3e609dc3244f794f4c80543fb09349920b228bf8ee6cf45fd8925ad6df15c1e7

Analysis

max time kernel
99s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 741KB
Sample260820-st6fyazeld
SHA256 3e609dc3244f794f4c80543fb09349920b228bf8ee6cf45fd8925ad6df15c1e7
MD5 654814de33211ca4b85487edbb0d5b17
SHA1 6ec68220d07f61aeb34b175499b3614d64dadca2
SHA512 49848aa896a101b92a6cfe950a3879b04c22dec6c43f9157e86d2ccca7072f65406992fed2db6f188d0c88bc433dbec34caac8b8090747c00f633ff8955e6569
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzC:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzC
TLSH
T1B8F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/1236-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001000000001c545-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1236-82-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/8-119-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-681.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-730.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-984.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1021.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001000000001c545-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-477.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-588.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-681.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-730.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-921.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-984.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1021.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1153.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1186.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1345.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1385.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
8	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1236	2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
8	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_654814de33211ca4b85487edbb0d5b17_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1236

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 741KB
SHA256 3e609dc3244f794f4c80543fb09349920b228bf8ee6cf45fd8925ad6df15c1e7
MD5 654814de33211ca4b85487edbb0d5b17
SHA1 6ec68220d07f61aeb34b175499b3614d64dadca2
SHA512 49848aa896a101b92a6cfe950a3879b04c22dec6c43f9157e86d2ccca7072f65406992fed2db6f188d0c88bc433dbec34caac8b8090747c00f633ff8955e6569
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzC:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzC
TLSH
T1B8F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 f0157aab965671c24354b1cbd86cca5d722e016d767ef307576d401036721dba
MD5 ad82c5eda59d2bf0782f9da8cb869821
SHA1 9e0f5a13e75df68e8c7dd76d160571dc19d00c9b
SHA512 5f61a26c9b743c5c11d5445319153a225e722d4b61b6bd2bb636042847d64120b51c7820bcb99be7dc07edc15243ce2e1c9f6751ab83687ccabab47256513835
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzC0Le5ji0hmxNrM:A3IqJtb2ITPji0Aj
TLSH
T133551A25F6748731D073C0B9C5D2A69AEE7234825B308ACB1286D76C2F677E6C53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 755KB
SHA256 edc57d3b39b372996491630a2dd36de4dbbdb9bfec6ad2102435a6be8ef9045b
MD5 78404d350685a1c743585383e9a970b5
SHA1 863fbe65cc6124a5e7e19567f7675a5338fd01ed
SHA512 2e589079441cc546febb0203c7225ad3e24a76ebe0bffc0a4326964d830caece7a4bb1257a923ea0c107ba4ee8d4e3771549c412dd750b39cb93cd046a869657
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzMa:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzMa
TLSH
T121F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 764KB
SHA256 5d667ec094e5a84f90084724eb069b47a3cc36bf271b7baf5b75b82882536cee
MD5 ae2ddc85f384f95c34c5755883b0647f
SHA1 dca867acdeba1db27ffb391179c641d62b32cc36
SHA512 424ec331f8f8ace360413c6c26d5a0ab89dd37470253c653028a0c7b407e163edc6c94236d954a42902c886481b934672fae0dbdb87722c61083d21889c4660f
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzl6:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzl6
TLSH
T152F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 764KB
SHA256 30e8e7df35d0db691c17816968fffa8376e1fa2106508b24209b6142e720024f
MD5 cd22b9ee2a26b0dd6241250ea80bdaf3
SHA1 4f42e6087359b0f839159525b3ac12e1dc81b031
SHA512 7002b4aecd18b2022f1896fb97b3f5f31ec4b653c92154cd558f1853d7bb65bbbb39b55439458c10ac1cc51b0c56363b2557ca7d780516be92144bc659512aa1
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZz7N:A3mMYTqMi8CtBd2QHCHmTBW5ETCZz7N
TLSH
T109F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 764KB
SHA256 0ab620e4a36252a26e0f4496aa7463607a33fb52adb7601091ec28993d9e0dd8
MD5 3e33e763610fe1969443b610ca9fb29a
SHA1 8b3d9d9d7fd98b3923dd2001b09648d54e448b4c
SHA512 036e1d91ec2d54104f6cdeb86a76be2f3740e6af1f52ddacaaa4a9f1a98268c8f7206d4fbc026eb5dd5b49a9e4d750027685512aea7e6a29f808ae1700efa946
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzZf:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzZf
TLSH
T130F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 902KB
SHA256 2fa2c4f441193b3a977a5798cdc0786aeb12cfe930ce9c3e44ef40b7e05c5272
MD5 5fc989fca661a66029e11151dea316e9
SHA1 9da34f67dbfac244940337940a5024572accd308
SHA512 e5987841bdbb6e1fee8b8923f9c26d0037e368603c742b2ec4c81f27d9fec62db76f3e6a9611639177a1a32bab6e497abd1c1392c3a326d658d35e314c72ff78
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzkzy7:A3IqJtb2I9s
TLSH
T1C7152A26F6748375D073C079C5D2AA9AFA3234425B308ACB1289D76C2F277D6D93A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 764KB
SHA256 5ec81f8e6d422e7c19899f3a5df9e3f99d128139d3271e39d0eab446f51adde2
MD5 af66ef0bcc7856a08a1a000b96bd9811
SHA1 4765769ec8d4b85ef3733a6a817759b2bf449f6d
SHA512 163a48d784ea8800dd0235eff1b1535ccb1e9db4fe413d71eb60d4538e53796e4d6d9ebabd98231bbbffae7173922f929585a816b0c7beabb940373d6c2de3fe
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzbo:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzbo
TLSH
T15FF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 764KB
SHA256 72d4ec1ab4b49fb8b7312be3af294e351ae15b9e7fc44820b1da4f8ca8f27792
MD5 ca5462f4e77fbf7447be5cddf519a335
SHA1 07b932f4543f22a0914495e3486e6dcec72d921e
SHA512 5933734b6c467ceead89cb45deff354496a66119881e8e7fe66de32c743d42a22b0c6c14db0fd720a72334434042f5b5c58f849023f1433016eb61321bee9383
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzPu:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzPu
TLSH
T1ABF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 902KB
SHA256 c4bd201354976c529d8f7fc307e85ea3cd77e5efe4a52d3a0a76ad4c3c438b32
MD5 bb11534fd4c04908a22eeae69d8554f5
SHA1 ae63bf8ecf942c78a94944578e1ffef05d20d0fe
SHA512 843ce63de887a0a9c68517a2d2b3733b9a276bebacccd958877f2908ccbafc4e8ea81483d9a9b98c9e0dae00afc96adc53a4ab270df5506e87332a4c1289a71b
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzVzy8:A3IqJtb2IsT
TLSH
T1C9152A26F6748375D073C079C5D2AA9AFA3234425B308ACB1289D76C2F277D6D93A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 764KB
SHA256 e914cb015202250d76cc59d5fcb7efe174418c8bd5d0412b910b4cf4f085d863
MD5 eef4b0b6394506a38907ac418276ab1d
SHA1 8552eee5c8b9d889f62a7037c6c719cad7e5a847
SHA512 2896ffc443fb4d0754611ffa82de1af4369341bd4435e92636595d492831b56e1d1aec090202ecee6e308ab451b653132642932749d68df3bbdd77d3fded75cf
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzd9:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzd9
TLSH
T1EDF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 764KB
SHA256 be5f632ad60f2ee49847bc6aabf0772b14402df62b10101d01329df9db4b3efc
MD5 a0063a6095dbc4f918849ae73a0c1233
SHA1 87aadbaa659551f4d997cd7d467b22f845c8b8b2
SHA512 bc08b936efcc0187fc332ddd7a34fd7b341340e4773b09d9800930754a042ab9154734106c282eef79e169153457732ddabe6c8a4d222d2efca390ab24195509
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZz5c:A3mMYTqMi8CtBd2QHCHmTBW5ETCZz5c
TLSH
T16AF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 764KB
SHA256 e04ad25c7be6ca3dc54dc2d151ede8bc1c53640e5509a6401a6bd093d2eec3d9
MD5 c46f6cecc679bff342c61c6593869d0f
SHA1 0b1d4c71126b9ddc8b08299e7bdaa15342092e26
SHA512 c92179c305e949afec72a190f9e60b249d12b76cceeb02aa6e55036cb6a779fc39d1368898112103a9853d93c98cb902f0994e6037f7f832889159d8a79b8bf8
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzyp:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzyp
TLSH
T1F8F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 764KB
SHA256 bc60846d016d034d4d08c2a090b3626c8bddd7c61bb459b40d52a3cdaad85eb6
MD5 466498d821dcd333f55cabcbef24e335
SHA1 036371a213aac13d86c094244dc61c845af0639e
SHA512 05679a5a71b08b7da03ee3e90b0e3788a01f944792630edef86cb1cd69a825fdf3d94fc13753af0cc7030b39e04a12db96e8f5283a140ed8d653aea4d577e369
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzF0a:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzFN
TLSH
T109F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 764KB
SHA256 bdd2167e0a22628c30a8216bf48470ce3477aaf743eb67cee361cd71c65ccdce
MD5 d069f1afb9ddfa3ca5506aef98e754b0
SHA1 73ad57406c36d415e492bcd3dd27d7bc45b66ba3
SHA512 c85bf6647e19c6db48214e7c2ea9267d421d858a735694bfaa6af5dfcccf13c9e10b5c51e5a6b250bac9db589edc543ae5022161c937c86f1f2537dcd5a3e220
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzXF:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzXF
TLSH
T1C0F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 764KB
SHA256 30d2ae0bf3274d1887692ea197ce97344bb90f0925fe97253b265a45abd724f5
MD5 62fc91546d05b7a05323721c27199269
SHA1 2544aeb2e68b3ddae1df51be923469653c8a4e9f
SHA512 119809ef1be7c9e126cd1b131c4b42f089b20172eb30a5a228d7c89f5c3af91bce9c37152647daa300fae890c458e8fd5109f5fe9b4665be8ce961597e2363d5
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzoC:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzoC
TLSH
T18AF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 764KB
SHA256 1fe90cd58c52361e87ced1575872851d3853ff1fd903797064d60f9a215e38d5
MD5 b4ed94eb1787090ac2d35405bd13792c
SHA1 24935847df296dced91c2aecf35f7e427c9468e9
SHA512 105038fd46a55dec9e6d1650867c01e3121387b260ebbf0b552d0967ecff659f4de989731f49266f3b1063fa5816d475cea4457a420704e8b8666e9a60660d3f
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZz7w:A3mMYTqMi8CtBd2QHCHmTBW5ETCZz7w
TLSH
T10AF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 764KB
SHA256 e12670f2a4b19199157999a9dfad089ba129491d8e33f7e33d57a6dfc937f2b8
MD5 825ef52a9350b9e631fecaf20af9982d
SHA1 81846ea35a4379f2283c42011a736cd8904ae19a
SHA512 2b21804cc4ae0ff7c8da33a3ecac671a172cf5d23d3bf9a0c0f11e839eedd1486bb9797d3f4f8b408050b31b50f7854cdf3a79ab7093ccff69076612ba906bdd
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzCT:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzCT
TLSH
T1FCF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 764KB
SHA256 1aab5cadb3355bdb3092ef373f381913f9c4cb9378b018b194ccb11c5e73ef0f
MD5 73227be425e731eb2c324be04eafb1b5
SHA1 3a5d7aefc532dbf5501d5479e858d4bc2d6b4a75
SHA512 a4efbd1fc90f01cfa49c2fe0ad9f11e8956f34f22cafab44a568446768b3c24569c523e03bd42991f7d8eab9ec46f81046fe3e79b7f3eb985a421957f28a5c9f
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzSu:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzSu
TLSH
T172F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 764KB
SHA256 8c0a9867ada2e9f3c8fd3056d815e7f69208eb6a71ca225fa88e04de090cf6c8
MD5 42363e5ce2c5dd5a132b7fa83282fd2e
SHA1 758c3cc3b414a6a818681adcb43b197f0ec7e43c
SHA512 a590e154ca1c7b2c340f22e9e323aa1643320b0277d6fa65171f7f6267cd8abe666d7b40917758ab9c850078ad166e7e40a7ceec3d0080ee4132aab0390423d6
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzMb:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzMb
TLSH
T183F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 764KB
SHA256 d4ac58e29cb4261907d2cb8e2463fc9abd575797a3ba7957a655020eed4e6348
MD5 abb041248bf3a58e172870d32da3ad7c
SHA1 a8a0e72a131a126dc6b9b8af2af69a1e4f2780cf
SHA512 097ab5acb3e6ce40ddd2de2f06d6730ad9c71db7f76b9b6f6308dcfc7f458a1c00a4fac1eef831b52d24fc0bafaf075c1cde401f8a04f80875a05853ec6b905b
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzyf:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzyf
TLSH
T1FBF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 764KB
SHA256 bef9e97d85e1c459e3bd86ea487cdbc07a1dcf137a42068f1d5397ffb531f371
MD5 92b9545e2baece0a1d90afd2cac05276
SHA1 01899141a25a8148462184b0678a44f6c6bde815
SHA512 48b2915e3f5abe610b6bfeb275c1c6a03bcbc9ef3c5d23e6408e0c46239d252697afcb0279a1030b91d1bfddb80729d10e93b8b12aedd85f3ec62b4de4cc3c91
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzfK:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzfK
TLSH
T102F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 764KB
SHA256 8dbab69c080d9466570f0e2bb79672cbfc936edecd7fb293f8193316d3fb5e6e
MD5 fb8e320025d5c6d30997ee4b994c12b5
SHA1 842ca12624a5d2abe615499760e78504daf5f945
SHA512 a0c6e4e6f75ec6b46cd5d9fb4bc151dacef0b58815861384969e602ddefe9fe8d78bbafc749e07c9b3f58cdeae0b717c65c5270984047be75854b8ea78f77f84
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZz4k:A3mMYTqMi8CtBd2QHCHmTBW5ETCZz4k
TLSH
T10AF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 764KB
SHA256 07abba41d21d4b2da537abb0ff194dd4929e1fcb743e537b722c2be8bbaa3cbf
MD5 e4720fdd3514f23a0391fa6f14aeb05f
SHA1 435de61217668b57c9ad5bd522ce6612b1ecff99
SHA512 ffdcabf5baf17a4f72443d101a005fde1ca54feebc6c6deda1adb4bacf46c886a920c4c99072e86e08f122b711e7be78ff9989e385cded596ef305f521c03862
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZz50:A3mMYTqMi8CtBd2QHCHmTBW5ETCZz50
TLSH
T176F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 764KB
SHA256 c532a2588e4fbe8eec242fd53a4bd3864ef4052eda013291727487712ece7adb
MD5 9be61e12d02585eb7de18b758eb76360
SHA1 5997d03d139959a3025d373f67711ad2901b70b4
SHA512 b51fabac66ea490b408aa9f38233e21f37b5bd00c5b57eb27e2aea87ebcf2e377ab06d8d189b6cfcd34f3493ccb871a75dd43b9adec1c86778d89007ddc57d47
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzs70:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzsg
TLSH
T1C9F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 764KB
SHA256 3c9ae25e1a3f24c813d3d53f99ed3912507fb9730394b7b648a67a22cfcd45b6
MD5 43dd9215600f1a94d58fcee2d1541d61
SHA1 935c8bce249407d5eb50eae34a68b49fbf1961a0
SHA512 077b76d5d21c7f11d67e665b3b348ec63658262fd2e9046a09d9a549013517310d1a74e2f083ed5733bf12f7e65cae7c5cefac73b3590cedc935d5a1faaacda1
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzJr:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzJr
TLSH
T189F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 764KB
SHA256 7d8e6e314acdad540ffcbe3d19b4ba880b44ee0d1848a37f98696b388eb6d0a6
MD5 09a0f4633bf752ca6ed782da1744d481
SHA1 adaee3e3e8d762599e60560b9e1d3c75e878a00e
SHA512 2ef83cb2b308506c6626744bef5d8849b4fc5f156f2c12cb2f7810079bfe994e0a17f467a3ba1d29c160d7ba2947bc80d2294318059f0cde89935ec93c4bc240
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzrn:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzrn
TLSH
T12DF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 764KB
SHA256 71543bf1c359462d8661038890754839c8e5d1a8f890455effaef8c6840827e8
MD5 d045d40fb4a7a57b7392ea59a39b776c
SHA1 5e6f2aabd14f2d5b4b550f5c370b14c4e264f48c
SHA512 16c4de0716b6835c9ae659c12b75e54157e6e2f46bee537d9f98d6f4bf0348c4bf98a3761218104c0c2b25e016aa894d984e315a0c1391f40e3ed05fef493ec6
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZz3x:A3mMYTqMi8CtBd2QHCHmTBW5ETCZz3x
TLSH
T10FF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 764KB
SHA256 d420f31ab19dbe3e41cb01048c1cbf6d0feb090c2390b9561fe61a8ceaf5ddc0
MD5 03a912cf257e1c4f4d603f7f0d20b2af
SHA1 fd631d493137fb5422d86b38c1468cf3e46b55b1
SHA512 194720d89e84cc5d3b6b470d289adca5cbe655e4a478db9873e649f083dfb15b286e059a8937c1aee600eaf98a0ffb5135d08d8d57cf2a6a76352c52b9ea1657
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZztA:A3mMYTqMi8CtBd2QHCHmTBW5ETCZztA
TLSH
T156F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 764KB
SHA256 d7eee5337a8dfd9da269e9d9489515df014a6799b235b84494e8134b1d2ebf1f
MD5 f2260fd4452cb020f076d1c22199a50a
SHA1 a07024562bdbff80c1e52f335d72aca523c69b92
SHA512 5f8ecdfe3b4c55b583f7fa17f339944b82f952f472cfe4abd0c807186d709b999b6e27d03ab69c39d49c2be73b7de837dfceb6137e0f2239c087e3fb09dbac8c
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzm9Q:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzm9Q
TLSH
T178F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 764KB
SHA256 bc5f963e1714c5d5e07e686e4d1cc163077844b38e43cae57f8c66944af178eb
MD5 b21df870346cca8bb55fe3a36168495a
SHA1 0780559c78b4d55eaf8d58a1002a3a28610b4157
SHA512 826d1d04970be20a5a4e9aafe456f874f0c17204f9a846826f172e688adfffe3014c65d37b2af70b7ca8f771ba8a6f8c21740c9c574706a870692c1b0fa49831
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzD4:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzD4
TLSH
T179F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 764KB
SHA256 4cf3400ce152df67d7c0cee658392979e03fae1f4db7496109b66a4310301bd2
MD5 6c9c3d11f494c5487db6ef94bce0f346
SHA1 5ec5e37d56baf7fbe5e3f83b2ed377d196e78041
SHA512 326472dbb06c7d6f944ad0b7bb52a0db4a672769b21cd7c7bd3a362514bf22973b7fde85328235c335185db25a11a04a2c8747daee2fda7c8de6782687ef5de4
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzqu:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzqu
TLSH
T1A4F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 764KB
SHA256 7c57b75a37bbdf431ba635e436a952a0ce79ee9d26883b0505cc385c5bcc6aa0
MD5 3e6c3871b9d52f983eba3660a30dce10
SHA1 5438ed9938d533a240b00550a1effb6bdfbbf52f
SHA512 70f81e2118c8c9136d9db1195394af02993b0bfb84d6902f9ff1c0adb14547792fc2b5920f389aafbd6eaa8973429bd375f0904dfadc9b964d47b1caddb6e34d
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZz7j:A3mMYTqMi8CtBd2QHCHmTBW5ETCZz7j
TLSH
T1F9F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 764KB
SHA256 f53dd319094bedbc5893d9814ec56b02301aa433dd32c81a5edaf750a417b862
MD5 5d025474539c6adddb898e48954b786f
SHA1 39d9491fcc6cf4ecf3a02f5db44dbae93bd2c0aa
SHA512 7aadd3a93a192499173271a0b348c8044a6db3d6b4e7f86341ece4b768342272135f7e09551376281d8ce4835a1d36e6fdfcfcc4e69aa01926505a8de9a2541d
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzGg:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzGg
TLSH
T108F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 764KB
SHA256 6504b01f438bb946e2dff434fba1c43e26633e7e6629c46a53362b2c5e77194f
MD5 22b4c101cc34d9d1d473b5b546f4a547
SHA1 2aea15cf0ace6a0b70d385bd8bc4e7e7c1f9f27a
SHA512 fbd1d01fda81619ae7798e5e8c68c43751eb420ac7b379ace60b723daa5d1bd13b25f2cbe576d395e313c66b6be63d16f32116fe3582cc3f22bfb8abb85ddc20
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzpI:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzpI
TLSH
T118F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 764KB
SHA256 921fbb38b551697dcc1d4391fe53a42a24199ef9ff6239a949913255c36d35d3
MD5 0e582fc8c83ea7e5873a5c956edaf071
SHA1 4ce81c553545496add0d745d383062bb03f7a59b
SHA512 aa7a0879fcbcb5929ac5c58f033f9b5c51538a92fc34af63752d862774d5aa8875106bf3ef7a2953770bc31bcc3c7879970dac513082937d792a9b84b1c60189
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzLo:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzLo
TLSH
T1B8F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 764KB
SHA256 6d22b9112ccf2d0a2653e6a1036c42ff535de142baa7b3a431d6ce9a35d2d814
MD5 7dacbdcb32408020452c50d943c31c60
SHA1 f8017f171895ff113bc38652a89c70c01d42b89f
SHA512 dd23f277feee36681e12b38e633fb1d84315b17e0369e4a95e44b9902c366b75a717624ddee42366f2b5ea8491b751684d8ad742de353f9bf0c29313887069ac
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzw+:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzw+
TLSH
T1EAF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 764KB
SHA256 641f9a82fce35a244ed6accc79e115bc6d93d489d4f2625d1ab807943a8b5746
MD5 8ab20fa7cfe8d44858db61a60dbf2490
SHA1 b0746d1aed7f439984cc2f67a41c5268d19464a0
SHA512 b0de6301fd2a5cc23f8d38209ce35ce1bef9d7c47e836f85d8c4367a9e5c7d2bac835feb91faa182de261767a08215d0bebbb5e8de9fb68abd76bc47993a8b1a
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzIQ:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzIQ
TLSH
T1C7F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 764KB
SHA256 954de9501dfac351999c961eaedf27e04954e40111936a3eaa055d88bfbf58cd
MD5 8a2a9bb5996bed3c48071c5f122d774d
SHA1 14d779d3267965c6d5fdff42313a7be6aaa767df
SHA512 9245683f3c35ba1249514f1b7b259d0e0027e3c86591716bf26d90ba5da787f608b0031507eb712434cab3a27e4a55711dcc16135d02273d49d4ac017fb0807f
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzBX:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzBX
TLSH
T160F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 961KB
SHA256 cabaf2ee37e6d1647ad0743a2915bbc9fd3a0baca301ae4bbc85db280c2eda59
MD5 ca435d44c1cd51174b76144afea20e7f
SHA1 bc07cd33aa52d65c3b7c00f48b84425305205f6e
SHA512 3623c5a279f678e0ff97c16acf8183f2b0059076ce5c6c0ac8f7d6b330a8c01c9f594a584dca4cd17c4e4ca8b66ed1e54baae6636fc10e8326dfa1500314626a
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzGjCXF7IwZ:A3IqJtb2IZC17IwZ
TLSH
T18A254A25F6748771D073C0B9C5D2AA9AEE32384257308ACB128AD36C2F277D6D53A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 764KB
SHA256 e6366281920150f31e8173adbfd892e3e015087a6071435d2b0fc99d4202f074
MD5 ba94277bd815766b7c2f707a21561047
SHA1 d252df160ae3c9966546a1ddd72e6b545484b836
SHA512 2da7ddbf56e8aa7e5eefcc9551549a8c7dc84953e8b0147432a66e9406714855ad86da312ce184275f0fd4be8e58fce5edf6d6e8c77f256e42965da225b16f53
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZz7L:A3mMYTqMi8CtBd2QHCHmTBW5ETCZz7L
TLSH
T14FF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 764KB
SHA256 d448276fc7ccb3e04af2e6be09554f810159265d55a944034a0a19d6b972c650
MD5 1ff2a887f05099bc8a7ec92c23a718ad
SHA1 58e54f246e46722504e12ad1dab1bccb1224c548
SHA512 0fe59e0b902ca242e4e905749ce823a8d8965d54e8483ac8c88c102eaee12319e42dbdce6608e65a785394c9ba8a9f769d9a99067a7a49c325838cd101ab371c
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzBFC:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzBM
TLSH
T161F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 764KB
SHA256 7cec29177c7c461be645818b49408927e6c8c69ca5c3ec2a8c3557e25aed3134
MD5 ae9c0d1d62b57cf872ca9ef848a32b76
SHA1 11fd1e019e7b470533604205d12a4a4c0951f7b0
SHA512 17dcbba9e95813aeef333e5a5c662d4e141717d1c8d152345709ca0525c4ebe8c46432f17e5d0b281684ca32a532c360a628000cce749122bef32c6585973f3d
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZzqh:A3mMYTqMi8CtBd2QHCHmTBW5ETCZzqh
TLSH
T1A5F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-119-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1236-82-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1236-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads