9b0b0f2ae85d2bd19ce333e63c042936f7ad79dfc99f0b18e10b14a07945f552

Analysis

max time kernel
95s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 939KB
Sample260802-vtvqjsxdrf
SHA256 9b0b0f2ae85d2bd19ce333e63c042936f7ad79dfc99f0b18e10b14a07945f552
MD5 aae3042b4845da38155480119df6e045
SHA1 c9027d95ca0dc0cab9986607ea363c150594f8c8
SHA512 c72e690dc684773229bcdf86c2f168a52b4337d327013b659520da4ebf47364ed8d4ae62c55740c776bfb0f26339bad97ed0b735ee884dbcd612e9fd2f865261
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa8176:A3kqPji0Ajw
TLSH
T1F9156B16F6B44371D073C0B9C5E2A69AEA71348217308ACB4395D7283F67BE6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/984-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c71c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/984-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2812-185-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-458.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-714.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-996.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1039.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1071.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b00000001c71c-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-57.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-222.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-458.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-495.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-714.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-739.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-996.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1039.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1071.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1127.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1368.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2812	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
984	2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
2812	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_aae3042b4845da38155480119df6e045_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:984

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 9b0b0f2ae85d2bd19ce333e63c042936f7ad79dfc99f0b18e10b14a07945f552
MD5 aae3042b4845da38155480119df6e045
SHA1 c9027d95ca0dc0cab9986607ea363c150594f8c8
SHA512 c72e690dc684773229bcdf86c2f168a52b4337d327013b659520da4ebf47364ed8d4ae62c55740c776bfb0f26339bad97ed0b735ee884dbcd612e9fd2f865261
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa8176:A3kqPji0Ajw
TLSH
T1F9156B16F6B44371D073C0B9C5E2A69AEA71348217308ACB4395D7283F67BE6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 92d9b4df1021419aea2159b50db9a881a03758a05b14508066f83adc220613b0
MD5 cd3500176bd4649ead98fb1f27842cea
SHA1 5e954ecf9818e569a55370cc73761a0acbec38fe
SHA512 c57e86c78d7681fb6d9e114ddbb379be33482092f7c749d7840d904b386d0301c0260eb8b7b21fc017387e1cb76110c703b104bf620026c0feae90d7d4b5ee48
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817K0Le5ji0hmxNrM:A3kqPji0AjIPji0Aj
TLSH
T182653A16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D76C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 953KB
SHA256 835164caed4e4ddc21e26f478b37667927483debeff54a6413fb9d353af13325
MD5 ccb3203c68a83b0c241380d49ce09784
SHA1 a14f4d84d290aa90165d6088365d82e3c860ef74
SHA512 f9ffab9bcce58b2d2a6918ad2ab2850e5efa6ddff229fede2b4b8d3e86e0d7e4a8ef2aa66582d1b51de460a3c804c8108634802c301e2f25869406307f7f64f2
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817Ea:A3kqPji0Aj
TLSH
T148256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F67BE5D63A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 e22df407f1db193083072f64162acf6bae01c2daa302cbce500d29f4e00bf219
MD5 ba28f7eedd6a7156bbb91b5773d29e80
SHA1 7db61118525de4d8495b22a54eca7b912bd92b30
SHA512 c428776e4a1ee62a7819c95b119a23ebc9cebb741c9f3e0a60f1a06d68c56fa92bed714dbea7fa53a480d8c4279fbb7401e069f9a7aca13151ac81de247d19fe
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa81796:A3kqPji0Aj2
TLSH
T111256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 962KB
SHA256 74ab1d2a76e1b22948b9d8b2e996397ae75a7fa4169e05e1c99a74e57e897c1c
MD5 bfc5a0a892305ba3ec6dc5b04696e62f
SHA1 034a69f7403f736d9f45ca9fd1d83eeff1995293
SHA512 e03d5a547af1a78d846d2c5ad114c087b6aeef940229c39ec8cf59bdd8364b58fee64fb91cfcaa576072dce9cf5f4a7a65232bdf98613ea5a07c154a4662e427
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817TN:A3kqPji0AjH
TLSH
T1F8256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395C7283F67BE5963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 962KB
SHA256 dc839a230bb20e47d8e71415bf8546da724dcaf8cce71a8e8730c876eb4a80d4
MD5 3056975c25f312a92a8ee428fceed48b
SHA1 4e8a86a0951cf980f518ed9258c879c61e587906
SHA512 7e5d693ef8e44e3b3b961ba338af5be976840e919e31a1af15a8e6533e4d33646e509cdc4402156a1c8bd157717d501dd82eb45dea6e77cab00ee2e7aa592174
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817hf:A3kqPji0Ajj
TLSH
T1D3256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395C7283F67BE5963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 962KB
SHA256 c3c476dc2c98732e00b40292c1a7909a8c015a726db1d724578557c0b175cba1
MD5 770d37706ebf44907528b0889af4e942
SHA1 ff25193c51d8e5a63310d1a2d862955bc9b87d16
SHA512 a5940b1956e1a123c51a00ad6f425401dbdc9292a0bc15ad75a0066632a1076318835f6eda18616fa4066fae56a7acd75a511afc9947a716bdb2628207e2364a
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817Do:A3kqPji0AjS
TLSH
T1DD256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 962KB
SHA256 2e2181bbc7f204a189716c20b5b5e2e451af01e09f8f394cc6f47bf1fdc60fd8
MD5 180a2000a291d12b94f380d70ec65dbb
SHA1 30d2188eaf4f3e89a6494acf8eab5788452ab656
SHA512 dbd2d1389935742a0c5ac4edcb270a31a1504ec2bee1bd0730067074e8a25d42c25c2e1cd13996ffa072dfc81f3cd1f99eb6f532afb6ee73de0880fab6635a76
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa8173u:A3kqPji0Aj8
TLSH
T1C1256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 ff8fb4a7380a11767a7fc6d1855addd7e310bc93e93b8f10e932df2891b38593
MD5 cef0881babb1bfd36319b381fedeb4fa
SHA1 6bc9a50eb8d2b9efcc0cfd11f44444d25982006e
SHA512 eb553e754411e857abb3a2f68956d71063aa163c9f98034820293e15ebe553c7807d58b730cbb0036f747d944b0152c0a047d5c6fc68dc21664e8bf76e42b765
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817F9:A3kqPji0Ajh
TLSH
T145256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 03e6fe70b16ebea9adfff0a5ecf66e496af39e5bbc545a051e235ecd9046b348
MD5 bd9d6f2a599b9e6442443ec0eee0a61b
SHA1 4bf2d2ab702b0b40fe62c256eefa9ca92097391b
SHA512 0e3d7ed4ca6b57eda96738e41499e35905c568b3dfbe22d79dde521a6d16d75f6a1d0f3081a017a962bf108781ad07daf477cd1345094a1634065de79f8cf1e0
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817hc:A3kqPji0Aj0
TLSH
T155256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 924af7f0eaf6148ffccc02bcf8359f26278750a2ea538e29e1b3c3e199406d37
MD5 68552c29e792350956c12d9ef56e9ac2
SHA1 45749c170debe87fd58c4106bec5924cb5feb389
SHA512 ce4883fbbe718839267e833b1091c495d0a5decdcb5ce3777a33d01c7524e0d0d06944658a89161c98a5237c86bce0b9e8bd19887ae27b5dafde553614bc1436
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817Kp:A3kqPji0Aji
TLSH
T17B256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 994d7f3722b83146338d24e7ae6bd89be64fd76a7ab599cc653155ec27df9d95
MD5 1682bf5c0bf94120df02426e95a03da5
SHA1 6c20d45deab7d7d4431621d4315434bfe697a6fb
SHA512 2b388320e44b8bfadf1a10d0e5dd1b62e15798d5d4a0dddcf16aa60c3cafac7cb035caac5946ab99e5d4e5a84fccf07faa65a81081335443e8ef1f65a9958565
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817tN:A3kqPji0AjF
TLSH
T1AD256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 479ecc93f7febce3a7d5ba5fbf7f68282999791a216eab9b1da678dbd116fb23
MD5 37850c15bfb976c38dd13112350d0279
SHA1 552773caaacb199bcbaadaa54dfc17c1ec000ac0
SHA512 0ebd888da8e3b111a44c828f44719cb308b1c294350c484de846b87d8c4a2358504f0651e95dde3be9f47c2ddc4b21680d0d148d10340904f0160535089338a2
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817fF:A3kqPji0AjP
TLSH
T139256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 0cbfbce273bd64140be06cc94fc864425b66870a069deef96e48438afe226069
MD5 8a8bba49da76905e44a766a143c4e593
SHA1 f7482b5e694615924d76dd3c2783afccd62ec16e
SHA512 76d51d1665f33189ddcbd9f1cda6dfaeabfac86606c4dc46277f7ba94b303a9068ddaac8ebb69f112b9802b1bbc0a5b787706eb15f210fe5f9f117d4ba9a3ab9
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817AC:A3kqPji0AjD
TLSH
T1B4256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 a323a24d1a2459d7741b84ee2ff0a2f25bc9f896e23ed0648521b67efb16728d
MD5 9f33c1790d96fd9ffedab259a5b4a7ce
SHA1 7dbabf8b4bfa37d5bf732d67cf72bf9a36bbeff0
SHA512 b8d4d4372b5adb7c6992fa392553239fda8a36bff12cf30a1d86fae20fdbf68fc741a638fca8a8a256b05d359632c96bfd6ecb0aee2d01bb8c27028af7774045
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817Tw:A3kqPji0AjG
TLSH
T126256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 ad329ba11829eb945c87e25e4cee50e550c995789833f484954804a63203acd9
MD5 f785dc9064c181f71f5da14641187ed8
SHA1 3e039bddb7ff97d334554a764d3b539cc80d6ba7
SHA512 683ab2cff66000014a8b65bf3823075a27e65702f9ade1c6760aa959eb7396786f5b6683be2fcd6a4d88ed344a02705880d69d6ddf328a6e7cbddff6533b7f6b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817aT:A3kqPji0AjG
TLSH
T15E256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 1d98dbcfab981259ca06d8a1cd34bfbeb625f7ce70324da567d822cbcf12b5ea
MD5 749663923dd18d061ba4c1e11fdfc40c
SHA1 121f1c60183fbe1d72e3c9cc06a3fe399d0421bb
SHA512 9e1e30cc019708f3b250c25feefc3702e9d2053bb06bcb07170ef778ce2ea7d43e27d2226c2aa0a72a61932ac9ebabc137590a52ec9ecb55fc6ca75a8be512a4
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa8176u:A3kqPji0Ajh
TLSH
T166256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 377e2e1133f6698be7d584553ee241f23df79b866ad91afb46d6d2d387046ace
MD5 90b2fbc93cf6821d3535915202bd713e
SHA1 2ce330a7f0be6eaa4209e2ccf29f7fbaffee40b7
SHA512 b1019491573fffb791bc149bd509b80b0ae57c722432d670b1f46e14683f5a6a1ed5597c2f1d2f95ca6e25556916aef240b2739f6b2f8128c0afd8df99419ef9
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817Eb:A3kqPji0AjA
TLSH
T1D6256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB1395D7283F67BE5963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 d3a318566d8a9010d4b074b0c31f24d9407bb7c479c726c5f79cb79cee1ec2b6
MD5 686605e3c647a2bd8f9e2cc5b4d9a366
SHA1 4cbbd1bce90e2d0505842285fc87a91cc5e8f79a
SHA512 dd39d2fef45d91b1a840139c92fc993cf642bca4394754de079e3b8d695e6695fa5af9e119c1385e2cdd05c776500752c1e12e31ca728bb6993e440c2ed7a349
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817Kf:A3kqPji0Ajw
TLSH
T1F3256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 cdce4863e7a76b5a09dd13a4a04752b0ecc89f30fa1aa37d9990932a57b29671
MD5 a3453bc0a8e7dcad081c866326808525
SHA1 b5eae5ac4a687dd45f66d74859fb9a4a06bab7a2
SHA512 db10b3d7ec158f448efb97d3824f19883412bbe599f321afcab7b1395904425f78e2b0a0fa462a18f6b438a4370b43f5480a4bbc8ca4a12d3e80c8d80388a11f
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817XK:A3kqPji0AjQ
TLSH
T173256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 14a07d06bc4a8a6528e82f8b15c0e8b4ac55bbd01f5cb975c92eaed29a7e47de
MD5 7e1b6631dc9e6730e1322e128526c143
SHA1 8714ca43f5e425adca10c3209ec10e48270b0f14
SHA512 415a0389e1d8eb390dbeafb33d7d7b643e7fe2df635cd5e3e15976cda1a01d916dbdade67562298822c487dfa496fda5c03acaad9dedb4de081463d2a0b49e98
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817gk:A3kqPji0Aj5
TLSH
T191256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 b794c491688eca3febc16cb348d034a7ca9832b8d95c2d474af99d307c38db0e
MD5 f6a170842cb9eac13d673101b38f55d5
SHA1 a40620977e0cfc245c489226e49c94096a446452
SHA512 2e4dbc5902709bc8c279ae79aa002c4dd3ecdc354963efbae62aa3c45e8aaf209b2670112fc9208279c8d4cbddaed689426ba211487826d464697ba34946e373
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817R0:A3kqPji0AjM
TLSH
T1AE256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 42e490b6331b5c099b01ce717f2e1c5bb6afdf04f31eb18df97aeceeee10d730
MD5 5d81f0247773698fda22a0733940d9da
SHA1 3ab757322de77d5728a65e6709651b47f6743cb7
SHA512 f0de133f8b2d40092b379b06b3cb83e7774b07d756541b21f6ecdaf34f26d98f2140efbb2970197d79b62e52ca0cb6be4a8a154aa952f12ffa9ce455038961a3
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817Eg:A3kqPji0Ajx
TLSH
T156256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 d73ebedfa32b942b562c8b60aa5d7a6e1969fc58b7c3ce9ddceacab32d857aba
MD5 ba2c22214d50543ae159df55c6388170
SHA1 b16f3577535ca7e89f331d51099efd17eccebdb1
SHA512 53a37915b39473ddac4c44c1a0c46b11a3815661316236aa0c619739860b3642e230481a05f1795b1d6a598248e31c864d328e1a9c3bd23b6b4d4036a81dcf4a
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817hr:A3kqPji0Ajb
TLSH
T1E0256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 3985ea7c1c390df6e766f36f634e83f1920b9be66eb0252022ce12c31becbdc1
MD5 b6b87d95d6385c1b22c27dac9dcd500d
SHA1 9801094bf37f293079053a33c72b5efbdd37cef7
SHA512 e99646c2dd8fef4e813f9cc9521b1fa69f3b0303d5585b3998a1df9cc52546a7d24c0e769ca897f129366a1d99eb80264b106e4746867ca80797270a946cd58a
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817jn:A3kqPji0Ajt
TLSH
T12C256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 43779d4d19549e28dce4311ae8d6a3ca7d104ca078d5531176c05ba44c4d68d0
MD5 b4ab13af2df5b75d0096ad90635cbe07
SHA1 af562ecdec653c3c76b153d9b0da7416ce7732f3
SHA512 7631a73280f2aef9cd17f2a2d928e2f25137fc83def6c0592d465028cbc7f98cba6e40c6f569b3c5b19f2d66b2db4f37fd07349a67d82c086f7bfe1b2c8ce705
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817/x:A3kqPji0AjT
TLSH
T17D256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 56759e3bdcaf2cd8a0393ae156f7359c4effd9e5703996acac7dcb8fb4469266
MD5 b2972b0ed03e2db9adf18cf9e8dbb94e
SHA1 c0a473760774a61e73bc1b0b6fc66a3ca3ccb9d8
SHA512 84d0a38eb450a8d5394bf85bdaf11bfdfc9fc9bc2b94efbfd08f6950690cb63b3e805f8cd1fc09c0aff4f01acf62adf291806e571f5b116238b3a26a0f1c9413
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817lA:A3kqPji0Ajs
TLSH
T1D9256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB1395D7283F67BE5963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 150b98caca95721ec9ebd5a90a0b96bf602aa60ca3db310dcf650371363d0e96
MD5 47f943438042229fa9e4a4e4c7fe6194
SHA1 c269368ea9380546cf22a5fdcb7b8238b225cc9f
SHA512 13712f9d6fb70dbc6dbb4407f535f9eb6af604ec5f8e75dd3b134e205d5ce3a600c6330df9c85a157639d320eda090276a0f337b846566a02b52a330b7e3147b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817e9Q:A3kqPji0AjN
TLSH
T10F256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 698995b89dfa7a756596f31fb6cebfd0650029ff430f2608d2adb0b67b7de71c
MD5 37340786f491b39823dc469c90363e71
SHA1 df7504d4604ea2a988c828b2ca2ab75e0c8b3692
SHA512 533a9cf07797b67b5f49db3febc94c5e70f6b36ed78a8f3a64243dffab898b659f42b60a9a64192ea9eb421cacb10f7413fb797dff7baccd4c2cb45e91223d6b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817L4:A3kqPji0AjS
TLSH
T122256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB1395D7283F67BE5963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 267f07c4679de57aaf2ca621422593bc273d244c42e074edfcafc152973f5e2c
MD5 080ca84500fb8d5ae694d5ef70c07f30
SHA1 b0c25baaa680b98b8f931b0f2e6fc6e1bc015479
SHA512 769e857b170694f8d2215d432dc24576c4e84cd863514064a3e8146900181f63eba11e7e8b8e97f0a37d848740e1effafbb8cc1df2cf221754660437ef6a5872
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817Cu:A3kqPji0AjD
TLSH
T1EC256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 357d0c82847fd2e1ef221620f7d45e817cc7e38dcfda3cb1e55dd68a9b9c072e
MD5 03564aba2be9d7cef8c49428c7a6c9e5
SHA1 787a176e59457a34f62882a2f3a9bf8713d223f6
SHA512 871578f15dae1ee9d3a8f916b8316420a5ef2bd36aaf4c4cea48601900c11fd1f1103dbc9f211290f08a33d6a55b5ed1cfe15f427690e78e071aa0578397e535
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817Tj:A3kqPji0Ajt
TLSH
T187256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 542a05cea9a102bd945065c98cfdfa527d3c6db07fe66d6fc6e10e64681e00ea
MD5 4840e598ecb64f3db3e8bc205ae450df
SHA1 896e0dddc1ff3182c96729546d5dc13ee2c1676d
SHA512 7a9b3f4526d8f8a02036e4c192e43c645c469294818c5600e9821bf4aeb11d298cad834c028b29691a8d5e62c65993682215007ac22fa2bb1b3dd4a6d3267538
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817eg:A3kqPji0Ajx
TLSH
T1D6256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 5d5f138f5be4e4a6da4ead61f5cc6f08bcf8a9b6715950898bb2f2fe20cecfaf
MD5 35839aa8d5f1edcf42b1747068b1f5ff
SHA1 3bf6e436bb4c3f4802fa61ca709d50201259234c
SHA512 c05cb8976f059c4a69034d1ce9392ca421e8de0cf500502cb16c182ed8c0ed39573e175b69aab3b702199ca8ba774a3d8cd6d9cd6162ca2c4c8895a7631bf1d7
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817RI:A3kqPji0Ajg
TLSH
T19E256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 f63b3908cee54afa92a75f79b22b3679d952458c7e7ff0f3dea6d7a8ec70de61
MD5 4a62ad2e8ecac27f6ad5c9d59ac2d8c4
SHA1 44ce9c8f2ec77f21e665dd213de4f1e0832c3ae4
SHA512 9ff8aa2cb9a094546b370efef450dee8c6393ea7b296b1216f99eb9404b687c444324b106c38db82a79aede06bd44c8a9576515091d7d101f97f53004dbd7e3b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817To:A3kqPji0AjC
TLSH
T1A6256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 1e16eb5ecfdaca18bcbd0836bf8ac471117c402285df07fff67d7ad44f6ea563
MD5 3b9e7982f19a67b49b2e4abf49527ea8
SHA1 e9a35a2c4df372ea8a73537b7b8c24c8cedd4bf0
SHA512 140fe36493b4998d5ad21f04995a728aae2aba8ae32bed597d206b528616f0dc23bdfe0d83caf79a466f78d0f5ce5d5f1406c7f28425ee88cdf97cb134bc39d3
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817Y+:A3kqPji0Ajn
TLSH
T10D256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB1395D7283F67BE5963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 c61aa0a9a700d75fcbd44dd9675ac894de35d840532dd4bf59dae92303ffdcb1
MD5 e6528ab685bd578d5af6cdd66a5eb52c
SHA1 44729a985fe74595ed02d1ddb32932a1f048d762
SHA512 b455a6ec93efe37c9030da4d70f4c13bab9d37d0c6c9e7df2289b3d91be6bbfeed3af36213c0c454413d97b91d657fd7684366553310d402a803c6ff30644548
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817wQ:A3kqPji0AjT
TLSH
T18B256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB1395D7283F67BE5963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 c86e9bc60696821d8ea413775a9b14c30f1c629b1977ad6a2a8e0f08b9656b8e
MD5 40c0782365371e5d591d7ca13159f283
SHA1 f3828eecd0362ded99d9dc18f9d519905a64c1b8
SHA512 170ff059cd6b1610b5b475145af8fc0d0b44a0f714556395fd5aaa706af15fed165173ca50e3027fda0fb1ed0e29958e871ba738bbeabc7f022525cc0c0abb52
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817ZX:A3kqPji0AjH
TLSH
T126256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 c7ebf48e7708ebcc73c8bcb8990b949ca894c584f76d44479567de5698ffc637
MD5 57f96189c429a2a957eaf9811bdd3a05
SHA1 908b76a53d988ff80af0f8e0c5fc28489f404086
SHA512 e214b271b167d49d4d02ca601a0f1c32ae7b9d381c07cb86bd76b1de835e1d88ff36d085355e1edc744c845821b09c9ea25095f7a06bb8fc47a6ee16d1ca35fe
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817zL:A3kqPji0Ajp
TLSH
T1A1256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 a2a183a7a944ea32ac2be123b344a45bb5bf1c991292a1fe9eb9baec5420f644
MD5 27c1e29e7a90d363c7e6b596f1968319
SHA1 78acbfe3c823fedaeff1c16cb0fd81d6031a874d
SHA512 28ad92072d8b0dda2c96a45df30ea2e51c8d99767793be6e3138d734b59f83c0d758f6fd175bb0c15d7450bdf621612666d1afc08050016dd2cf28136c3e7f1f
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817ZM:A3kqPji0AjQ
TLSH
T1B3256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 bbf80f2ad2b81d7c23b5dea4862c653b09e221ada937ce56d567ad7af3b3c86d
MD5 5b020f94bc7958f577dc36c00ee1f98c
SHA1 5a023721ac4d7a0c3ef71286ceeaa8f3cab7140a
SHA512 3b342b0ae55429ffd783bf69d5c71bb323ce4cbdf75a587cc54b0d0d46d93e93f3e48c6a0ba6516d3252f42f9aa289812e644e94de814970d8861efe91a4e00a
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa817ih:A3kqPji0AjC
TLSH
T105256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/984-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2812-185-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads