f482409c0eac0dbc85d2f94b22db3dde63888a40928222e2929b10b1cf05903c

Analysis

max time kernel
102s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.7MB
Sample260802-thbymawdpf
SHA256 f482409c0eac0dbc85d2f94b22db3dde63888a40928222e2929b10b1cf05903c
MD5 fcdbfb5a06697e8aabe146f172d64613
SHA1 8d471c41f201c0ac2d14b2028190554bf115edeb
SHA512 ab3f486264e3abb78da143b2069b1cba40ccc4fc90a6a676094a28fc12fc992710c24d1bd96586e3f24cab9b1fa7fd9fc59a7030956977d46a52b81e82950b0d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDFPZe0p4Ek4niOkl/A04szE8b:A3k03kB56r7eW4SkZP4sz9Mb
TLSH
T11D852916F6784B62D07BC0B5C5D6AA5AFA333C455F3087CB03459B283F276D1963A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 6 IoCs

resource	yara_rule
behavioral2/memory/3252-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c538-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3252-165-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1252-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019caa-1277.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c538-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x0004000000019caa-1277.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1252	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3252	2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
1252	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_fcdbfb5a06697e8aabe146f172d64613_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3252

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.7MB
SHA256 f482409c0eac0dbc85d2f94b22db3dde63888a40928222e2929b10b1cf05903c
MD5 fcdbfb5a06697e8aabe146f172d64613
SHA1 8d471c41f201c0ac2d14b2028190554bf115edeb
SHA512 ab3f486264e3abb78da143b2069b1cba40ccc4fc90a6a676094a28fc12fc992710c24d1bd96586e3f24cab9b1fa7fd9fc59a7030956977d46a52b81e82950b0d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDFPZe0p4Ek4niOkl/A04szE8b:A3k03kB56r7eW4SkZP4sz9Mb
TLSH
T11D852916F6784B62D07BC0B5C5D6AA5AFA333C455F3087CB03459B283F276D1963A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.3MB
SHA256 55c66f20a60c69e0b18a0d9e47a9fd520b9be5c1f922acbaf2c7478b3f9d9d97
MD5 0822795e3bd67dc6370c93cc7c268a79
SHA1 6f57726dfdc0cec5e677fc086800c57cfabed9a8
SHA512 4a798b905d3f7123a06dc17f4410e002f865b134c21996a5d24852088103617bd8e6ee30efb18c7e364ccd7b092e2b923c815246b14d6be8ba0e91281a9819ae
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDFPZe0p4Ek4niOkl/A04szE86:A3k03kB56r7eW4SkZP4sz9MbBPji0Aj
TLSH
T196B53A16F6784722D077C0B9C5D6A69AFA3238461F308ACB0345DB283F277D5963A736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 1.8MB
SHA256 fe0459e5c2342f8c890c4f7b8a3204ca8e932b869a43b26408362abc2824655c
MD5 9844eb6b34bad375e92147cc282c4e6e
SHA1 6b2dce914d88f1e5045fdd62afd011c86129619c
SHA512 6f33e2398e6437c1734e9c473774e3d104a619cea81b0b5f88787fceaed5c2411cb1e0589a7416a3c5fee6eeb959a862583d5976f6ac798f1a5ff66749e831bb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDFPZe0p4Ek4niOkl/A04szE8u:A3k03kB56r7eW4SkZP4sz9Mbj
TLSH
T16A953916F6B84B62D0BBC075C9D6AA56F9323C451F308BDB0345BB283E376D19639326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3252-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3252-165-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads