85ebdc260e0edb00f6026edb9b10d83cc3159b2b6c8c692c7d8c4eead47f086a

Analysis

max time kernel
100s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 955KB
Sample260817-tgphbsvtfs
SHA256 85ebdc260e0edb00f6026edb9b10d83cc3159b2b6c8c692c7d8c4eead47f086a
MD5 466300f78e82b481462479bf36ed93ec
SHA1 2d3a718f6e5e188d5e1758cc8b67e2ee9b9a31d2
SHA512 6f0efc70d501770bc2cf4972d9c63e7c445a8a653c082ddc986babbdd13e5c79d528c0a6f2fdfd6bd80098e3cbcb616ac8410b038f9ccd8217c5d8db46d32ca8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduECxbQfN:A3k03kHRJs
TLSH
T14825AF13EB9500E9E10AC1749AE54A23EB757C56176097DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 9 IoCs

resource	yara_rule
behavioral2/memory/3632-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f9-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-9.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30f-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3632-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6032-77-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019989-540.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a56e-776.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a56c-813.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5f9-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b301-9.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30f-39.dat	aspack_v212_v242
behavioral2/files/0x0003000000019989-540.dat	aspack_v212_v242
behavioral2/files/0x000300000001a56e-776.dat	aspack_v212_v242
behavioral2/files/0x000300000001a56c-813.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6032	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3632	2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
6032	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_466300f78e82b481462479bf36ed93ec_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3632

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 955KB
SHA256 85ebdc260e0edb00f6026edb9b10d83cc3159b2b6c8c692c7d8c4eead47f086a
MD5 466300f78e82b481462479bf36ed93ec
SHA1 2d3a718f6e5e188d5e1758cc8b67e2ee9b9a31d2
SHA512 6f0efc70d501770bc2cf4972d9c63e7c445a8a653c082ddc986babbdd13e5c79d528c0a6f2fdfd6bd80098e3cbcb616ac8410b038f9ccd8217c5d8db46d32ca8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduECxbQfN:A3k03kHRJs
TLSH
T14825AF13EB9500E9E10AC1749AE54A23EB757C56176097DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 6177ac4a2617c84d32b06cca3d46cd712b74757d2ee3a1b315055bbc39e6de76
MD5 86284ebb86ed03cdc26a1ad1f44e295e
SHA1 1c007115521e9505b079b236ceee4b7a60b5c189
SHA512 96e84e5dd63cc2c75abc9fb0c445d096de05c7108da472e234bc565944673b28dc5d50be74a8574a4e3f114edd5905b458afa74ea80bbcdf73ac74aabafcc79b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduECxbQfZ0Le5ji0hmxNrM:A3k03kHRJ0Pji0Aj
TLSH
T18E658D17F6A402B5D067C1B8C9E69A5AEE7138421B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 969KB
SHA256 57c2afd03923cb9b9fef5cf05d9dfc8a05617a0b6129f72493eed943b49323d5
MD5 3d3411efcfe0160b5aef668406ac106f
SHA1 005e473556c186a9dcfcf852eaf8d1465e93b2b0
SHA512 093cf389f72a14520c1d1554e4015259403ad546874290dd85f426376caa7a2f55c1387014b72da12f3eb601464dc680f45fa9676a5e5d31213d7f783e429e4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduECxbQfLa:A3k03kHRJ
TLSH
T15325AF13EB9400E5E10AC174AAE54A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
Size 978KB
SHA256 d455330afbcec636897a14d0af0400280f151efedf38835e0096ae17883c66f0
MD5 2c2fc0a3ec6986c26d6f5d574b69f4ac
SHA1 e5d690db8534a4befa2f13be59d2f15888752044
SHA512 a20ed85b8bc90b916d0a97992443272b3e0b1884cd04f20cd7350f48fe0e0261713a33c2bcdc14b2c019b25dd3bd0ab768617ad0747d61cb92318bb375fd4e47
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduECxbQfV93:A3k03kHRJQ
TLSH
T1AA25AF13EB9504E5E10AC174AAE54A23EB757C56176097DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.NetFX40.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
Size 976KB
SHA256 03985e65279d862de0ea171ba20ac583e802e53deb5ac9575c9adcd12894a6cf
MD5 c9bb9e41a62ec86276db0994b125779e
SHA1 e3baf2f61760758ca7ae5639880e5c70f34535da
SHA512 aaee2e578508a4e15f20fee66fbee626c4aafbac799e0b9e5ef9401b0812ccc96fb88daedbda34097005eab04e40d88b61f715f314263a2a11345e176ae3c0b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduECxbQfQ:A3k03kHRJ
TLSH
T12A25AE13EB9400E5E10AC1749AE68A23EB757D56176097DF2358C2152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.NetFX45.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
Size 976KB
SHA256 89d9b0786efc70cae499556a8e946efe71c05cb995058e1cf77ccd532297922a
MD5 4b2b4fa541046c377481c22b19ea7f61
SHA1 020693fcf58cf9a0934bb35d4e1275f08072b35c
SHA512 7da4d8e9532142f243d7add86c4ad96638e36f6d8a0fb745cc0c350ea74fbe119e6156b3d93fd7a3a34c8cd65a819b7e83a13aa72e3860123bba4c68c8c12b9c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduECxbQfAj:A3k03kHRJR
TLSH
T1DB25AE13EB9500E5E10AC1749AE58A23EB75BD56176097DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3632-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3632-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6032-77-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads