Analysis
- max time kernel
96s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 14:19
Behavioral task
behavioral1
Sample
2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260809-rm127szarh
- SHA256 5d638681fed367b717abe99a888c7dcd0f55c69ea065371e6bb83323b06b505e
- MD5 64fa737558ea7bcb12c44e1bbb0f189b
- SHA1 d7cce3aa8d101c7c826c9a23fb981f478d4253f5
- SHA512 0cfdad9795edb515e3015b614cd5acd44a148a20297e312589b5cd11e3ecc089cf58cadb91e1ab607c34144062519a81c7d4f5ce3c5b5407bc1eed870e9182a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHXu3mnXoZ643mnXoZ6i6cMJlCUQ08:A3k03kHRJF3k03kHRJw
- TLSH T12785AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/1464-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5f3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b2f2-21.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1464-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4380-72-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-288.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bad5-287.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002000000001997e-760.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d1c-1270.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5f3-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f2-11.dat aspack_v212_v242 behavioral2/files/0x000500000001b2f2-21.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-288.dat aspack_v212_v242 behavioral2/files/0x000300000001bad5-287.dat aspack_v212_v242 behavioral2/files/0x002000000001997e-760.dat aspack_v212_v242 behavioral2/files/0x0003000000019d1c-1270.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4380 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{ECFE93F7-0E0D-49A5-A40C-A888E035F269}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1464 2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4380 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_64fa737558ea7bcb12c44e1bbb0f189b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1464
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4380
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 5d638681fed367b717abe99a888c7dcd0f55c69ea065371e6bb83323b06b505e
- MD5 64fa737558ea7bcb12c44e1bbb0f189b
- SHA1 d7cce3aa8d101c7c826c9a23fb981f478d4253f5
- SHA512 0cfdad9795edb515e3015b614cd5acd44a148a20297e312589b5cd11e3ecc089cf58cadb91e1ab607c34144062519a81c7d4f5ce3c5b5407bc1eed870e9182a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHXu3mnXoZ643mnXoZ6i6cMJlCUQ08:A3k03kHRJF3k03kHRJw
- TLSH T12785AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 4d658d2fdf8d1ec5bfe3c3e2a1cad6f021f6a591f098d0c738c852b551752f6e
- MD5 933b6a20d451618e34ff81613791d838
- SHA1 c513cab8d3026691032e8ab96ecfca1f5d628868
- SHA512 39f8447ef0bf777ce2482ba6d8d6f09f15e83ab4fbc2166cb8c2bb03e78184057d8dee289911a6d72dcb1a9a01f5be4f7cbef2cab2e5fc5d36427f49646f813b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHXu3mnXoZ643mnXoZ6i6cMJlCUQ0Q:A3k03kHRJF3k03kHRJIPji0Aj
- TLSH T187B59D17FAA401B5D026C174CAD69A66FA717846173097CF2358C6293F63BD0AB3E3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe$
- Size 2.5MB
- SHA256 b3a1c5c8d0b4b862b47558f9199566ddb438953b08ccb79a2163e0bc62683ed6
- MD5 dc8891ef385894712348aff724498eea
- SHA1 a407417d43562e38edc76185e97821890e7a93aa
- SHA512 3d08de51664c7b1fe9f4aab27969e7646b4791154ad991797d6bd1fd132221416583145e5fdce10f0382e23008a3180b40c8b93c68e943c048e6eac3d6199cd6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHXu3mnXoZ643mnXoZ6i6cMJlCUQ06:A3k03kHRJF3k03kHRJ8VO88hXl+
- TLSH T1B9C58C17F6A401B5D026C1B5C6D69A66EB7238425B30C7CF2348C7292F63BD0AB3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.8MB
- SHA256 047f2e2e353ad2c6448288bae3eb4c0ef9b67936a440350c24d04065ea142d60
- MD5 ab199dedb09468f82ba2184e02fdb2fa
- SHA1 d8ef83c8e06bcf6b5d28b1d6ec9e9c4450087436
- SHA512 a251d6fe8e96063820857df5bf044fa09b9c38b619d517fc78f17acc030e0d84804829db8b4456c38b830a20868fe81b2fbc6a556f10e1b7589c9efa45796810
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHXu3mnXoZ643mnXoZ6i6cMJlCUQ0p:A3k03kHRJF3k03kHRJF
- TLSH T12E95AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$
- Size 1.8MB
- SHA256 e7bb3db866c908028cdeff8e8d4a27e94edf9fffad17def6cf58a780dcd0e4b2
- MD5 506ab18ee48bc14dcfd03816e0f87075
- SHA1 9625b52fb3c9435e5e3c94038d02c9dce0d91ec4
- SHA512 bc8352a2d1953c56293156f289a47b2ab5d2a7d88643ffc86a48e69cd1bbe451943608f603b21c95d1f6d2d6f5b9d35f78c90e06888e0dffe2753c44a3fe8e20
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHXu3mnXoZ643mnXoZ6i6cMJlCUQ0G:A3k03kHRJF3k03kHRJi
- TLSH T14995AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$
- Size 1.8MB
- SHA256 369fc3ab547c69fe5e5205256ba5738ebdfb076974591ecc7b05961467b3b854
- MD5 dd5bf8ac49e1d64d0dbdf367d255e976
- SHA1 7e579967e5089fc0b58f7b8118dd1cc05c58e609
- SHA512 1be4606fb45256eee01cc5b228129514e64f34c7e3aed31f75950109bc71ccd3cb8a166402c59a8c3c00482598d597fa68987825e91b73eb7b1951e689a731cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHXu3mnXoZ643mnXoZ6i6cMJlCUQ0p:A3k03kHRJF3k03kHRJF
- TLSH T13995AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.9MB
- SHA256 59f0037c588fe37c5b0f71898b33d0fc06c81a78f3dbf6c80d6aa48165bdc796
- MD5 8d34c20aa9379dab4e10dbacb0e678e8
- SHA1 1c5675a0b3ffeccc1c7d841e683b3d839706e2b2
- SHA512 51c6f7f48f551d414dbad50c5a78ac877b6a3ec40a22f714a727cb71b0a2f8255ea4745244a5b3346784d67304bfa24ec2eb738dd17360f60a78433df4925fdd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHXu3mnXoZ643mnXoZ6i6cMJlCUQ0M:A3k03kHRJF3k03kHRJo
- TLSH T19D95AE03E69500E5D10AC1749AD98A22FA75BD96176093EF2358F7152F72BC07F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH