8586032fcf1d35ec45a194fabc22c8ba0b068c4aff4c5f7f45ac9404b4ef5f0f

Analysis

max time kernel
107s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 921KB
Sample260812-2cfcvswckf
SHA256 8586032fcf1d35ec45a194fabc22c8ba0b068c4aff4c5f7f45ac9404b4ef5f0f
MD5 5dfa8d1b53ec4c74f2edf86f4955509d
SHA1 4086336dca34d7ccee8c186b2aad37e1ef631a1e
SHA512 fa64487ec13a491f9b5c577e967f4376e174b032e318147e7d55261e127f429e9ff936820d54312ff3c6f14ce9d4f7fcc62bd7c2987de2cbce060fb42d22aa85
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEB:A3k03kB56rt
TLSH
T128157B03E6850FA8D10F81749A958662EA737C425F2097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4100-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5cd-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5cf-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4100-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1236-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-537.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-610.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001bacb-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-909.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-984.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1126.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1152.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5cd-5.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c5cf-10.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-225.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-262.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-444.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-494.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-537.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-610.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-641.dat	aspack_v212_v242
behavioral2/files/0x000200000001bacb-726.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-745.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-794.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-843.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-869.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-889.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-896.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-909.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-928.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-953.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-984.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1045.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1064.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1126.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1152.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1177.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1184.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1221.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1324.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1343.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1368.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1381.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1236	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4100	2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1236	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_5dfa8d1b53ec4c74f2edf86f4955509d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4100

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 921KB
SHA256 8586032fcf1d35ec45a194fabc22c8ba0b068c4aff4c5f7f45ac9404b4ef5f0f
MD5 5dfa8d1b53ec4c74f2edf86f4955509d
SHA1 4086336dca34d7ccee8c186b2aad37e1ef631a1e
SHA512 fa64487ec13a491f9b5c577e967f4376e174b032e318147e7d55261e127f429e9ff936820d54312ff3c6f14ce9d4f7fcc62bd7c2987de2cbce060fb42d22aa85
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEB:A3k03kB56rt
TLSH
T128157B03E6850FA8D10F81749A958662EA737C425F2097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.4MB
SHA256 163f15f4d2ffa284c0c99dc16cad4189aab976d34bc1ba0ad9b9827ba01678ba
MD5 a4105b40258748b370d119e43495fb71
SHA1 d8706649d953d7bbbc348f13a5963fd0bc03edbc
SHA512 1ceeabe34e0fb958fd2b7f6be2ab430507eb5ae5d995e9bb25fa073de944379c144fb22fe06fe1f74ab11d1434e1375b46d7d071364916fca74a409a1ed08a5d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEN0Le5ji0hmxNrM:A3k03kB56rpPji0Aj
TLSH
T1CB655B16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 935KB
SHA256 09e46cb78f3dd26c08ff62311e32f9ec217109c580ffe88c40be068a7e38d58f
MD5 bf09a3aa4fc53ab71ce3c1d9ce7e9278
SHA1 d674aaa63acd77e46eb9197492c762c035b5f0d1
SHA512 369f87dec7dc08abf10fa20c7aa70d224d99656306efbe64e6613080ca8b13463910d5d218fe632b7a25cfd9b93be4db969a281395b5a6d4b5e3186911bbe568
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEfa:A3k03kB56r
TLSH
T1F3157B03E6850FA8D10F81749A954662EA737C025F6097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 968KB
SHA256 3b6d97c55e9d04f9c2ccd24957b3ac55602b908beb6c5841be9ab10cbe0ee19e
MD5 5262a8718c2de248a7b19f4401a99b90
SHA1 7185ee47247252b6bb9e3389d29fe6358e43580e
SHA512 1a8f4e1e21f79e928f538c55433cefbbe02de2f03fbabd8d0da7645665978f711e5762067ddd61152677e892ace1e1ef81d4e4a47e3ccf4f75eeba1c75642ca3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEMb:A3k03kB56rYb
TLSH
T16A257C03E6940FA5D10F81749AA58662EA777C421F2097DF2358EE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 944KB
SHA256 8a3483eeb8de280a3480088d60a5a5a45cd51637196991f741e1ccd1d6bbabfa
MD5 b4e710cc9e93f306ba81b60d2bb92001
SHA1 e5a88ca31681d47cb2b281579f753769ed38f6e8
SHA512 1553c4ffb976116540234f4608bc99cef4254566cc3aa6d71f7ee1090d0821a7924344c1d6b5927f04b9a43dc7e8b1d37cf10e4b517290a63034e01663a11139
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaE+6:A3k03kB56r1
TLSH
T156257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 944KB
SHA256 0b6e71e3cbc40753f8c2e45d64bac144e02c6a68bf830204b95ff69ce510a8ea
MD5 028476109760387e5b674e7978592353
SHA1 ee9d052a46977149624ad4ff59ab1afd2cc67d81
SHA512 6f93c924c7b42630f50d9abdc1e1ff91a0b832d0e15e76510b734acc6a9d1ebcd76b701034f42896afab52e3389d3e055c3adec3866581b7d926b3a846c9fe47
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEuN:A3k03kB56rE
TLSH
T153257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 944KB
SHA256 d8763c6e28d49fd47f726f0bc7ebf22e8cbdc133f0850ec2dd3a5b5b20620612
MD5 b5961a08f9c2ff52a611bc1cac771f38
SHA1 4510744cd2faea9002b2379a795aafa991f3fc5b
SHA512 0ad16e71b4b089453525e02a99f3030b8383ed733e09061dd3bff86673521b82f83c50f0f347e721c31ceb36e4735c5b78aca99d18e22b529cd78124190f6378
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaE8f:A3k03kB56rE
TLSH
T125257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 944KB
SHA256 6a30dc0504248c7b82d366ec4c769afb063242372ad5b7fda3cbfa63e39dda95
MD5 bbe8b054e692c1ff76210ee89d59beb2
SHA1 ab0d5ac5706b87541fb406c38adb7a8e50adcdee
SHA512 4e1c298c57c0b49a4317f57f488a0a50767380da3a87af41c46810d1b7c18451db4ab69f38d893d31aad077bdaccc8f7b24d91a71fd60757390bc00ccb4efaf9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEGo:A3k03kB56rZ
TLSH
T1DC257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 944KB
SHA256 dae64b514710d07994ea60ceca45523036ff7c87d20457aa11cf5805c14dfadc
MD5 af7d2154f2a6f17030bed3d08608b7a8
SHA1 ea6b584b771ba260a0b3a0f277b0e94ac92b7428
SHA512 81073869381f90351fd679c61039f6a11877dd4be05e1dc5408fea0b346e95b9c4715b15e80d84f4b7d13130155fc4aa662eb293cf886a75c5d72b029659c7dd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaE6u:A3k03kB56rb
TLSH
T1ED257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 944KB
SHA256 64b06b1ff6a82c3d39286d48e786a40b347597404d6461e0dfde6ead3377d913
MD5 6ef717b63c89d96742cc0813ec8aaec4
SHA1 7ac3f6ceb4c42e7038dd1bdf233436d043385199
SHA512 6382ec0871d8a2289dce576caee26dab2dcb9eac72ba31c915d8034b124712ccbbbaea735cdec8696da9d3159e8d1290cb3a676e9dcda9b94ef5b3c623e602d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEO9:A3k03kB56ra
TLSH
T1A6257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 944KB
SHA256 75d7fe999b7b9bfed0776762ac3e154dffd8b8096096f4ce368e27bbe4510308
MD5 84e3e1ac5b7effd220df065b88f60e5a
SHA1 c9486434fc2487c991d319587c31c198556bf30f
SHA512 865b6c4d9af44e547833df8eb20165a1d315d88e5db88a1589c2bc38aa3ddd7b474fb5280f9d67a345322ece22a105c1a7ef8bed589a03a672280a90243217fb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEOc:A3k03kB56r3
TLSH
T1DE257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 944KB
SHA256 9b348d7882dd990227b924f91438fa974b53bba5e5359071d70dfcbff518c989
MD5 dd2e3b2e912f95c321069d6a48938bd1
SHA1 06e2db59fa5d7dd8b90be743adfad503948f6041
SHA512 5eb95ee4074243bb2a1613ccf0537ab13f41fb4b450083619309a7e47e6510b76fe81fff8126a0a1692f8e9b50e0c9d51dcffcdb2982bf8e27b3007fa8537aac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEXp:A3k03kB56rt
TLSH
T1A6257B03E6850FA8D10F81749A964662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 944KB
SHA256 9555b5242793524a610639db73b4061b9d6ccfa070f3fb517653a64839969b7a
MD5 a274322841df693cc5c5fbb576c74c96
SHA1 4f3305d785857fed255baf5853c3230715926d52
SHA512 f1883157e56f3b64830ea52c280bdc2dd67a749416023fdefccddff02b61b0d0d3d89db69ccfc618599c5070682e878c2b56673c0b6f13ff7565f5e7e67253c0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEIN:A3k03kB56rW
TLSH
T199257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 944KB
SHA256 b75c34a039d5d8a9afaeded3e2576285e4ee6cd5aecafbe0a93b6e5342dd74b0
MD5 76d3b3c83616dbd2815c8b28b6721483
SHA1 ae6eb7114a3b11b7a747d91b44f0fe8f3cec8f84
SHA512 4029a6799d3b87508337be5d7a4c514fad2702c557d0f56e3d27d1035e6a9025ca747fe8f4c1b6226a71aaccb7b52902c73289aaa47b8f1782d0fea7edce10f5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEQF:A3k03kB56r0
TLSH
T1E9257B03E6850FA8D10F81749A958662EA737C425F2097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 944KB
SHA256 89adb2390f031d7ef57066bcd5259ed0afc529fe1987f9ea327b63edd9473980
MD5 df4890ef092342d73b6913dc5bef48af
SHA1 3e9cca8593c949fd34f65629e304acb4b2b50e01
SHA512 08add9b8fe8055632b6ee972c3a7d4cb7bdf53c352cf3619d48aa52a23235e3dda16cb1681351518e5f3e0ae70132a3d03d6556851b715e3702c6f13c8bf43ef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaE1C:A3k03kB56rg
TLSH
T1C5257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 944KB
SHA256 20749df9929de5b1f2b316672257d83528ac344c8d539e0967312578215be6a6
MD5 1fa3d6ff6e43d0cc49e6d4d5f4f0e538
SHA1 0e324c61ac6a8126d35d67b3e02dc580072b9bc5
SHA512 f22d768ad7037d08123aa53d399316ddda45511f91b677595e2bb710e1d85a895fe33bddf13671221fef8ce2b10463d3b77471fdee345d5af9521e90d27e3796
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaE+w:A3k03kB56r9
TLSH
T174257B03E6850FA8D10F81749A964662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 944KB
SHA256 4cc655841060e644c069b6b583611b1facb6345b1837539894b0c05d4cab5787
MD5 ecb1e14f97aa23a050cb5d502554f77f
SHA1 fab6c3d9d66342df8efbe08253d0f6026799928b
SHA512 8649a33547641183070be5dda2037e686a5860fbebcc403bc548f35c04c683258206094b684f9d8f05ee3a6657a459c2d63273f1a4378267a28d9a1fbf3ecb22
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEtT:A3k03kB56rx
TLSH
T177257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 944KB
SHA256 a29dea778475b87dd403bdc8b3ece067c62a1f05436523f95c9d475ce71a0617
MD5 01b35dbf26608b45752514f15b632823
SHA1 dc5126f992d45cb1d29e44d5b6f13bc279c7d3f8
SHA512 57ea02829d4b1c6846ade3a29d9641722e91630933504317a5e5a1982b280905d1a17d87540f013e2117ae621e3f23ecf639298238d6fe8f798c36a2f199cbd3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEzu:A3k03kB56rm
TLSH
T1F6257B03E6850FA8D10F81749A964662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 944KB
SHA256 e769903eb14be22ddf6b1241c819cd64bbdd6e5c4022752e5ead51ac16511042
MD5 51d8f81125ce6dc323099d6620276db9
SHA1 c430b48455ae1c4c0a90fb62f1c565deca0aa9c3
SHA512 24672fc4641e4eddcb650087f0df7c55f40ba0b0f66f9ebad6145bd5a4f03268a83641afb68b58a7c904680f74dd996221c1181346e125f23b95e713587a725d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEnb:A3k03kB56r3
TLSH
T147257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 944KB
SHA256 fab163cca3e5a08709b70725a57870159186b179f8dd5a959cd48efe98442575
MD5 44354e19b4c651921c1b454f39b96297
SHA1 fa0924ddb109f64bbc9239ce3cbae91a874fcdd1
SHA512 feee01c068e35f0437af8d83babeb2e2b11e832b4968f701f3577833147f9551786e3f1dad89c45ee0fd3ffe1d01c872413c00b69bfce3f9d73435713a08795e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEjf:A3k03kB56rf
TLSH
T1D7257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 944KB
SHA256 d3eda78be85f52192f62cb1f6f225ddfcf3345b40118a74aaee3079d02ab9dc2
MD5 a578adc3b84a6caf00ccd15b6e4e066f
SHA1 e7a6f674133b4d11bc4e540e2c82acf34e023a91
SHA512 cc1bc2ea78e339413c7c7294a21fc6454d66ece189528d2aab0d74675bb092b93b0371fb3c0e028aaff8f2e23f442c830518845d666a8e719dd2ac7f3dcf9f78
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEcK:A3k03kB56r/
TLSH
T191257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 944KB
SHA256 1d57b2082b7bc8255fddc9eeedca94972928c126fe4af5ef7d93ae0f5c88a867
MD5 a45914c63623eddd2400a7553da2cadd
SHA1 29758723022b2af61fdab57874c34d5405706ac8
SHA512 04f4648fb70498a7205f49339b6e249066882f9f645dee750335e278f05c1b47915f08ae8f51edd21f58367178b77096fbea4b6a0706d4f290446e5b584e68ba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEhk:A3k03kB56rK
TLSH
T161257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 944KB
SHA256 a330b67aea6cf79f4c2125df888fb8c31e745c44d83d5ee392caaa1a6976502e
MD5 a2204419393128fd0943398570a985d7
SHA1 a780f8d0339e3daef4376d238f2d8d1ca82acf58
SHA512 81a41d1f48fdac2b00cbaa97f407475a4cc513d8809d293dd2875cc81547dbb3cffbf334f3605b4a3637eff140ea86f49b5b33a3dde35ca24ea86df7f42cd346
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEu0:A3k03kB56r/
TLSH
T140257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 944KB
SHA256 97ad1bc98864cf28b0afbacbb18906fac76f77253dff7d94abaf84dc9c63aed8
MD5 241e3ce89112ca7c52aa23a03c46249a
SHA1 41b7412ea785149bea67c02b24cb6e5ccc2ac428
SHA512 ee9ede8aacaa1f8e9b96e7227b13cde216c648a8c965d44ee73503fe1f4a9046ddb7ad3e4967f9eb32e585fe429b114eda1c8b0030aee7c5b4e08ee05e6771a9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaE9g:A3k03kB56ri
TLSH
T12C257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 944KB
SHA256 a3d47a3dfda26e42087679da600abd6a0dd9fa9fd54d77a7690d8e190f6b6580
MD5 453059f20b2ab1b904475b8754b84f24
SHA1 3ead166bd5cce9f8ec80980adf3abc015fb7446f
SHA512 2227fde6acb37c41176e147a2bf05c778e14bda3605ee3117305c78b1847cf3a5e497d2ebc93da06cac74724d5429bb6f5a8713c905c698977ab3c58d656b781
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEsr:A3k03kB56rs
TLSH
T14D257B03E6850FA8D10F81749A964662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 944KB
SHA256 0744a5436007cb4a6407ce9e97971ee8ce135c4eb359464925c3e32ed40090a1
MD5 2d22065638ab3b1d6609f6aaec207566
SHA1 6a27c7638451988d046e5c79a99f2751bc303bc4
SHA512 24e3cd9d96f878ac69f964c0e52bae849d9e1c26a19d8181b47f33275dde5bcf1f7403d83f80b7f55f07160f40142acf19068a955ee2421499ae753cca1d964f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEin:A3k03kB56rW
TLSH
T137257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 944KB
SHA256 5742c5aa75af2686865b17a661b99606f1aab82be9c584a3246b12559ca097df
MD5 f7c81cb6234c09bfee17c30d98d2cdf5
SHA1 bc70eda2344e3efd5264ea59b692c61b01c8811b
SHA512 1cfd95640eaeb2285b1b11b485f4de1beeffbf4d2fefd5c98aea0aaab6e44b52f53aa1755816c6d389a381c69273981d85e78dd9cef76ed64edbc5c021030b04
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEIx:A3k03kB56rM
TLSH
T19F257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 944KB
SHA256 f18b44badfcf036357023445597193b800984bfda967a1ac4bd15ee74d6a687d
MD5 ce5a2d194e800b31ae10825ff5142f1b
SHA1 068d0864684673debd5198f98665497f47d469ee
SHA512 5f2b4866bfec7d28283d57432bceb89a32b52da37d63f108839c8a795d0d968527e68efa402a522a7e2f1f2994a2e7196f11598b863d6aada87627848d4ecceb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaE6A:A3k03kB56rX
TLSH
T13B257B03E6850FA8D10F81749A958662EA737C025F2097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 944KB
SHA256 e815ecda4b8d5429ec3a1d04cc12113f0b66d2fe9d3cff9bcfc678fff26085f4
MD5 38ab37a1b2bbd2d59240b46a9d22f899
SHA1 e68d6316db23e8315cb495777a7fea9541a427b0
SHA512 d43ee8fc4a97dd4d062706021449b26e0914754733e3f4861b4cb0090ad901aa0d7404ca3d88fa9731f0be44fb5e9011f59f3fb6b29e0c7008c469e99879eb1f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEz9Q:A3k03kB56ra
TLSH
T1E4257B03E6850FA8D10F81749A958662EA737C425F2097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 944KB
SHA256 83922bb65205a2c2a9a8b3fd8357bd8ed459b891cb8db22b4463a61eb09cbcec
MD5 d980ed4db97b8c8922cca2be6a070a01
SHA1 4ed7c1bb6beb956a9d605e253e51bb3ced26e483
SHA512 65a25fdc5a2aada10b0a955cf7825a0a9f5bfc07038e19970441bf76d8c4b20a207c45717d45e4b8ec541266729f8ad670be78422e1c10a8b88f9a34d62e59dd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEy4:A3k03kB56r5
TLSH
T1BA257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 944KB
SHA256 d7ae2532a70c2ee5baab50a12bfc319e1c37704c721770721b1b0b82621f3d9d
MD5 62914751aa808ad72a97636f6e4a24a0
SHA1 49a6764b410718f263429f59ed2db7ebb84c04c7
SHA512 a84dfe685753301461d5af4770f0276179afafade4fe6524c579580fa188bd2204dcd262505d914e9a827e8cbd0fa4fdb51edac211948d14c426da3ed6905f8e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEpu:A3k03kB56rE
TLSH
T1EA257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 944KB
SHA256 6e1c7eaaa7a7c9d7e8a23cfa38d0118742ba7ee08b160af51338750710dad7a5
MD5 16dc0f905797d2078a89eb5e1ff0731b
SHA1 d18e387377290d79d6b3f4bfaf8ac2517ee381f9
SHA512 ebb82124bc9cafe4387f228f217562f9c05838d8088adcbc107e18ae4d131793151dda69819cc23ee266884df8a2890659be4d2628f038742d6df75c90e15096
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEcj:A3k03kB56rG
TLSH
T1EB257B03E6850FA8D10F81749A964662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 944KB
SHA256 d6bee1d1e2823995aad4f7ede61d1c46db00e4c4f3da6303cd17d55c71936163
MD5 fd92cd68b52420045be946c68785a70a
SHA1 b9e39e0cceb4375cb8a8f328eeba3a0737bff3ba
SHA512 ff8fa9dc187fdc56e60c2ab6ec1508fc40a15fab997f1cf25481efea6761e6ebee948ef78335faab4b0258d5d8dbd674a4ace918e2e4da8fc59fe3213bec7e84
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaE9g:A3k03kB56rq
TLSH
T115257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 944KB
SHA256 d2904672f0f32d55be17de8ac765ffbcb6e13fee0cd93476316689294c261814
MD5 b3d261df753281ee65fc908a834bba0a
SHA1 a55f72bfbc7c2ab50f22486c909fc14ca780665f
SHA512 9c43c3cbeaafdd79fd0cce72973e720df3620e29cf5eaab8fb01c20b877c989ba8b50e2e4d2aca237e203c598724bcf964cb74108e088edb35823330241a8e0c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEMI:A3k03kB56rL
TLSH
T115257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 944KB
SHA256 7ca0adcfbba21909bc9e3e78be4acbbeef4a5c254adc272cc7c83b1b9a0b56f2
MD5 5d039eca67690b1606e9dc4afe541b3e
SHA1 957bbb763f7e587174b42b0b858aec6cb9145d23
SHA512 64ccca387109e89c13711b822524651ef0ccdaa94b44347017a7f5a1d524514397419173beeffe95fd579725ee754e25cb1e18689efe93bd4a14f586d3a299d7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaE+o:A3k03kB56rV
TLSH
T1C4257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 944KB
SHA256 3b9774e5afe68763622d3b27bfa79472f69e880338318b61c1c0d2da08d1fccf
MD5 f43fa187576746d91c0bab92477bc6e7
SHA1 3936dd99353fd7b6f14b3ee9d7380c24d59b3d03
SHA512 02ee48e65f478d5fdd9089bf6b288aa0fdb309a69fb9bf8cba08c0f77ece843fcc4e40cdb3ade4809bf6c064bc1487791c09801672cfe62e3af76b3efce2558e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEF+:A3k03kB56rw
TLSH
T1EB257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 944KB
SHA256 75616b8d1ad02be5107d09c0546221f221dbf70182d62d37a34171b8b6e2cc9f
MD5 d5b89c9e8e512d5a596bbd58a065d90f
SHA1 8844dd6204850379815a0c678130eaa5f10b5884
SHA512 3f865eaed2a74fcfe88bd85c61c4d56456e5a748d349c0a5e17d0d4cf2b6b2d0234c043f7ecf587bc65a77f503858c0dd80b6e15a2518d61deecdc5f1b983d2c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaETQ:A3k03kB56rA
TLSH
T101257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 944KB
SHA256 2caf838124bd70aa29969ae1bb3017c1377f53e30d326b7b0f26faf966568ba5
MD5 d2378488c231adc57b33c4fbb6ab3cb6
SHA1 179dfd718664c3b5673c9d65dba9ddb9a31e1da7
SHA512 09c4aca76f055d1e04d5747598e90d5df5077958e7b8ba1c04032f34bb0688517ded943cc99307c4a7877df216feedd0d261c2f5a749af5a0065729ebdc65760
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaE4X:A3k03kB56rw
TLSH
T1D7257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 944KB
SHA256 03e27f0b1308da60c3c1b43d9c20c6b233c061823d2585f97ac8fdfc6a0973c4
MD5 a31ca2068d352c7b06611fd9a001c2fe
SHA1 26cae114d26f158757877a964aa336ce718f591e
SHA512 1a19c8f1cb49508d0e9dcbd9da97649c55e926a5ed71b64ed4fb3878a6d7e2c1a90d3314e4c36870527448f574399aef8b83653154de4f680233086b3c4d705b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEuL:A3k03kB56rS
TLSH
T10D257B03E6850FA8D10F81749A964662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 944KB
SHA256 b8e6101ea2bd03b16334bd68485d7e32480f2df4168af0088dac9304d22e42d2
MD5 8ef7e3634b598d76d695bc41e755cceb
SHA1 94fea0553426dc6a0afb755bbfe8f9c4d0c36b1b
SHA512 938fd06f4b968c89c1d4036a4c4e36d95adccffe67f9c212aa8f7450021db59829538db074fd131bb9c1694238a427e583c07003380e276f56e3b587e511a54b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaEiM:A3k03kB56r/
TLSH
T13E257B03E6850FA8D10F81749A958662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 944KB
SHA256 6e9adb488e3e9fb78fe2872134788843a2fac9b264c37e04997047c19d4f75b2
MD5 bca31f544a2af18bbd69b53199299edc
SHA1 2fe81953c1a881051ceeb614933bdb7f1ac2e58f
SHA512 0994443fd06fbd54f264f72d81a636fc2d59410be876464ce1d94f09b5b2376c9c25d6b7bb839c78cfef21d5079fbd595fb7a2b2677cd10c5401fd98ae6d7cd2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0abaETh:A3k03kB56rx
TLSH
T13B257B03E6850FA8D10F81749A964662EA737C025F6097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4100-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4100-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads