3ea706dd50daffeea14728b97a662120039b1f7fba383b8dde47c3ecfbc77327e6db1db4c6f924ce841d
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87K7Q:A3kqPji0Aj/
TLSH
T181256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB1395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 9d658cacafcecd612c9c13f65e64796e61e9d290e45acf67e574c0e6c247de44
MD5 091a63a6a551771d1d998e44c2403e76
SHA1 705335d868c1b57c63038ad19870bfe4da917cbd
SHA512 b0e4a7afbf61c5565b6ad73c4576c864c1645192c6567485ec70866435e320ddb727e003a831f3c28a557b0a472d92156291ce85cd5a6c4ef54f10124a5bd422
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KwX:A3kqPji0AjT
TLSH
T13D256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 7c7745d692acacffefd178e2ce18938d5d7d94499187211010beeb01b6faba66
MD5 fdf26bfbf22cc2ee2ee4ce05a2172f62
SHA1 07bf852001bdf9641360839680d60edeb21fc702
SHA512 61a3a57c4ea62acc2b79c18c23715b40203482053ff15b15b4215d5b6c95377468d1bc99d555acf78bbececca5ae5f8b2aef8ca7f7b48bd73e41cc69924eba26
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KGL:A3kqPji0Ajd
TLSH
T1F4256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 4b9cb9e5ee358c3c52c48be5502f46d0bffdd664706edff3fa806e9481a3aa83
MD5 e302a9cdc5039823d21615f8740b8939
SHA1 76635795c93c3f623b35ed2424a44ed01ba51d9c
SHA512 37c4944f02d867cd2a51c31e733975bc01d607727d5361b67fad53d83650d39446a560ed950e9efe33e4294446b50dc0cd1a29409b0db74b084dbaa780eb1a30
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KaM:A3kqPji0Ajk
TLSH
T133256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 230980da6f7eea32fe7b4c59d1d2da89e42d175a81915c654d3bc5c93310f72d
MD5 490884601774d0f23f7295f4c31721cc
SHA1 8cd9644b7807303fff3272768c4b9ff1aecd71c2
SHA512 d76516d51d2bdc775282c5840c2b4c67ed857640b37a238af9de636ef7e30fea36b0de5045d51d0ab761f41cfc1b5f420f98ecadd63629fb306a1f65d38be27f
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa87KLh:A3kqPji0Aje
TLSH
T13F256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1492-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1492-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4324-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads