bd50185eb7f1bb7a8347608d4269c943f1f85ebf4e100b44c2518e664a058924

Analysis

max time kernel
97s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 952KB
Sample260804-nv94asae36
SHA256 bd50185eb7f1bb7a8347608d4269c943f1f85ebf4e100b44c2518e664a058924
MD5 5eb9d00e36c2bc5f12f30da3f1e90774
SHA1 0b1110f3a064e9bbdd6345a9f22f155612bc67d3
SHA512 741e247e614ccca99e8685eaccf70b0b8174c94984d18b4ef4ed9fcd366e39d8140138e8d4c7608f947f3926c0024209938de0442d05ccc6bb06f322d3e6c182
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLa:A3kM/56rq
TLSH
T103257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4880-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c550-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4880-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1292-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00100000000184b8-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00050000000198db-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-704.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c550-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-440.dat	aspack_v212_v242
behavioral2/files/0x00100000000184b8-495.dat	aspack_v212_v242
behavioral2/files/0x00050000000198db-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-704.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-980.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1041.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1127.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1351.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1292	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4880	2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
1292	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5eb9d00e36c2bc5f12f30da3f1e90774_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4880

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 952KB
SHA256 bd50185eb7f1bb7a8347608d4269c943f1f85ebf4e100b44c2518e664a058924
MD5 5eb9d00e36c2bc5f12f30da3f1e90774
SHA1 0b1110f3a064e9bbdd6345a9f22f155612bc67d3
SHA512 741e247e614ccca99e8685eaccf70b0b8174c94984d18b4ef4ed9fcd366e39d8140138e8d4c7608f947f3926c0024209938de0442d05ccc6bb06f322d3e6c182
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLa:A3kM/56rq
TLSH
T103257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 7628553441c69c1badd664468b1aa3fb52599f8847dc4a8254a429d4241f87dd
MD5 b3a8172c7cbcc23b366f12d3377dc003
SHA1 6649c8e85aa294f20bcd6c06b6463d1cf04d0be9
SHA512 34e5542dd6b4bc26fd8ade9e2155582f366423142788eb212a8c98cc0373bfabe6af1fb5f597edcc851a0d570f0a2d2bb19256fe4e584e163f989b7322edddf6
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaP0Le5ji0hmxNrM:A3kM/56rq1Pji0Aj
TLSH
T1F4654916F6A44BB5D06BC178C9D2565AEB733C520F308BCB03549E293F276D19E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 966KB
SHA256 f3c17eb3e38591f89e83a26cc02c795e76494b402afe8b7c2633dc5d2072dd82
MD5 4dbd6c6f2940aec8bae87f1f112fc305
SHA1 37a7381d23b886276f6d611a9339d89f8752ff6c
SHA512 ad51e47168f2aa7067cd0b5a8d2c50c10eb62752be4258016968b59eba9b9309eed659d4bb15f6ebbdf92607b1b1d8eb33acd9a949e3294bcad71cef2605d624
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaRa:A3kM/56rq
TLSH
T19B256C07A6941FE5D12F813499A64952E7737C224F208BDF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 975KB
SHA256 3f04315e02dd6229c51b38e849328b23aa32c7a698a086b852b457072df40ca0
MD5 11b67dba36877eb5bf00759b36597bf2
SHA1 a9cece7b888401e5b5a26608161b9af60703b2d5
SHA512 12b348cbab0ac6dcb9e7344379b9bcdbea6236fc337e1e93acdc9fb9d85bffb77568ea9938323b49297bc39a4f6730381bacd4771bfd231882a0cedeac3e26b2
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLao6:A3kM/56rqx
TLSH
T10C257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 975KB
SHA256 876c4d43563df9272ade79d955570778ce40b5b9a223a75390d017702f62ab89
MD5 a802ae74e0c941d9b6723c1ab2aa416d
SHA1 6edc433e23cdb1a708ba0251012f307ab04c6eea
SHA512 30aad5d2cd976cd6bd891e5dd7ceb6314097438fee11fe661bf367900d4ebc43af882eb422d3d3d69a10a076a94bfecda909170a77ed4afdf9814371f6fa8288
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLasN:A3kM/56rqI
TLSH
T1EC257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 975KB
SHA256 a54a8c0cbfb48b952e8ff952c3c6c225d166f9b421966b0b934d9b8e6b3eaeac
MD5 7d84752e68722dc3ea1273bebcec0558
SHA1 e93bd5dfca944283e7e0be1749f3615d8856c5d1
SHA512 2a763ea4a429c6a28d5287d91ca8e022344474520264089e08b1ed084e883ae630d3cfc594ac95ce804d21f81b23e83d8aaad2c084010b4936cbd285e8e44d4d
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaif:A3kM/56rqg
TLSH
T153257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 975KB
SHA256 4fd48f9f574961c3e375c1bc3b611f3f145fa644939a9c5af67d86bbf4f12c8d
MD5 07908ef6c38aaab88d380a8e0b924c69
SHA1 286ac839eec2289f7e4f29f66d3192f305862b6f
SHA512 fa62d5ddf67d77ab9973c4bc376886c5ba62310358455600d4ff8403804075dc92716bb6a85981c5af4b15959a61e06c4ebd9cdd6b3a342415a5833ea026164c
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLa8o:A3kM/56rqt
TLSH
T199257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 975KB
SHA256 4f9774805a3f3afc498ae2c4a93b4085339cd0f747da59fe514a0e532711ceee
MD5 5a55f229d04f0ff6aeae5754c69711e3
SHA1 224a4bc341304e832e5d3eb32b194448b4c03f38
SHA512 9e162e2dee27b6ee4b443ebd93f335c0a82039d5d5331c1e0d62baaa96a43f83c14f2294cc98dbe7c551b28d05b6894ed7b7a2b2c831dcce9e5b7ca21c53a663
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLacu:A3kM/56rqf
TLSH
T146257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 975KB
SHA256 a894fa07f6bcabfc89e93c68bff8b6854862345586d3c85a77c55b7d939f4867
MD5 4a80b3e44da73f0dc6b7dc93a74d7261
SHA1 2e74a24538bdf4f230ceb13249c37dc85f9552ca
SHA512 4f055ec8584ff87bf9ef35fa7971ed6f1eb3398d01d1dceab798776d9adef370149c298f9f39c3345917aa6e1770ed1adcdb54d154c5df1cba941a8e025a9695
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLag9:A3kM/56rqe
TLSH
T1CA257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 975KB
SHA256 b142ef433c679b56a74cc3ea1ad8a8e05df2fcc32c5f600ef0184afd38f8af45
MD5 a99772b251f29fc7d116e7c2ab97ee3c
SHA1 5a98eddaf571fadf5fe8a3878c9215964fa91b04
SHA512 b11ee439718366032a1bd854027b0f4d224e2303671f0810a225e38933823bbb347458f97012bff3b4e93075e97c68d60ff1b94c2c8b50fce51d23582d7c182c
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaoc:A3kM/56rqz
TLSH
T11B257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 975KB
SHA256 9d13dffe74123db150839bba225655ed56bb50bf98f82eab0795369bdcd74604
MD5 5e78fb177ed872ee81e5f4074377a07e
SHA1 cbb36bb4811464a716fb50786b140cc7781543f8
SHA512 219762b1f2fcd6b78c322b5cafc81d6bef050ac6965b5706df5cc5119c2c5930b9dd7ff6fa14f50357b157f0ad7572585a1571e47216465d6dc3a8a51319c619
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaBp:A3kM/56rqR
TLSH
T13B257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 975KB
SHA256 c7a2f962c6b4fc308d1c0e7316e312fa46333f0b28a74a2e67c46e733fe235f8
MD5 f181bc1281fe9b47549b364c43b7fb92
SHA1 4abf95f2cd595748656cac6665d8a8b85e38504f
SHA512 a8e137af0575655c0c8ba390576d5a36717fba93c33debeb9e69cd02d459d24f4a768781274312b04111f6903ce7595d7468b3051788b2104a24eb679ba2ace6
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaWN:A3kM/56rqK
TLSH
T1B0257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 975KB
SHA256 4d7d9e83d2be3f15380c3de7f2a7770943084003cf41de215c02880053c11566
MD5 428d876e8a3cff699815089207ed931f
SHA1 df4d9c2f97a577f8575bb44c5862a1b1d81232ca
SHA512 417783545f30f5761d5e5bcde8bab8b9aea20f37998032050b0197124ccf6cd6335b310c1501288a792be5652c4a9f9b21d9dcccd19d555f9438885ffbd5f2bd
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaaF:A3kM/56rqQ
TLSH
T146257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 975KB
SHA256 615df8ece025f16c78bb0569a8abe790cfc103c644dd72f8b872d6e61463f643
MD5 1d9712fc645decf04ea7f7d552c9cb8e
SHA1 6608ed5787d29d02b6a4310aaf56fb87b5cdde46
SHA512 9a05ff1518b0982e3dcec9016768fcce973291fea1bcfac19ee3d8b85feed876b7fc950c19308346e39fc3b0846556ec25e16e42655b4e05e5ada74fdd0c1e92
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLavC:A3kM/56rqk
TLSH
T192257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 975KB
SHA256 ae8ed60feeb5ce65b576cd00a43e008e01a8de130f46325d92d4b8d57c7db8d0
MD5 edaef69d5b4dd8b405c99ba1676a972a
SHA1 0483a3599d298b813ccf0df79891a19318d723bf
SHA512 5231c4694886ab894c11d7f8d830b0c95d7f7f193aea116878db5bff9ee0946a03a6d714c879073d6aec5e7ccee766d803345887104fd78ec04ca5ce2babfed7
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaQw:A3kM/56rq5
TLSH
T1A7257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 975KB
SHA256 9aefcde34ef912782564e1b7ee6bcf4bf6d549c9fbf53cd5e2753c97f2c99374
MD5 65ea61e571f9e9e8bff6eb22f2b8e1d5
SHA1 2ff815392652029b843ae77b0ed282774c2b572b
SHA512 7700afd8ce8070acb7dccb180f02094349d09769a9e43589501ee708c05c040ea566a162af186d787143c2cb8e17d05a95855e996c3dfd168846079d9cfe6d23
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLavT:A3kM/56rqt
TLSH
T1F5257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 975KB
SHA256 a7ce97546c58049b2e4665139a9becf39453188a771815a7361ecacc35abec40
MD5 853d7f259132e296d66101a147902fcf
SHA1 43fe21d19f53e7642b4866b15eb97b4857c33c10
SHA512 204d714c8e74ccb10fe2bdf2c9f6128753ff537ea837ff3ea6d30f1a444164b89505769e0a8e48a75e72666f00a09f625967e9795923357c77cecd3d0daf8087
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLapu:A3kM/56rqy
TLSH
T163257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 975KB
SHA256 280d53f46c64f240dd8690e1a17a8cc215b065baa1703604c608863a66429c09
MD5 224e8731165150b737366fd2ab71c8da
SHA1 0dfde366dd8f67d86e3f154ec6cc36a160e97d2e
SHA512 f0e77e067d84b4b4d5d4834ffa1e0b5c8606dbc369daa0f2eb56d5029e41d8c5a2b73fcc54de3a320729d64f853575ed9670eb032ac921867aaf0e3bd1b540e9
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLahb:A3kM/56rqj
TLSH
T1B8257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 975KB
SHA256 26bc96e0b62ca766351b5527d1309ff18741d2af861063b949f3f8af7e8f8950
MD5 0f26a35da7a26db0e59c03210ace7780
SHA1 ddae1c7ec1c6174dad351889570745a040d2864a
SHA512 6f3d77c9838c0eadef771ba1f7306eadfccf17630c9235c955ca3ea6f7b86413a193dfe936e45873a92c97bc612504b409708d364c9d73fab9c14622f3acd100
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLapf:A3kM/56rqb
TLSH
T16B257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 975KB
SHA256 20a8a582e62c74e78d13ad9003e6e57885e86963c00d7db61623a0e29368207d
MD5 62e3df7e13cd7ea0551d729675ced386
SHA1 c5cc0440f5f62002ce62adb0eaa723f37c46f2a6
SHA512 d6f97b024c6c47739be6d84f189f038c1b1160a022f6c51a363addcd482f4ff85936159c949298cc8279819969d5426a582de19c6d32bbcdcd4ab560ad769ea1
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaSK:A3kM/56rqL
TLSH
T100257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 975KB
SHA256 6b40b9d6ad1526e059a513273175937cef72860978cc6c6dce0cae8c7e798f20
MD5 1de37085dbda6655439d2f7dc1a305da
SHA1 e09e7d5b6faaca94669aeefca886e2a26f64f02e
SHA512 f54f39086eeb353b6d63ba7164e16bd9a42a16d27fda2599c6e3769779dcc48c3a71e96c76e530f536808a70e8b0a2663f2124e49987bd0d2650e7cba951c123
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLa3k:A3kM/56rqG
TLSH
T14C257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 975KB
SHA256 8636850c9285cd5c8084e69ebd6db53f4e6f4b11867e05310fd4b3be8d19e0bb
MD5 8039af05478343b02ae31905afb78f0a
SHA1 3c6f58f034868fed8dd3980813ae8b7368fdf8f1
SHA512 2e1e60384c88e6a5e1cf797660da1455320684c16f41c881f85e0fb29af2b0194a27aad1c9ba3d86c67b8ad4ec01534802800e7b4c829fc44b6f234a18950ea6
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaA0:A3kM/56rq7
TLSH
T12B257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 975KB
SHA256 b0e5f48b23458f97f57405147b6d4a93df715c7192ab6f4068d609c841a63d4d
MD5 8b7d1a677237b14bfb57a8b71287f049
SHA1 34531c30dec62bb39ddd2bc05815dbcef669991f
SHA512 b2f981f70893bbe776ddfdc4aa32177047b881683a2d58cc6bd8446d28ba5627e8d40f8955a831a353062dbf04152a6d9eb9b1db28850490b9f691da431db2b0
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLabg:A3kM/56rqO
TLSH
T1D5257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 975KB
SHA256 39fb1c5a776c0446eef0f2488720cb8e31e5d2a1e64a2f268abae3bda770eb33
MD5 34a18f4642ef7b30e5ff621185f928fe
SHA1 12d86ba8855b34701b5f86fcc337a255c476bd5c
SHA512 91061ed4f90cc00104d3bdeb3167c83d4726d453ed7dc06935487b4e6ff6dfc4241cba1796f7ce6963e24cdd39a32aefc82de2ae95889f06866d23387bef3836
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaWr:A3kM/56rqQ
TLSH
T13E257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 975KB
SHA256 903f53b93e98767db0fa193d8850fe0b0b15acde250686f41af584b8a4b4e42a
MD5 f86ab6537ab7b9b4da48a70cc7cc5fa2
SHA1 acb451b9ecf9e0534ee6475d1ff2c865698dac1d
SHA512 9e380017389e7c638dc13b10e0ef3f1f0dd1eab18702467d515d4e4185968bcc645b9b9c6bc512081d10d08020d5e428cc778b9a6c4b8bb016393a3c22d2d0d0
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLa8n:A3kM/56rqC
TLSH
T103257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 975KB
SHA256 1740385f247126744a92af36465a87bada4601b7dbe0bffcc56b649b898834b5
MD5 4fa4110fe6185fd9330525aa77b0afd3
SHA1 e0d295b6022680aab04ee25e57578e29f9a887fd
SHA512 1c1e2702f32cce0cfc035a6451d4815e1262216d1c59022a68d022ff52dc622d8ee0c6ffd47756b75d930c4b3972e18df194724285fb8cf5c4a9a15402c00af8
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLa6x:A3kM/56rqw
TLSH
T1C1257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 975KB
SHA256 001df20b3b3b64d4d6e599074a46d8f6c5fb9838e2e8cc05b7b55b20759de28b
MD5 407a4bdc6a3c4c8ddc2c5a663b560cee
SHA1 3ac99e80c12321cb398b9a85c7abcc59e1fd1e9b
SHA512 964f4699646fbfb37d9cf36412ff819a51d58884c26e5feb98d9e76a85ffb12dd8276e4173a732fc914931b0ce102dc654ea9af515883e5c7d64b562143863ec
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLa8A:A3kM/56rqT
TLSH
T1C6257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 975KB
SHA256 d3ed1ae7f1b88a3c187f6469582199d16cb8d51794b7e666e7f0405278f54d6d
MD5 1c24fb3ca71ffa70845ce2c1b6b050a1
SHA1 cf01f6c83333a87f3893927b4f7e1aff735ae1e7
SHA512 e982f50f603fb03e30a978c5e0f28a1284c697c364d01eeeeae2ebe96ca8408b1ea38e8a491e029d6918408ee85ffafc475b8075c9afc35f494101896b70645d
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLal9Q:A3kM/56rq+
TLSH
T1C3257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 975KB
SHA256 8b3a4551c8ef86fc2aae95353b12e4c051d79e6c1f75f6f90321b1fd23bface2
MD5 23bb438d3771ca678a22875a9a0feb7f
SHA1 abc5388cc6c03fcc2a77d15aa2e1012e124dae01
SHA512 35c6553a1b53cb9323a84cc13cdc5baf2e43493840c93b6117bf1460426fa7874d7ea93a6e3c106434e5a449fc2188b14b600dbb6f42b73050ed1723d675906f
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaQ4:A3kM/56rq9
TLSH
T19D257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 975KB
SHA256 af99d0ab5bc5154a86db11f27ee5ff58d1249a5aa211f8150759c977b0b54c61
MD5 761980099c3143ecda50a56e1ca6fa58
SHA1 ca744756ba1ad5f81d133d3f83cc41a0c2d962f3
SHA512 8bfc80891db26316890867b0dee265f02cfdd544fd0f3048d2f99712740028799eb7c2a6a2d52ac7ff66a55a4275e03940e55d67f150835468a03dab6f9e1506
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaTu:A3kM/56rqY
TLSH
T137257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 975KB
SHA256 d2e8e455b070b996c0ee4a288e6744550e74ea8dd4f9e6d4a2ca5e8180ab56d2
MD5 6dd3fd6cd2d57b1a343b1b85a8bc6ede
SHA1 b9a3d0ff5877a089cbd321d5a6b8d13e7249b7f0
SHA512 337d5738b096b2971add09837d904bc9ef10f3347814acf3994cafacd8407432ac9755067aa79c5132b807c38373b6dd9088f65491ebe46a73c3b9f127b1fd10
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaOj:A3kM/56rqy
TLSH
T1ED257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 975KB
SHA256 55a2b132bbcb42831ee4dca0e96c3156fad9e99b615852dd93ea7f3d3f4d6b01
MD5 71080b66f2f14c5e6221caa8a21492d1
SHA1 1bef4451e137bca9a18e7cee09d4b76c6a09b2b9
SHA512 80e842e4da1aa9d589096db11a2c270faf779c8fe7b04a73ed2933f22197370dd2633eea31f6f9e7a0341377d937dc58eb25ba83c7616a60221a112899b76f7d
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLa7g:A3kM/56rq2
TLSH
T198257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 975KB
SHA256 e55324ce878dad11e97500ce1f0b7e63e77e726ae59e40d498946353291f1794
MD5 25a7ea63fbc7a88d61d431541424ae2c
SHA1 f5ea9b6c49f94dc2fa0fcac4146b435b35a2717a
SHA512 12bb249979db483096b7bc3e1c3bf984c81ad9a51c731f249ff452d950a93841f839d3351ee6e39e81568f849e4e5ea7f3ffc5d41987a1b1cf0f46b4194ae6b6
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLamI:A3kM/56rqf
TLSH
T1C5257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 975KB
SHA256 8f58c394f74fcae3958d6de89fddba081333776b0dafc9481183407cadab231d
MD5 2203a7602a52049904f91e4b0362aba4
SHA1 225c31a53edc65c137deee7c1870d653dff10d56
SHA512 9d2e04146b1b7f56191e267904e1f3325821a00fc1783295dd1b0e8317782eda82b8a2c93095662a215bb7c95dcd97c694198f2fe97aa0afc2112d3426fe59b9
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaUo:A3kM/56rqJ
TLSH
T11A257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 975KB
SHA256 a42541c82e9fe62f255741dc6fc60c64daf06979e85055c3a5297731d6f2a5dc
MD5 b10ad979e2947d6f6ed0aa9862435969
SHA1 1e5bc4b6ac135b0df88c54fb3a24d578b67857b5
SHA512 32049e7e7d258d9ec47e6337969db897576e15af877d4ef7011a630a07a4f757d3883520494debdeb0d4d9b4e7dbbcd6f7d33d3fe9c0c9c81943827af26afe42
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLa3+:A3kM/56rqs
TLSH
T1F7257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 975KB
SHA256 fc60ff9bcfeba90be5aa3928096084d3045dde645ff0c9cc59cfd8c123606b31
MD5 2538f40948727053fd80aa4cdb705e9b
SHA1 81a90e4a82fda9c5bffbe3f6b7d94e4dd04011bc
SHA512 6ec70a6d1afa135dc1220ed646145550b7ac0f01028591ec484194b006500cad1e5a5142b9e7ca1e45a06b444bdaf246b49b19eb6a5c4a6ce17f27fbf3a140a3
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaNQ:A3kM/56rqE
TLSH
T1C1257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 975KB
SHA256 7541fac8c0c64a16fce18fcce6d81ab1f91cf8ba95513ae21dcc9f95d489da1f
MD5 792ca328cb8799b4509e5c356afe0486
SHA1 6b0a109fa43c239aa6dc3844d799cb7a44f9345a
SHA512 b869abd7f5bfd15f5a3e6bdf84e1c8219b32acc0c0f94c050f9792849bb2aca196748af1f84456c235739bf9cb26700bef1ca2e4d3a2918769c799427e999cab
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaCX:A3kM/56rqk
TLSH
T1A2257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 975KB
SHA256 3f02364d48c2c9ea10763c93fd59232976533bdd6d4ae316ad45673215c35de8
MD5 4e484151e07cc7824013b49afae18433
SHA1 43e9523539cc51ea7cdb4f532b83b425296df47b
SHA512 c60e9e27718e048c1471cfad35915d77cd7b29a205dd331e22a56922cb5385ed7892178c2c48c808510361f655b0b8c1aaa5bd9ba1774406abe87b007e0586a4
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLakL:A3kM/56rq+
TLSH
T1D5257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 975KB
SHA256 d0d26509bc3611bff015081be2c690a32f50ed203b805603790c63fdcac16ab7
MD5 74fb94d0a5f197c966ddf230699b3895
SHA1 294fe6b12f599f23264c480622b8e0c71eb88ed9
SHA512 4b13313631c5cfc24f441212c40d2da3b01a1dcf3f962598615743394b22d011a28b3612d8234ccdc5c7a0afb3dfeeeb5b3f2ebcfb4ab1477678713db0071c7c
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLaAM:A3kM/56rqL
TLSH
T147257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 975KB
SHA256 7f034a02b21649e38fbcaabd005b39b433aeb2871b342494982a5015a240b6f3
MD5 0de3d3001961b561e9b717fca8c3f5f2
SHA1 0f32e42bfc248d2166b274ed6ee2c962b9e933d7
SHA512 b658a82fa0ec73ca9f6b9f8330c8b3a3980e0a861e13fca7e65f621f1d5f664de98dfc9cccc1f6123242871d3fcd3bb4d13dbcf82da75e5be8f8846c342b9c38
SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRawzyJHLahh:A3kM/56rqF
TLSH
T147257D07A6941FE5D12F813499A64962E7737C224F2087DF1364AE253F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1292-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4880-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4880-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads