32f503af0dc2da8a6d382341535abd7bbe8d0fd7e301cb069947fd8b94e29e58

Analysis

max time kernel
96s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 19:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 936KB
Sample260810-yj1etsgl2x
SHA256 32f503af0dc2da8a6d382341535abd7bbe8d0fd7e301cb069947fd8b94e29e58
MD5 b772408bf7bed1578438513a8570a260
SHA1 ea708195896a07799962345bff699040d53def67
SHA512 0489c0b0e3580262e6be1a7a97fb9fd5f56a0de8ae8460e4cbf2aa627ef4bc147b6b73b57d67a2e0a9770db0f5f88084bc6c63f85179b12413c7067ae6a17ba1
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aE:A3kqPji0Aj
TLSH
T12B155B16F6B44371D073C0B9C5E2A69AEA7138420B308ACB4395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4972-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5bd-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-34.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4972-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4936-203-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001500000001762e-447.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00060000000198ed-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-702.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-979.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1276.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5bd-6.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-34.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x001500000001762e-447.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-495.dat	aspack_v212_v242
behavioral2/files/0x00060000000198ed-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-702.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-783.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-979.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1060.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1127.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1146.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1171.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1276.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1332.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1351.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1377.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1390.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4936	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4972	2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
4936	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b772408bf7bed1578438513a8570a260_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4972

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 936KB
SHA256 32f503af0dc2da8a6d382341535abd7bbe8d0fd7e301cb069947fd8b94e29e58
MD5 b772408bf7bed1578438513a8570a260
SHA1 ea708195896a07799962345bff699040d53def67
SHA512 0489c0b0e3580262e6be1a7a97fb9fd5f56a0de8ae8460e4cbf2aa627ef4bc147b6b73b57d67a2e0a9770db0f5f88084bc6c63f85179b12413c7067ae6a17ba1
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aE:A3kqPji0Aj
TLSH
T12B155B16F6B44371D073C0B9C5E2A69AEA7138420B308ACB4395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 0bfed5238b5642e96af3157c7dc52fd1734d8f407684c77700296ae3147ba941
MD5 465e64b178d78d58b6138c9db88faeb3
SHA1 729922f25496a9ca921d6492ded0ac05fcc05710
SHA512 3ec04c2232fc665e8a9c8ae708f13339b943c771b59b18b6454be131d42ec8acca7bdfe8242d0ea29ee648d913e42b698a693ea562b539faca977ea44f5d7d36
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEP0Le5ji0hmxNrM:A3kqPji0AjbPji0Aj
TLSH
T16E652916F6744371D073C0B9C5D2A69AEA7234821B308ACB4395D76C2F67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 950KB
SHA256 d48a5864d0ac1d325414f06f043b8d00cddeced1d399465a77e1530aa2dc0492
MD5 45a0bc79da2f69ccf5fd85a4de2d0035
SHA1 b809e3c6063646f9f789eddfd4d72de43849eea3
SHA512 c4cdc0a877a60c946b3266d0471fa9300d95abef2b2da5d4c3d378a5d81e98ed37df98595c199277a385b21e50a63e097cce4098a37e08d0b4260e6f4a8730e2
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aERa:A3kqPji0Aj
TLSH
T131255B16F6B44371D073C0B9C5E2AA9AEA72384107308ACB4395D7683F67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 960KB
SHA256 4de786c507cfb0f20bb8050da0f8cdeef563e1fa077d43fec755c8407eec9383
MD5 52d53dfe2b74b932920c27cd9a50bbc2
SHA1 588e31e6b55949330767e55dee63beda614f96ab
SHA512 13f662001df6e582c51a23a8edad39cafe2aefd6073198778a1ad13d17268ac3ea48e9c7924ae3e20fb4c11f04e67e44ef7f7441d0d4ec7f18797c3fe81d8f5c
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEo6:A3kqPji0Ajj
TLSH
T171256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F67BE1D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 960KB
SHA256 96cb7f76da7659048ee435d5f425e8538637430249eb1fc75543e5140c321ee5
MD5 d2ebc165c5388a1070c9bf5649addfdc
SHA1 a1ce2fa1d46ec0fd119927417c0acffde05a4edd
SHA512 ef7da157532405397e8ee58bad845a72cf927585a6782300b8a9c933944380ab5dfcf45b825f592524cb0febd838ff7edd5b2afc601367b5b4926e0e36ced5c4
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEsN:A3kqPji0Aje
TLSH
T10E255B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 960KB
SHA256 854d9b1b2b6b490e9d81ef887a2579b85802000ddbacf5be4fc2f764255a1b88
MD5 43eb1806d066134042e6d7a9cd17870a
SHA1 7312bb09cd44b27c52217a3f8dbe1f27ac7c26ae
SHA512 553827e6e63a6290d8e04524c66b6503117129341413f1a8a319c54082ab50ec2f6e3daccb4920f3e3d4f1e165736ce1682f147f54edf77ba45a6b41879cc139
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEif:A3kqPji0Ajy
TLSH
T15A256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 960KB
SHA256 4a9f8075bd6ef7d0c128c750b93f3825cbc7ab8dcec5360850cc3d7fa26bd053
MD5 e751de133ee161d0b3adb730e39d616c
SHA1 2ec4361707a29068d4d988eb3b5991a2e0009d82
SHA512 17a89021d292bd59bf3e4268e0738e527ac876d7fc7b60b104d6c6029278df3ab5ea31b2430161cdd0de548f458757d1c5ab24aaa096cd5b44c0f51b064cff22
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aE8o:A3kqPji0Aj7
TLSH
T1D7255B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 960KB
SHA256 6ba941c82835db69a136bcd7402f21dcf0c095b22201a441cdb77a546d4c85b4
MD5 d3a1db84163333e3da270b10910a334d
SHA1 3da1b2fa6cd97e5e3fa2fda96087b9267583d295
SHA512 01d76c77ed97fefc1326f5bc197b1b0d91ef79b008d999be7188464c014b40846c57e54c8c542236f94f344d86a83aadfeefbe9a63ffc1e1a0b3ad4c2e26a0b0
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEcu:A3kqPji0Aj9
TLSH
T1E9255B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 960KB
SHA256 9664aa9d53d9c0b453bc8f14aac02290faecbc96db49e25649af56ab5084a757
MD5 c234e0bd2e6d9b2e735412bbc096ac7a
SHA1 f3c57ab6706abd099d57550fcb57b45157c57fd3
SHA512 d7c91516d5d6755af7cc52012caa39520a824e0041644518ecb36eca75dd9e6d167d897fadf555b33c6594c16263ced5b78cb157964c20a1a6a7c3a686555251
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEg9:A3kqPji0AjI
TLSH
T16D256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 960KB
SHA256 c842c4f966e2441efe05758eeac4721419aefb66fc287b86dc09dd60e44298d9
MD5 bac0bad3b99aa785ee8a318e8de9cb84
SHA1 a0bb9c6c0a91c8b6f8f4d28a99fa7cba73d1c3ed
SHA512 113f8df6e03c5eb274c981e8adcd8692088a91219ae14485099085533d6fb71b1b6d133d495ab5e71820994357a26e327c0bf14c9aa87a99b6df79f18fa964f0
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEoc:A3kqPji0AjJ
TLSH
T138256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F67BE5D63A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 960KB
SHA256 f60ca58ade459d87aa9729d5cff21a7cd5611cc561f64b47e4005000b8f588f3
MD5 c518754527a9d3fae18e6019b52b419d
SHA1 58d2a299a7a506d7f5dac65d79ceadb07ea816e0
SHA512 220983262cc3c66ab361b38b9bc5d6f12f95921a1ea67a404d711674109bf8b96e738efcc6e6fe59d647c396d32af40802578be57b34abcae817f48ee9f3c9db
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEBp:A3kqPji0Ajn
TLSH
T13D256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 960KB
SHA256 56d4ca97e8bae4e67363908c821e7bf9d58c3b306a37dd6ed2e87ed115fa31d9
MD5 121b3c82980eb319a4c07f042752a356
SHA1 0ab09438a990092e2e8c4eaaf377b548250deaf8
SHA512 72cb45656ba58b57d51f3890cee4d974d5557836ec178f332d9621ff3354f81ddd32e52ad9007928702a46aa5cf82aeb0686348bd6ef2bc42dce2e0dc786afe5
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEWN:A3kqPji0Ajs
TLSH
T15A256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 960KB
SHA256 32b6d1163167de344bbca3c3e526aaf84be4ddac6443b17d5b247fdb7018977e
MD5 cdc29eb4ed5aa290bb6a97797aee753b
SHA1 591b38e3fd4457de566f0eaeafaca6097af7d7ae
SHA512 0162d57abb604e8fccbaf3a2cd2aff83ff8a42bdc73251dfedad656187dbfc9c70e4afa42a942dec9790601fa5a61736741bd548b7e262c99db01dd6b2e783f7
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEaF:A3kqPji0Aj6
TLSH
T1D6256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 960KB
SHA256 855e59b0049c04cefa071d466c4c4fb5ae3cfc2e44c2287d31f2c95914a84bc6
MD5 de65ef7b6fbdf6f3e1df12a1da84b317
SHA1 66c249145af6863e3875e3bcc6ba70712d93761f
SHA512 0ed49d68e5f807b77ce3be1a0bd9ebe602c082a0f1265add31b0e865a9db8953dc436f9d476fd501636cefb947e05915b7b40c15b7ed4732e6048a759b1ca97b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEvC:A3kqPji0AjO
TLSH
T144255B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 960KB
SHA256 40536e82e15d1408709cc8b854f39f077b3c7b42ca1686dc2a794705fe07f252
MD5 9e1bcce091c88b36ae2596cb06e4e9ab
SHA1 c5456572300030e0d42b215af57d3f345ef383a9
SHA512 1df9c83d85690afc07baa91e017052bb40045d1fc84d046adc0f97fe6fcd1db16770db860ecf78fe2fff18bc2a0bb39bac536c6e984bc15943d850e041cc0eb9
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEQw:A3kqPji0Ajb
TLSH
T1EB256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 960KB
SHA256 d13fc608763f19dad814406844bfbd1e2669a744306034ea703d55b7814e8448
MD5 2cc9532d77926bb9a3f40733e3048147
SHA1 0323df01f5641793f2b12eaab003f48793242d9b
SHA512 cbf1c8f5c5c2f1e9179cd5d346b078edf9e23f8c4ab9af0513324b36c65feef1ff41a1cfdf80eb3ed55b2e504ad7636515a37a455bf15e3211035aab83705bba
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEvT:A3kqPji0AjH
TLSH
T116255B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 960KB
SHA256 ea839072272c00ff1516ef74ef031252f4816589b4dfa27257048c65966e3288
MD5 7f903abe24d117893c84fd95a7a52b93
SHA1 72ef96c511f8aaa43a145abb59ec10be598c0eef
SHA512 fcfa714df9181e3e0af9de422110fb18bc03a9a05a54d12625e27fd27f23785e2e0e3cdc393e249706f9427dd2397dad4ce35b2e061544c645ec083f91ecbeaf
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEpu:A3kqPji0AjI
TLSH
T146256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 960KB
SHA256 51ea09f3de356c9bdbac143de541dad39119cecc6e89be53469fb717600d8fde
MD5 b607b19d29bfff8a2619343ce19b372d
SHA1 2964d5d385a2aa65aa6df28fae19b83e61b2f5ae
SHA512 ceb7a8e455648fc47303f06a253e0719a07d4f4b1401376cec6f60e9c37271876ddcbad989b7dc74a844503fc01a3f262b3ca465be7fe23899f4643b02bb2c3a
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEhb:A3kqPji0Ajx
TLSH
T1F7255B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 960KB
SHA256 d529560df05e321391ff9651718553cfe107ff89c122bb46d86ac59739530e39
MD5 8ca891b6af753c2380cb7cce3ddfea18
SHA1 225efe27bebf9ca34b5923c00189113b0bd099e5
SHA512 ad451e142a0fe99ed6583746051967ff0163f31ad973ab744f83a08af7c50a771f8457b049a83f1f60e1e5bfb60683ec7766de8b2d5b76087a4196a060be2716
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEpf:A3kqPji0Ajx
TLSH
T1F7256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 960KB
SHA256 91abf87a0d14223298a12cae638a9c28ab86cb316aa7344ab601781cc7acf29e
MD5 ed0f632c8e342399b14638550f505030
SHA1 269fe540624ce6e1db2ce0f9cb0e8cf55d32b97f
SHA512 4c0953552111e774a7780d2d581954da9e81cdf05bb73d09d7ef070a02ed573446bd37788b6b8f53aa17a81ed01932d375d80114e8ab5ce100848ca7541d0f33
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aESK:A3kqPji0AjJ
TLSH
T1CA256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 960KB
SHA256 0ba70b3b125b69c919a0e3fb106795cfb00e7679b4aaaada2f12ac8ecb34b212
MD5 dc0534c17e0eaa456cbee62199a1e587
SHA1 6d2892f5fc4237058a74b01ac6175252ceb50c0f
SHA512 d6cfaa3109170f31f40a462a2c3c3d6b73a31f522a453cd50b06194e1c471df590d8194f224794a0fc645f0678db3c66496e36a9aff743d8b002090bb42b1147
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aE3k:A3kqPji0AjA
TLSH
T1E0256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 960KB
SHA256 d302f3ecc63225ff26a8aecd833b04ead36e86c313845668f8a7251b5963a742
MD5 b3e3970665f6a7719b30845568dba635
SHA1 b0c91a7bb8357d3d0397c3234911a203069153d4
SHA512 c280b7e7743df5027f0284b35856d51e65681882299b2a5aa8228306e7be312a60b32bdc3ec30de3546c76195083c58bc6e0c92409f7c73b09a189da62041050
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEA0:A3kqPji0AjJ
TLSH
T175256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 960KB
SHA256 d9299e03029ed145f1bc8adcac3a2e5a36e90e83c12959a3fce330285335a3d1
MD5 d4194573a95374f9f05162976965114f
SHA1 1c18a64bfa0b6f5d8be8614d1098aa919260e063
SHA512 71eeaa4cfa5dfdff4f1af75781b76a19e018e7befdefed76f213ce4cdedd774c05b9cff6b3274392ce521c33a9f6f119d5d909ca6006f4e0f83f3d4dc867b541
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEbg:A3kqPji0AjY
TLSH
T166256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 960KB
SHA256 81c44130e90be9bfdbb0bfc8ac77d6ca363a37a9c17eaedc29e9929a428cf62d
MD5 0881d077817eb6cec68347c9ee5dda17
SHA1 eb76c1686557d7f30ab24b7fcba40c2a1c04db0c
SHA512 7e27d9f7dd78feb089e49c0069674e39583417e78110dae9109b724cb966647f6d3e46effacd7cdcb10973b7ad8dad685e8d6591c233c0edc80c31a85effa6a7
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEWr:A3kqPji0AjC
TLSH
T1E6256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 960KB
SHA256 fbb56ac9a3f404b727e19d124ba9d17632bbc54e8e20252120e0647da31920d9
MD5 651a9c2d7170f1bf3927f3f779892bee
SHA1 4b115fadc45158371c7e04514e8d219448fa4172
SHA512 bea1f85a5fc678191e1ac559b80efc767a18506cd214c6c5de3f774fabbcb55f6e4bfacedd80af48331f6b241d2cafd0c4d4957045ef4edeaf64a412060724b1
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aE8n:A3kqPji0AjU
TLSH
T11C256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 960KB
SHA256 0f3a0b2777996b0eec454171945d87d1673448b8961a766f7ab4bb66d1b4e504
MD5 a22dc33e34f1975cd703c943bb52822e
SHA1 87fbfb732648c4ba05858488aaab60b50819b267
SHA512 29535ea9dd0cbce86a21428cfc5b5ab129fed49649279ba8df5279fa4f43a7c2bb751fa46532b603b19d34a956cba3ec2c53df8ba4297baa7d54000bd92fe5cb
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aE6x:A3kqPji0AjS
TLSH
T1DE256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 960KB
SHA256 e217356800ce309cb9f3af30ff75504c9662ef373880125e1af5b2c5d0b77467
MD5 7179b4641d6e527da99a999925153962
SHA1 377e587e288599f72be1b5371ef7ba3d2cbd2620
SHA512 bf1af7e45fb473d1e531747cdb307ae0ebe6cdc6c7ba6221b753f4bf7c6d40f28e4b827bc6fc8ab62cb83ab7f370ae17f10595fc19519103bd44a4e2f0611127
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aE8A:A3kqPji0Ajx
TLSH
T109256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 960KB
SHA256 cba5229e96dd6fc73e4eeb347921b1509d2eb8a9072d5177433dd89d4a503c81
MD5 71e11b605451d10c7d2b6e86101e5481
SHA1 6361f676c1a4d1c180f0b0f26dd2c7984b122c12
SHA512 845beb69ac00bcb1f8c7e7e677b621ec47a70e930f935e6ef95c3c70b6cc8aba2b13099bcdc5847285cd1c60d6afa7b9a62489c41e168b25097bc5d711e209b2
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEl9Q:A3kqPji0AjI
TLSH
T12A255B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 960KB
SHA256 2d094dfe6179ec2809fcea04f2d377df329139f1a35ef028f8d2ae8952ac1568
MD5 f0301b6da51f2efaf059f126b8d27785
SHA1 062f2f1831f1e7d0dfbc1037016d5ea93c893a08
SHA512 53bf300d7cf19f4ef1b3a02e34eab2c945d18bb39cf7cfc93f387e1e81a28d4ce19e6488217be810dbe2ca5423a4e4dc568b6599bcbf97804c934c65f37b9364
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEQ4:A3kqPji0Ajz
TLSH
T153256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 960KB
SHA256 ff5f06c236121d9ac5081972337aea91b474b0f28ddc60c0e625d76ea981cf3f
MD5 5038fee5f2e22770c35eaa0f6b524871
SHA1 98b1061e9724180459e447ae1e2e5d9a96b7ffa7
SHA512 215d982b6d4a86deb59d49ef53199fbea042c47ed6b1c905a1105e9641bee1b2bdd8cc4ebdee628cc4755e5bff12754e2280c6900004ea5a54bd190c9b48c73b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aETu:A3kqPji0AjW
TLSH
T11D256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 960KB
SHA256 3c1baf25840fe1c8dfe5c13e101ebb2d177bd21ec89d83bb1df548c838d8867c
MD5 5489427357748d65731fe0e44d74ef2c
SHA1 6667321de104cb367d1f8bf382246088dd0aeb4d
SHA512 58405030459f0010bf0960f6e50ced2fbbc59b3280f224719497faed68a522314642de3af43d71eab05b273ea535d0161faed427dccb21ee4ccfbf736437eac8
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEOj:A3kqPji0Ajo
TLSH
T1CF256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 960KB
SHA256 d973a4b44ace78d2fd65a75f0dfa15302199d49bbb26f00c995616ba19ccc702
MD5 a4db67f35c7412abf16d538f64c7245e
SHA1 4194ee58e17c8fa79b402fe71311a3734b8d60e0
SHA512 ca03e9b71cbd85555ec9272f6d22fd3bbb6042f6293558ea56f5dd519026d08bb3038795fa80e591ab96f9edee451d013b2019cb2d0879db1123d38c58c838ba
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aE7g:A3kqPji0Ajw
TLSH
T1F4256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 960KB
SHA256 61228a9939a968f12cd53c49ef72fdd432495e6975776100d732537f4b09da3e
MD5 bdc3ad745dc1953d9eeb84a576037342
SHA1 49520880e7965cc1a15330b889c1db215e654525
SHA512 2e6b8512900bde9dc187db5e5aa9805988f3afdd94cdb1e90c16aaa84ea2044017b2c7a48183d3b3d70b045a8c555cfac54c7df8e9c95818a113e464001d63f2
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEmI:A3kqPji0AjR
TLSH
T145256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 960KB
SHA256 f6a29b148752fe8dfb637dc85fe482e18fddb6eb9e85e873e2bafc317acb64af
MD5 1d1478dea8ce25fa6958de782883f6fc
SHA1 9ab4323d0f981f550731ab396828d85f87da428d
SHA512 c691da45437b7792cee6f75680cffce2976f73d5e7cba4d41343d9b22cdc3356bd2c06e9753906f070966f77023c72c1ebb10aff70e7e0e2e0f324d8a0a8a8f5
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEUo:A3kqPji0Ajv
TLSH
T1AD256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 960KB
SHA256 79ba16d283805e18882827c60bc948c74c50408e54d2720697d512f7f8e9cfec
MD5 01b8a399160be12235abfcfcac8b86d6
SHA1 971ff93ca646032f72968ba85a461469da5c5b31
SHA512 3ab3fbb4f11dcc4858a1f41cd3deb81470d9739582de70fda59c2d49d86f7848d79f5f119e920e4ccbdd2bae51cf5df792c81d53aff54a2e6962d8ceb42be632
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aE3+:A3kqPji0Aja
TLSH
T1FD256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 960KB
SHA256 876eef4f692e44680aefeeb2a615c108edbe6bee9459fc68e83cca0d2a3c3027
MD5 7855b1f6f047ddb07de820b5cd78914e
SHA1 555fe75d83be223b0c22613923518e6413845222
SHA512 747f499729aed88c38a5e607675c474b5a2b8bc851a5b490709a721a56365dccfce813041f975014c666234b719c2eeeadc2543b4f5de9ca56bb6f20724a67a5
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aENQ:A3kqPji0Aje
TLSH
T10D255B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 960KB
SHA256 173edf80b50fe0ac9931412c0d1c0155a8cd237a31850f334021c53e7b6c4673
MD5 2a5a1e5b7471693557f31900e86c8e87
SHA1 b14fd8ddb9494658c89bf943a32e724c5ab05d9a
SHA512 0c9103ff54a736d39cf28f3bb091fbdb488a81b2cb67dbf505bb5e58b4da29c092d77361867d1aaf2103f826a8e391205c8c02de900cd5d87b78a8a1b6c9f48f
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aECX:A3kqPji0Aj+
TLSH
T154256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 960KB
SHA256 1f2ebb469d27505aced454e0847477f4f49235f52db04cfd470cd14278c7506e
MD5 e133c47fb8f4d034ed45c9a0b1348b37
SHA1 4cf125a69211f8432e9a457137d5525a1c9997d3
SHA512 4e638778f5e581f16e564a01965bf2d5f636f34656311c70af27f67285e1a97653b55408ee9b6b37cd70fa57971f41ac0b5d9f32e8fca566b7b65b33fb22a095
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEkL:A3kqPji0AjQ
TLSH
T1EB256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 960KB
SHA256 aa62d86b81f9f38a88ec03c1d720380af6c3a05d9d39530561f6e1190c261e2a
MD5 d183276e95987e4cd23c4f11b3686128
SHA1 a62c365c4ca60868428f27b95ec6c8179510cfdd
SHA512 73d712e7c6a44eeda58838d2be7a6f242e21ce60f9090e9b0c720a0e82c9765c3f5bde973a8e690422f4651562d257a18ae687d2b556b8984f1760c3a97f7331
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEAM:A3kqPji0AjB
TLSH
T1E9256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 960KB
SHA256 5eef9d9dda4f174f25b4ff0057bc58479d47c0b15b738a8ebfc934da034838b4
MD5 13c3d6a24815de3d1a519e4a7ba6d8bd
SHA1 a9df8fcf73a4adcc75d74a3009755de28ca7aee5
SHA512 2a92666a5c7a1511f5ed07ef1d5e9b8474b3939b36ab19c232de19369108d898e7a0dc0d1b949b6d1ced5d119fdea1c62b51664b89af825134b7c61f260de3f8
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFQyaEB3aEhh:A3kqPji0AjT
TLSH
T1E6256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F27BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4936-203-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4972-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4972-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads