Analysis
- max time kernel
103s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 03:49
Behavioral task
behavioral1
Sample
2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260802-edscgssxfx
- SHA256 3011dc0310f4febecc02589140d4dba5bface27fb7e9d05a37172cb5e6058206
- MD5 ed1cd906e34e8d834439639e74a101fc
- SHA1 5ebc4c77c7a338c38ce970295f66722a9a238c1c
- SHA512 5a7ca3a2a2298028bec16fe0bb2b266bd64e8dafd20176d00379d77d45bf7c1cb945b33898cccab1ac642bc732cd8f37be13153a9057933053e597689ab9d9a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape2LqNe0Le5ji0hmxNrM:A3k03kHRJ3Pji0Aj
- TLSH T113757C17F6A402B5D067C1B9C5E69A5AFA7138421B3086CF1398C7283F67BD19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/1816-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c508-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1816-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1824-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002800000001990e-676.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000019cd4-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002c000000019cd4-1274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c0000000064c9-2016.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000016b20-2014.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c508-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x002800000001990e-676.dat aspack_v212_v242 behavioral2/files/0x000e000000019cd4-1022.dat aspack_v212_v242 behavioral2/files/0x002c000000019cd4-1274.dat aspack_v212_v242 behavioral2/files/0x000c0000000064c9-2016.dat aspack_v212_v242 behavioral2/files/0x0007000000016b20-2014.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1824 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1816 2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1824 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_ed1cd906e34e8d834439639e74a101fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1816
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 3011dc0310f4febecc02589140d4dba5bface27fb7e9d05a37172cb5e6058206
- MD5 ed1cd906e34e8d834439639e74a101fc
- SHA1 5ebc4c77c7a338c38ce970295f66722a9a238c1c
- SHA512 5a7ca3a2a2298028bec16fe0bb2b266bd64e8dafd20176d00379d77d45bf7c1cb945b33898cccab1ac642bc732cd8f37be13153a9057933053e597689ab9d9a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape2LqNe0Le5ji0hmxNrM:A3k03kHRJ3Pji0Aj
- TLSH T113757C17F6A402B5D067C1B9C5E69A5AFA7138421B3086CF1398C7283F67BD19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 8d1b5f463a81491dc25bc602177ac9c1346e140ad63ff50c54681cfb3a1d9496
- MD5 90a9c5acf41b16982613859879e148d8
- SHA1 81425f47a6def89f84360abd49973efb9b127624
- SHA512 f1c47992ae87e7826a45b1831b5fcf6742a27fe1ea50d8e5b6ef91b6f50afcd97c02a6ddcc3265b37ee15c8352f25ea49f93dcbb7938f5026ab644232b841de5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape2LqNe0Le5ji0hmxNrMD0Le5ji0v:A3k03kHRJ3Pji0AjKPji0Aj
- TLSH T156A56C16F6B44375D073C0B9C5D2A69AEE71348217308ACB1399C7283F67BE59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe$
- Size 1.5MB
- SHA256 6b8cc868f4a2097d239541efef1f5b8553f032c9ae66844d21d56fc56c8be362
- MD5 94ad37f633a1a2fd829f8c94439a5c76
- SHA1 d5843d5f9d09844dfd26004c2d71428cb74ae0d2
- SHA512 e6f03cab7a60013a832b77bca89f70be5411250d80859bdc0587bba2cfe8081c60f426a5006c2f4d410c543b4d6563d5cde999332d925141a694f11aed5ba6b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape2LqNe0Le5ji0hmxNrMlT:A3k03kHRJ3Pji0Aj2
- TLSH T1A5757C17F6A402B5D027C1B9C5E69A5AFE7138821B3086CF1359C7282F67BD19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 1.6MB
- SHA256 e66af38c30bee379caf2f46bd1be0b6ff8df83c45f6048b8870c4aae1425b9df
- MD5 4743217c2eaed7d3cefd0b4ed3067593
- SHA1 146aac068be169b708bba23c22aa4d43eff9a81d
- SHA512 ca8f323923a4932898b0dc05d18408776a4a5bc999b12326e71ed9fe175ddb77b1628c4a3738865eec4ec9153023f0c3a04a1f729d1ee98f51acb9b43dd364e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape2LqNe0Le5ji0hmxNrMPF:A3k03kHRJ3Pji0Ajq
- TLSH T1F3756B17F6A402B5D067C074C9D6965AFA317C821B308ADF1358F7282F73BD1AA3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.5MB
- SHA256 e2519675c16052b23bbed2f06182bcbba19a2b3a6880898d5f3f00fcffdd6cdb
- MD5 c97c6569cc55f0bd262764e50e9262cf
- SHA1 9034294d325fe98cdde2033176f1429a3fa09606
- SHA512 498e7900aeed36fa07c477820e2fc04c15d5ebfe8ba0931fbaa8e3797952098c7404050dffb64d0735a31629724c13c40e2ee903f7eb9be28e7a25d0ae564a14
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape2LqNe0Le5ji0hmxNrMuwE:A3k03kHRJ3Pji0Aj7
- TLSH T144757C17F6A402B5D067C1B8C5E69A5AFE7138821B3086CF1359C7282F67BD19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
- Size 2.1MB
- SHA256 28d802187175bb44b2cad51c54e282aefa4ce0b658b508334002508780ba5128
- MD5 876819b6832a7f130c9715a01d9fb07a
- SHA1 3b3fdd0ac356922ecf54f81232f1bc0cff72c48a
- SHA512 1565af1b3138d636f4741d9d089aafdbee9bd4b34d55164479870a6355b54ff62ae6216db094ace059ba65d71ab240fa2e3deb6743c2bfb64a77ef75f77d0ddb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape2LqNe0Le5ji0hmxNrM9MysZgjST:A3k03kHRJ3Pji0AjwRjvQotoy4F
- TLSH T150A5AD23F6A40175D0B2C1B6C9D5A62AFE35740517308ACF53D8DA2C3F666D1AB3B362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe$
- Size 2.1MB
- SHA256 365320e2b5b9837b4a12bbd80978a8a5b995abe31845dc32b647287fb661d34c
- MD5 c5ac1eeccc732640398c74b87ef4601b
- SHA1 ef7fe77cb10839864f9d7d5ea01792b4f57b5998
- SHA512 711dd67c320d57980dcc2f487ba1d82f5142a417d40d974947019140f1311e3d8800d751ab08c656fefc51d7e6b636c9404eac318009b37b1df51d33b4a39a4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape2LqNe0Le5ji0hmxNrMKMysZgjS8:A3k03kHRJ3Pji0AjvRjvQo0nGH
- TLSH T1A1A59D23F6A40175D0B2C1B6C9D6A626FE35740517308ACF53D8DA2C3F666D1AB3B362
- MD5 SHA1 SHA512 SSDEEP TLSH