f74ea5fc9ce7f9719ddb748fa6dcf2a8bdd3eabbf531a862bea1728ae66fdaa3

Analysis

max time kernel
112s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 3.5MB
Sample260809-tb2kps1dlf
SHA256 f74ea5fc9ce7f9719ddb748fa6dcf2a8bdd3eabbf531a862bea1728ae66fdaa3
MD5 d95fc3a2b0cc44f8c5d32b19cd750e0d
SHA1 d161cada78a6e56d5194ecef6df48688af601363
SHA512 b6a258d45ac07df416fa1d443a211a8248fb211077d83b586614b818de3b3c555c12a0a244d0c45f8b59d839ed9be44ac47803a40fcf528e0d2bf7c78243adda
SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYq:A3k03kHR+Rg6cJr0fkZcO6
TLSH
T174F51916F6788762D077C0B9C5D2AA9AFA323C455F308ACB0345E7282E377D59936732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 11 IoCs

resource	yara_rule
behavioral2/memory/4212-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c520-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b311-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2032-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4212-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c523-56.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a77a-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00100000000187e7-1024.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019caa-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0026000000017bdc-1530.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c52f-1603.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c520-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b311-11.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c523-56.dat	aspack_v212_v242
behavioral2/files/0x000300000001a77a-981.dat	aspack_v212_v242
behavioral2/files/0x00100000000187e7-1024.dat	aspack_v212_v242
behavioral2/files/0x0004000000019caa-1351.dat	aspack_v212_v242
behavioral2/files/0x0026000000017bdc-1530.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c52f-1603.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2032	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4212	2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
2032	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4212

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.5MB
SHA256 f74ea5fc9ce7f9719ddb748fa6dcf2a8bdd3eabbf531a862bea1728ae66fdaa3
MD5 d95fc3a2b0cc44f8c5d32b19cd750e0d
SHA1 d161cada78a6e56d5194ecef6df48688af601363
SHA512 b6a258d45ac07df416fa1d443a211a8248fb211077d83b586614b818de3b3c555c12a0a244d0c45f8b59d839ed9be44ac47803a40fcf528e0d2bf7c78243adda
SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYq:A3k03kHR+Rg6cJr0fkZcO6
TLSH
T174F51916F6788762D077C0B9C5D2AA9AFA323C455F308ACB0345E7282E377D59936732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe$

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe$
Size 3.9MB
SHA256 d19d94b548132de687a5c1df3b1d1ae6bf7534a46d15034150f3e08e1e477453
MD5 6ab77b489317ca7384c18d2be753def1
SHA1 961cad2e2637ecc0e58dccf63ca935cf5809c145
SHA512 14c2db042407ed61994b6cce686fdb1ab61dc7864496a8160b90b74d09e9418d471a9c8b29b7ed8bc15b57c7baf24430f37e52383ee3d4b259f84d44900ee56e
SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYqHTd9CHKyao:A3k03kHR+Rg6cJr0fkZcO6YCqo
TLSH
T14A162915F6B88766D077C079C9D2AA5AFA323C451F308BCB0345A7282E377D5993A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 3.6MB
SHA256 4c7514a3c80d9c40a23898a4c04add58facd264b9e0dcb2928ba27a1bd9f4d1a
MD5 cc800cd4e6239c677153ad70df72789b
SHA1 d3ace161d4bed036ffbb364659ba84b5fedc8bd4
SHA512 b39fab5192a9c284ca36cc288ec577bc7781efa22b49b452d0d339da2cde9942ec9a40daac4cbe0afff936312cf6a2e895bf631e1e732020242d41e52a43b55e
SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYqdw:A3k03kHR+Rg6cJr0fkZcO6L
TLSH
T123061916F6788762D077C079C5D2AA9AFA323C455F308BCB0345A7282E377D5993A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 4.0MB
SHA256 efe9f0ef86c312cf9d442fb5a8e53d5e88fadc8b05170b3d5a4b8e593b47912b
MD5 2275ffa91dfc5924799aed9cb8d5733c
SHA1 53b5d724eeb139e3963782efdce99def18fd0691
SHA512 0bc0c5c6c0b9b59ca5acd7c16c5b4b4baa3bd1125ae1097e9b19f7facfac399e3c3b50a7d90914a2728c7e1cd90e55ac184852b2823afaef3308936fb5e95cd0
SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYqjPji0Aj:A3k03kHR+Rg6cJr0fkZcO6Gjo
TLSH
T186162A16F6788772D073C0B9C5D2AA9AFA3238455B308ACB0345E7682F377D59936732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 3.5MB
SHA256 004fa36f467e8c10469a10a414ff4278dd920c8e0454d2ebae2b0bf3d714eaa4
MD5 f22ba5060e8719b36053f012a11d58fb
SHA1 018b263924386404d15693347a921c3db5541cbe
SHA512 79e59554a74f01f4c841473ab0806e6426901b943224580b310810fe3f82f8a2f8cfb76e5a3e208d3c9a06d415d31d12e4d188915af0bcdfecb717fc145a5dfd
SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYqmb:A3k03kHR+Rg6cJr0fkZcO6hb
TLSH
T19D061916F6788762D077C0B9C5D2AA9AFA323C455F308ACB0345E7282E377D59936732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SELFCERT.EXE

Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
Size 3.5MB
SHA256 7c8a4517f967a2bc9826cb6d485fa7fc5a07c2a1becca23f288f4e9a297cf2c2
MD5 0c2c831da7c9804c580e2b01f34e457a
SHA1 257033b95e60e7ad8228b92b16adfcb3f0c27479
SHA512 f8ce3372f99afba1162b08b5e6cd5f6c7063c23df9965364178c45756cb31c25239b12f465f685f69f2e0daab15e5451d1bda0b4128e16e07ff97c3b263087e2
SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYqy1:A3k03kHR+Rg6cJr0fkZcO6b
TLSH
T184061916F6788762D077C0B9C5D2AA9AFA323C455F308ACB0345E7282E377D59936732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DW20.EXE$

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
Size 4.0MB
SHA256 0a0558ac85920b9ce925f3a449530341fd6fad46d675036e3d4a1bc0b10d67fd
MD5 e3bc046727777e99f42f785ee48d88da
SHA1 6dacd7b18334c010592c35439e3a88e0331e8f44
SHA512 f18883fb1c0aa0b36b5dcac461091cd16b2f512bfaf7c88cd024f2aaaaa97023f6ecc8c138faa9bf577925b9922b72fd56b020e3777774a9f0f8b41ae8b39580
SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYqx8tDZqrKV:A3k03kHR+Rg6cJr0fkZcO6Im
TLSH
T165162A16F6788762D077C079C5D2AAAAFA7238450F308BCB0245E76D2F376D1993A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 3.6MB
SHA256 c1131399eca1add9c1b571912c728eed7b453d3c35acaf6abc6cd977c265da14
MD5 d7471d5c7fd0ed2f35b5f9f5b58e8efc
SHA1 6e28558bd556db01f48e36131c9a6a2e41aad57c
SHA512 292b30f386615fd0926fca38107e0c27835f0e692f84100a9da6b1201739335a17faefe86d86412a8272f1f51e3956b7e8bd11912d1bb6ae18016d3271757be5
SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYqt:A3k03kHR+Rg6cJr0fkZcO6Y
TLSH
T1C9061916F6788762D077C079C9D2AA9AFA323C454F308ADB0345B7282E377D59936732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2032-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4212-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4212-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads