69a544d00da6f3454c61a45195a384e0935462cdf721d9b8fe7d511d45a43979

Analysis

max time kernel
104s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 4.2MB
Sample260823-bamfaawthy
SHA256 69a544d00da6f3454c61a45195a384e0935462cdf721d9b8fe7d511d45a43979
MD5 c3083089197e17ed21892b8cb1280aa0
SHA1 3af1ad905b4ead9196a7e6c3dbee3894d5ee12c8
SHA512 156c43dfeeeb9f30875918e5e8aed808509f82634b18919fffeb0ed80aa0ebcfdc38ad968981801fd7ad7bd804ab79c8fb63ed03428e2d4c22f10f08f5f38314
SSDEEP 49152:A3k03kD4U2v+deW4SkZP4sz9MbE56rbeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0a:A3k03kc/vifkZcBr7fkZcNfkZcRjo
TLSH
T189161A16F6788733D0B3C0B9C5D6AA9AFA7234455F308ACB0345D72C2E276D68636736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 6 IoCs

resource	yara_rule
behavioral2/memory/2480-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4e8-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2480-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3316-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e000000019cf4-1022.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4e8-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000e000000019cf4-1022.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3316	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2480	2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
3316	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_c3083089197e17ed21892b8cb1280aa0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2480

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 4.2MB
SHA256 69a544d00da6f3454c61a45195a384e0935462cdf721d9b8fe7d511d45a43979
MD5 c3083089197e17ed21892b8cb1280aa0
SHA1 3af1ad905b4ead9196a7e6c3dbee3894d5ee12c8
SHA512 156c43dfeeeb9f30875918e5e8aed808509f82634b18919fffeb0ed80aa0ebcfdc38ad968981801fd7ad7bd804ab79c8fb63ed03428e2d4c22f10f08f5f38314
SSDEEP 49152:A3k03kD4U2v+deW4SkZP4sz9MbE56rbeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0a:A3k03kc/vifkZcBr7fkZcNfkZcRjo
TLSH
T189161A16F6788733D0B3C0B9C5D6AA9AFA7234455F308ACB0345D72C2E276D68636736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 4.7MB
SHA256 cfebfdfb1ab4c7888c43d616bce3f4e94174a8df145c5ae7c36ce3635e32c2ac
MD5 f43df365a4ce699511c6aa3d54910de3
SHA1 635627cf3a4610ece4903f6a0b48afa0340952a6
SHA512 3a5b04cc3026ee81f6ea4b2cf2048a3cbc9639c6f0aee6f3f0216901603693eb6017541060a8c728a6c9feb46e3397c1ec99c58680a7f0664cbdecbf4d637bb8
SSDEEP 98304:A3k03kc/vifkZcBr7fkZcNfkZcRjo0jo:A3k03kc/0P1zPpPVo+o
TLSH
T1D9362A16F6788733D0B3C0B9C5D6AA9AFA7234455B308ACB0345D72C2E277D68636736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DW20.EXE$

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
Size 4.2MB
SHA256 069c6d2c00e3220a84917c75ddf268fb1e5ac8795b03a7eb22f38e13e1d31158
MD5 a4b828879f70de77043f6e824aa131a7
SHA1 cce1487b6496c387c0e214ba01a504d03d5df075
SHA512 77215e4bba0c1f1355e50f13077f985ad59c1eeb24ada71e1e6d59e5ea7e686d9cf66924869588ad3a3a9e6b16bcc1570c99b88c64cdbe02fcb93c0391b5c649
SSDEEP 49152:A3k03kD4U2v+deW4SkZP4sz9MbE56rbeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0s:A3k03kc/vifkZcBr7fkZcNfkZcRjoX
TLSH
T1E8161A16F6788733D0B3C0B9C5D6AA9AFA7234455F308ACB0345D72C2E276D68636736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2480-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2480-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3316-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads