e14513462e683471b7335858474a785465806fa7b21dfe10cb78ece13e70e2b2

Analysis

max time kernel
105s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 943KB
Sample260802-wk361adf59
SHA256 e14513462e683471b7335858474a785465806fa7b21dfe10cb78ece13e70e2b2
MD5 7b7d5263d4e7a21ac57ccdf71cd36bcb
SHA1 41fa3874e8822999169184b2158e4f24c5a64e1f
SHA512 20d6ca8f1fd5fb50b54191d260516f8a374f912e517873bf08fc3a4e88dd55023ace11d51894abbdad54cae32f1fbfb6dc22667d6e14fd5ce7dfef69f736c461
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyp:A3k03kHRJi56rE
TLSH
T1E5255A07A6890FA8D11FC1748A968662E7777C121F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/4608-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001b87f-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4608-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4576-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018992-200.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a6c-256.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-481.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-512.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-603.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-725.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-793.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-914.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1244.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1348.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b00000001b87f-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000018992-200.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a6c-256.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-481.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-512.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-603.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-628.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-725.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-744.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-793.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-843.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-914.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1081.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1132.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1151.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1244.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1329.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1348.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1373.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1380.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4576	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4608	2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4576	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_7b7d5263d4e7a21ac57ccdf71cd36bcb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4608

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 943KB
SHA256 e14513462e683471b7335858474a785465806fa7b21dfe10cb78ece13e70e2b2
MD5 7b7d5263d4e7a21ac57ccdf71cd36bcb
SHA1 41fa3874e8822999169184b2158e4f24c5a64e1f
SHA512 20d6ca8f1fd5fb50b54191d260516f8a374f912e517873bf08fc3a4e88dd55023ace11d51894abbdad54cae32f1fbfb6dc22667d6e14fd5ce7dfef69f736c461
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyp:A3k03kHRJi56rE
TLSH
T1E5255A07A6890FA8D11FC1748A968662E7777C121F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 34871abb3308184877feb3d1bebebe1049b2b3cb8c52b48b2f612bb95fd7dd94
MD5 42e7a66a8341d6ced00870e2d376fac3
SHA1 dd6a608e0ca8ea8085c698c5f6abde2dc6af0992
SHA512 2d974907bd0a8275afa3615e2e6f7275b25525718127818e6f276e75f1be125cbc3eab6ad6c9ac2bfb65643e84434f9c7f3d002fe8f6301c0dddfae6c2c90640
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyV0Le5ji0hmxNrM:A3k03kHRJi56r8Pji0Aj
TLSH
T1C5655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 957KB
SHA256 95c4a5da5ed47bbc600d0f8f158acc75cb895d7d21ff30f9b6ff4d675735bacb
MD5 ff3049d3e295ebbf0fe35cab06de8d54
SHA1 73c7c219c13a7a2d3058d8a79681c0fb71a147c8
SHA512 34292a2d23a68cbc4b15097a34fe4d49a0127206aa566bf72a377eb30080854966139fb1008be0acebe96e846d3e230407d43f485cc3af8ab6f7f4e6753787c3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy3a:A3k03kHRJi56r
TLSH
T144255A07A6980FA8D11FC1749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 966KB
SHA256 38e162441d1f2815ee25284e5d807478d35c607f81d1fa888b27bc597912e633
MD5 da087c747615f15edb3b1775413fee3d
SHA1 7ed09d79a3b7580422957f93f1d099e9f838ce27
SHA512 ca86f4ff1f1edecf79015722fa080302dad22a278c7aae1fac934b4cf1bda437fceee4b4d92cffd9030f8ce3d3e2e98056e11b31c7a6232c3cd04fddf180a413
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyHZ:A3k03kHRJi56rS
TLSH
T116256A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 966KB
SHA256 d9e10e0596a82487141eb52b385c62342d0a680b86c4b72a019ddcada08e9e72
MD5 37386e7a27be2a9d562f24778fc7f72f
SHA1 df288d2edabe2e271cd792f6f8dd21486bee8bd4
SHA512 6458e9370ad54322314a7420e8fb2efbc08a461ebebabda3b40f5236a3d9f32db95518eeb9cf0545717d8a82d90f61a51b53604622b40d1bc2a98cf5777eb045
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyc1:A3k03kHRJi56rN
TLSH
T143256A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 966KB
SHA256 336df0818394a0c723e3120dfea6f18e7631cc2ea2de0af3c1ffd9e7aefcd73d
MD5 ab9ffc1c59fc353f8812aaa7c92458a7
SHA1 47b4592820169fc3166e2119721d64f1ab5312e3
SHA512 2eb9f9ebad2f357c9ff070c18d411269d924059e45d352e5bd888fb42e17f1d0e967b8d37c8d7e6c08c6c3b15e2040d374a07ae2823ede65b72c4872a3d91bbe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy26:A3k03kHRJi56rq
TLSH
T1B4256A07A6980FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 966KB
SHA256 85e9a38aea897ea67fd33940b062fb43be19634dbc2149505480b4a2c0f52c4b
MD5 92d018e33bedbc7c0aac2d4bf2b48de5
SHA1 2b640d1b32de8296ceb61bef6f70192843def1a4
SHA512 2f72789166a0d68145025e675a2cf296c6f30645cd193c674e5fed47c2013ae3592e28aaa4ba6b2b1872b624c12c7a7ff929223749917933314a9f6569edc09f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vymN:A3k03kHRJi56rj
TLSH
T17C256A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 966KB
SHA256 c795616375e8c91e1874fdb3eb1e1b84b4165075b3a13443812196b3dde6cb87
MD5 93583cfe410441162af0c5efe2b9530d
SHA1 fab38768c8f9c99027ad64e0322f0e55366702f9
SHA512 12febdf7a062fc0923f5feaeb9cce5ea6a28515c8e2d58eff4c2d5fe750f1999a736880e5be24d2e6217dbf246eec70dd9630a5dca19ac5c864cf26614a2db86
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vykf:A3k03kHRJi56rn
TLSH
T1EC255A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 966KB
SHA256 7df51b4d3605930c2de77306d1bbb78276df15d2a1be65c855df23610d20c9f8
MD5 d7c41cee3e9af5f2b4cdbaf4a4d88b2d
SHA1 119efa5d6609639e12deb1c45188d4ad6cd8456b
SHA512 559925fb2bb5338bd206be6f971f602dfb88e0c5477a7ac4bd0e556cf574d0059e5a51276970ff220717a87983f33ccee16c2baa537a72c4e07224cdc6c7c2f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyOo:A3k03kHRJi56re
TLSH
T198256A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 966KB
SHA256 508c0c9d4fcc2f332641ddb36f668e3f94adc18c9232775fdf34faf3a2fa76d9
MD5 66f6119459ed248c91cc584c7497e731
SHA1 ae505765681dc338c1f7e4450dcd140a846b4738
SHA512 2927f693afcf49fae6b18a3737bd885010f5e1a76aabe9f14c015ceeb51b4f1b027b8e95ffd16dae7c77d9728b77ca925360f24bb9a51953c38e1cad0b9429f0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyiu:A3k03kHRJi56rY
TLSH
T128256A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 966KB
SHA256 84e22051fe779a721be50ee64e3d1a5bca5fea96c83217b15553064b6186cbc2
MD5 c4f7ebd0bc1f5fa5858ca3d3a7e24948
SHA1 99dc7c4f6e98ed55495e94f29d21f97511df86c6
SHA512 1e939d573150551f7175e2562871375f16ec36c4d60af05acc57f690b635e93e0003f8d1f5cb47f8752ca0190be59990c6ac30b2e56acec3b1a784a380ddcc29
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy29:A3k03kHRJi56rN
TLSH
T133256A07A6880FA8D11FC1749A968662E6737C121F2097CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 966KB
SHA256 ae78181dcc4c6f229facaa7cc0c90fe9e330d5afb1ea0be3481cd5df926c0225
MD5 facfc2ff70894ba82782fe564cc8b749
SHA1 94faf7d2f5d383d027189b5afe545db4c407cdb9
SHA512 ef429eeae1d4134fc18c30f2579d7162d42c78da0c85d374fc5b8a437e0488b287b4d5aaebb66b4ab2522c7d5972efc91e6c481d7d5f07b1426a6e5014b60111
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy2c:A3k03kHRJi56r4
TLSH
T173256A07A6980FA8D11FC1749A968622E7777C121F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 966KB
SHA256 3a8847f1adc19a59fb15146f20b371a923b4aeffc41d598ba1d5c1d09376da85
MD5 484fdca3536f7ba67ed91f17530e4470
SHA1 9340f60cdba3fa29734e23ed8ee663a16d547874
SHA512 3382ed90f645924d7f7e62122d67aa4b7ceb850eecff07df24fe996876ab01ea1f78e6e54fe8249e0b63c278bd2454b96991061947c9fe443b33d7ed210155aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyvp:A3k03kHRJi56ru
TLSH
T148256A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 966KB
SHA256 c364a3d959a7a92cece06bae94b678417ac5a78c7a40385fa78651517cdde8a7
MD5 61eb3f91d279dbe1236b753f6f40d0b2
SHA1 ca53d7b8e5fe63ae6c76da805b27ed97a6cd21da
SHA512 20851f80fad7c2286cbe95853d473e823faebf65bb5b0770d6319c02531180ef19c7ae6e07cb53367f16efd31f64684df4e3f5492b564c57ed5f16dff879738e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyQN:A3k03kHRJi56rB
TLSH
T10E256A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 966KB
SHA256 36897c0984ac845308d4242627c32b23572462838e3d7d07a20525eed1c45509
MD5 c7e7f94deedd817c0f63adec59b9483b
SHA1 432ad2489ead05d5938089fc775fe0a1a5ec2fc5
SHA512 9891d87d18710ab40368d871bd2f8b5f6e159f70802ad4c78ba87ff7bb5060b8240881a8dcf5d9664d5f271452d76773fb82e77c49d9c1a826bb499d2d76505d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyYF:A3k03kHRJi56rT
TLSH
T12F256A07A6980FA8D11FC1749A968662E6737C121F2097CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 966KB
SHA256 9ba1f5020292bfb447ee942d6d320a8f394fbcfe01d2c2e26febee1907d997e3
MD5 4ff819ea8346e8d6ab63541bed3ea605
SHA1 acf0b261d8ec423f8123d95869c94d313f400877
SHA512 0ec2d2351c5db1e76f3ce747a7edca79bdf5120e8768e5eb5639e11715e6f3a16bd26739f3fe6f4469aa50bf0dbeaeeaaf44809d7714743fceb0b6e6ec370fdb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyNC:A3k03kHRJi56rP
TLSH
T10E256A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 966KB
SHA256 04389ec67fecc36fee9765257b2753b8aa8ad69eb14e16732f4fa5c8ca09d9dc
MD5 dae9e12cebb394c24aa1b2b098204f2c
SHA1 84ed95bb65ee0f1968f7358612dc51ebb5cdceb2
SHA512 2ff7dec7e257e137b0e56e626428b3c44a3b82b9eda573cf060c13f1bed6861f682736f8b49cc8a2fac3f52543aebdd8099d28c75b8b8ce6da37d8e11cf331a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy2w:A3k03kHRJi56rq
TLSH
T154256A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 966KB
SHA256 bcc69c4b266edb9bf33ca3132022562b944f7a14fea6da538e58369c875288a6
MD5 ee2d4eb42eedb5f64e2c9611a97fcb76
SHA1 899f8c91d4c5b7dad42c20aba94cbf4f32a5163e
SHA512 e218d8a554b0438038ce7d8d6b8813fe70de0857f5588c9468d236b0e95a99b93f638ac7b625b0d3ecba9a611c1bd9fc03ae57db92abcb30e24690980258568d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vylT:A3k03kHRJi56ra
TLSH
T1BB256A07A6980FA8D11FC1749A968A22E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 966KB
SHA256 cd7919e354cd45e14eaf302bcb476cb47583c5f431e6cdbe1700e56557c9e6ff
MD5 5a24c19acc99cbb68cce316c499613e9
SHA1 ecafb10a7ab7fa6744d2beef0e042e3a15b712ee
SHA512 1445c555a7ffb789053707b00aa9066779f5675fea0376210fa51f059b8825903c95d944cbd4cdf3617b6100da9c1c38d144fcd22621b9ee180a64d7e31ea6f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy7u:A3k03kHRJi56rV
TLSH
T1EC256A07A6880FA8D11FC1749A968662E6777C121F2097CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 966KB
SHA256 31cccb9f77780e7c80c0d43c5985f3a332126a8eb2e5e449d2117724235ff2c9
MD5 fb0e9ae3db4b1fa0cfa26732f68319cf
SHA1 5d21ea2b84484c83eede72b072d811ae17b9f889
SHA512 15260db56566ed349d44042609eff1d8a3cc4a063ae7a7b1b52f3768d8477acd6c78c56d38dac18c7b61e15bef7dce4a9c98f2ea1032cfa2f4e4ef6e82154e07
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyfb:A3k03kHRJi56r0
TLSH
T170256A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 966KB
SHA256 3b60df28bd8447de317c11ba5d86da2fd1d9aba881ae86f4d23bbe911e48b50a
MD5 8b36b4d15c2ded824bc4781c9641f98f
SHA1 a54dfab29c951860a3b59fa259a026969d8e7d2e
SHA512 62ddf106e7526b6e26603ff5da3f2a45b57cbd656c9304229458f228e89abe7315a1556b1be93b932b3e668a4c145358f0fb81b7b92a0e57e5dc15f32922d5a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vybf:A3k03kHRJi56rE
TLSH
T14A256A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 966KB
SHA256 b6cbbf6a4ad88b8589db97450f39bdac23598f116f88515c94f2e6f0279a85df
MD5 705bcf829332650b958f14ae09dfa8b0
SHA1 13415351964b01063ca6ed77000000f98b2f8738
SHA512 d6bf298e68a30124df4cb7c8225d93ea38a208b7dfa2cbda659a86404b810e784b5561b594969ce93cd3e6fe67c81e2f6c06d1bd1953a72350e18cef83a17be4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy0K:A3k03kHRJi56r0
TLSH
T1D4256A07A6880FA8D11FC1749A968A62E7777C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 966KB
SHA256 a784a08865c746042d37cf97479e537b4255a35ce01648b0b7a964c28593247c
MD5 051c1395619786391c59a9bd04d26585
SHA1 a159a0561e5f58f4ae55c2b5ff6b450b73d07dd7
SHA512 9ef4e50df805cc2d0732961e856f7fdcd991fc486428d37a2bc75b8ae635873a84cf77c00002c9f36dfac0fdfafca162c064b021cb26bd3558551067513cff3f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vypk:A3k03kHRJi56rN
TLSH
T11A256A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 966KB
SHA256 ab4a986ed91fa843392a7f815fa739361d52a5f79ac59443441944f90c1792e8
MD5 b85019c5b64eb93b648bd3dad9477866
SHA1 052bec8963d6b2d04e6169bd0afe9c797edf58a5
SHA512 07034c43b6dd52eab9c995788adcd39079a1031d1ab22a743e36390781dcbee12fefafbf7fc72031188d64853e6a390cdaaa97f54a603ffd8320269d0157b96e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyG0:A3k03kHRJi56rw
TLSH
T1DA255A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 966KB
SHA256 10fe6eb1fdb5152f09d58e67967512f65e7acd21d9173dd8dd122eb58243d110
MD5 1d3820e9f51499a927902b19255f6c8f
SHA1 80acd10667481414d4dc312c8a2e2a68a566b0e8
SHA512 f870f1d2acfbbd90603c67bbd8561589b4cffc00a8428af5ead7f7810c9ce3601a20ba774dd0c015f586e8c2cd0acc0f0d2bbb34e23b988f1f76791dfc85ffba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyVg:A3k03kHRJi56rF
TLSH
T155256A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 966KB
SHA256 10f98e91e8df9de61f82f5733e1eb97426a6bbafe8cfafba8edbde74975d3d13
MD5 bab7bdf5db73dcbc7e558d7d3798b96d
SHA1 81a01e291bd62293e5cf1ae0a88058faa2da78d8
SHA512 a02290be1d4bebdd61dae8f2bf4550ebdab97eea78a794630a61b6d6b0cc7e23d292ead8ea564364aabae446db5b6f7560e83774b4e3b91cbbc4901f928b5864
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vykr:A3k03kHRJi56rH
TLSH
T18F256A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 966KB
SHA256 87ef80e722aa6518d0998d02bc387032eda5fab3a5ef052d689e87cec6a13389
MD5 94932bc7ae83246591b76e363d57cea3
SHA1 af3c24caa8293675f289841bf6cd263b37aef3c1
SHA512 e76551cda953dae413d4072329c357636ac35a1ecd3016b1b84ed32eb9309e754723272973480b19b4614b6f2c9fd96e835aaa374685e6a214772044b8256912
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy6n:A3k03kHRJi56rx
TLSH
T1AE256A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 966KB
SHA256 049d1f852e01406d24935fb0aafdd736e8b0e9891af6de5c58fe7356d1ed503b
MD5 101b4323e6e8b42e28b73833db6549aa
SHA1 34644b36798267ca180ff24af54916f334ef4d33
SHA512 a99b1d7ff59abaa4d740ffd7b187f24f63d9f6e79542a5d6bcc4de37d24ae92eb1a155f06ae6d9875908ceca9a057d3f0d2178253d295fdd93b9137a132bc978
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyQx:A3k03kHRJi56r/
TLSH
T1CD256A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 966KB
SHA256 aba4c20f3d54ac6d2c0ca4e71d07e5270ac57e84ca37865ef0a5604a2f44481e
MD5 46553ee5a80fd8b05bfa0f5e17c08a6b
SHA1 f9aabd9da38493c64c4b5b351cc7f1fff58eb5a2
SHA512 11100a376baf0e7626630e4d966ab91ba356f66aac134b6499177425f00c4354171bfcd09b355faa46c2c7c657fdcf7d5d640819451f69360f4bc47539bd2bb0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vySA:A3k03kHRJi56rA
TLSH
T15A255A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 966KB
SHA256 8f55de3ac34135fd9b94d4626a5f3c794d5b75c0a2708b614ee338d01effff40
MD5 8f740a0584651cd2d2860f9f3d52a193
SHA1 a0b17a47ff8e519e44cff74fd337cbd5e8db9424
SHA512 2b46582ff0e6909cc9cf96e356b75bff77f9d27e88f36fa987d1d87667bc6d246cc505eb69766a192abbfc272088c48937490664295b73d038020435d9eff340
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyr9Q:A3k03kHRJi56r5
TLSH
T1A7256A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 966KB
SHA256 ffb15b66bd4e51b0f1da5e204db23a6c2bb208b27c06a8995584ee3bbf2022d8
MD5 dcba6b05bb32b65d57ea8413188c1bdf
SHA1 c3fe6934c4960513a2f8cce65542800a060ac156
SHA512 b56742ca98df556c1aaa4904ead1d6b10730cc82f0a34415c1eb4eb4be75e8d152b4ca32441d0e5b0311e6f6cb736b6317ea69c9d73ff071a4a25ac519ba158f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vya4:A3k03kHRJi56ru
TLSH
T108255A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 966KB
SHA256 336b20835177bd39a576f7f7a707b807dbe5b79e29321210222a2a8f0b78c5a4
MD5 7dd18be8d5e784cc4763a4bd4ae990b6
SHA1 754cf205d1d240fd76c3f4ef1632e1ca77d52291
SHA512 642206f9698931b41c9f610456c67cdfdef628048119004179d53223dab2aa08e0018936c0cbce897eb68eb8394e6cc8d00a0edfb9e8bedcd4d891f1d9e2863b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyBu:A3k03kHRJi56rP
TLSH
T162256A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 966KB
SHA256 19b3c9d32821419997b97f58800f767a469c717f1c1ea5b07d1038f23ddafc59
MD5 2d8184e2e6623ad2e856bc35b3f795dc
SHA1 ed73b567838404486286a1641c5b7d99b8476bc4
SHA512 17b1c19078842478790efbaf5afc3c2158a13fa4ec42b101d846ef952ef17f42907788a9479e9ec8f6f96e554965d82a48478019116c5a47d84c70efed3e4edd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy0j:A3k03kHRJi56rR
TLSH
T16F256A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 966KB
SHA256 8017526bb9405ea9ea898abe108635102dc6e40b892ab899a4324008503d70ad
MD5 fe08cbb128b450a60b0ec99a190d3460
SHA1 cb1ccb05834330b008c598cd43bd5f5e1d11b5eb
SHA512 99bdd5dbf4abcc8fb00d41a347752a0b07d51a9e1c30fab26f561c15fbee8f44580069f1349077199a3e88d84a3bef3b1eca7e527156ab99241a3f6c3e92adc9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy1g:A3k03kHRJi56rV
TLSH
T1CB256A07A6880FA8D11FC1749A968662E6777C121F2097CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 966KB
SHA256 71426335505839aec2fecc5ab7dbfaf5eba0f4a06bb1dbf96245cd3f13c10ed7
MD5 03434df247d4782cd9928d0e2fe14787
SHA1 fbe02e41f6eb73ac92875655d8d35ace4856b229
SHA512 580fad3a30c9ebd16c2fb62a447bfe89075562eb92d337866e0224d3ed7bf2a5aa0e76dfbefdc5fe66adea0f63bd12ecf4287f62bdef284591dbbeb16f00d685
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy0I:A3k03kHRJi56rc
TLSH
T1FF256A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 966KB
SHA256 2cbe87d727e6d5147e90fe8feae0005102aea198670c64558d030f0775fecd6b
MD5 155a4f650653c6f50736e3fa0e6b9b23
SHA1 b6def92a5d62440beeddfa2a14c0f1dc0de099d7
SHA512 6b2c890595f4ddcf37b1bfb3da030fa2733e9c11e84de79b4299ee40d5e1657311bbb49b6b684eab3f9c01651fcba384b53c2e18bd8e527e5fcabc80d70fe19d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vymo:A3k03kHRJi56re
TLSH
T14A255A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 966KB
SHA256 f83c637f43de4ac51cad51097fa44b272f8e2cd6c235807453285f05b0df49d3
MD5 2698faf26616565cdf9b4e30deea40d7
SHA1 93fe676bde7ec37717031a4c7bcef7a1c4955274
SHA512 3bf592fb5025768bc78a8117c4e8c9b553a5a9869fa62ceee12f3059666ad0e695b827077043486d18f5615a51011ef3f77d2b7ef1d9e43db288411dd7e609d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyN+:A3k03kHRJi56rL
TLSH
T138255A07A6980FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 966KB
SHA256 2ebbf34155f68e18c18a4113a7ab9b060d19d566f9cd964effc64ec17029d06f
MD5 a967543b820a70fbd312593be78be5d3
SHA1 cc256b40cdeb9b0918fbd90bc4ea5280bd0651a0
SHA512 60af55256595c5aecc0a2c1691acc32e8db4c42688542a8db9b5784b85506370d979b771e8ce4fe3a238c20d5f0520acb352a326f06ba74ad0d6ba97ddcb74f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vy7Q:A3k03kHRJi56rP
TLSH
T1CB256A07A6890FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 966KB
SHA256 bfc7205bca222689202239ba351cba4f432b1f3f28ae0333c074e2c0f914ce4a
MD5 844493e27cef08bee07750470129314f
SHA1 0ae922405ce3dff7dcefd11c378fd3d2f207d771
SHA512 12959d740a160341647f64a4f9bda4b69a2547abf1989174aa6cb8ff188e200f0b9756477a7e9da744aa77f166ac5def58fa565820ea3bb36532c61096143c1b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vywX:A3k03kHRJi56rD
TLSH
T11B255A07A6880FA8D11FC1749A968A62E7777C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 966KB
SHA256 3d5efc851f17a302cae72b6a17cc806e784d23232a053669d1f0d06dfe67088e
MD5 4ef7807ba9d9c73420f3bd218039ca4c
SHA1 4f602def271767b109b765e568f3eea1e5a75e78
SHA512 e35105e09d63c68e66a1c92b066fc4a8103dd0725b783f8240e6804d5d98efcf43b92b44b37b267c9965ade0f2c0a4dc4793ecccb34ce048816552c5cf930d94
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyGL:A3k03kHRJi56rN
TLSH
T166256A07A6980FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 966KB
SHA256 d367e45d5fe9a31ae4d83e7b31ba6aae1612c52ad97ae4798f43090b6419bf7c
MD5 1d28dd3c2098ed50474a3f304065516e
SHA1 5b5dc0df23bf4df58c7fb46048da4e89779bd2fb
SHA512 7489850227a446dc2eeebb328608a5bb7b9f5d4bb361c02ac7fdac0fcae587266d59258b363ff7863517e86ac2b8d9bd9b019484a0518dfcc988d88a68d2cf5a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyaM:A3k03kHRJi56r0
TLSH
T1A4256A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 966KB
SHA256 1cdd63a20895babfe1e0e7c8c2697a3de6c2c386c470d10917230562582c54f4
MD5 e8106012bf288ca7c99724273ca8d0a8
SHA1 26afc01c5b4f87032fe8329a8a025d707d57e97e
SHA512 dee89cc7e394c98db6bb18248123ea83fd0a5ee8c347a27f9ca84ec291264f2eeffbefd22c3db8871911ef7a5a446b2daac7e5453aa123f8f5437dde30091a0c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vyLh:A3k03kHRJi56ru
TLSH
T17A256A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4576-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4608-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4608-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads