Analysis
- max time kernel
100s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
- Size 4.4MB
- Sample261024-bcwfzaey91
- SHA256 171f1b7c9d62c43f7bb44086424f5305c138b3eb0b38ec4ab3e4e6abd2efdf46
- MD5 abc1ffca55190104b832bde709b8cb22
- SHA1 8818ec46d0be6d62420848b0cf2c17c9cd53737e
- SHA512 ca9b25da60a0b8fe6bf6675cb414b4e1d95f5f6d76ac05a33d4e7dd86ba2b13af1ea1d5d2d37d370a7b23ee460ab7459c2ba89cd2b7b8bcbc544901b4cfcf3c1
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqN:TID41qW1PszV+tA5mkfkZc
- TLSH T17C266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 640 patcher.exe 4260 692.#.exe 3816 834.#.exe 820 433.#.exe 3540 855.#.exe 1932 865.#.exe 4104 503.#.exe 3768 867.#.exe 724 150.#.exe 3820 342.#.exe 4720 12.#.exe 2224 510.#.exe 3748 566.#.exe - Adds Run key to start application 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 855.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 865.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 867.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 12.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 510.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 566.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 692.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 834.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 433.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 503.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 150.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 342.#.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 855.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 503.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 150.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 12.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 566.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 834.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 342.#.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\ 503.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ 692.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 834.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\ 692.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\ 433.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\ 834.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ 433.#.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\ 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 834.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 834.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\ 865.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\ 834.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\ 834.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\ 834.#.exe File opened for modification C:\Program Files\dotnet\shared\ 433.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\ 150.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sl-SI\ 150.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ 865.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\ patcher.exe File opened for modification C:\Program Files\Common Files\System\uk-UA\ 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\host\ 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 834.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ 433.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Google\ 867.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 865.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\ 503.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ patcher.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ 834.#.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\ 692.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\ 433.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ 503.#.exe File opened for modification C:\Program Files\7-Zip\ 834.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\ 855.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfr\ 834.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ 865.#.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ patcher.exe File opened for modification C:\Program Files\7-Zip\Lang\ 503.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ 150.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 150.#.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ 865.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\ 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 834.#.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\ 692.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ 503.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 150.#.exe File opened for modification C:\Program Files\Crashpad\reports\ 150.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\ 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ 433.#.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 692.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 433.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 855.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 865.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 867.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 150.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 834.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 503.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 342.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 510.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 566.#.exe - NTFS ADS 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 692.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 433.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 865.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 867.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 342.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 510.#.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4808 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 640 patcher.exe 4260 692.#.exe 3816 834.#.exe 820 433.#.exe 3540 855.#.exe 1932 865.#.exe 4104 503.#.exe 3768 867.#.exe 724 150.#.exe 3820 342.#.exe 4720 12.#.exe 2224 510.#.exe 3748 566.#.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4808 wrote to memory of 4260 4808 2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 86 PID 640 wrote to memory of 3816 640 patcher.exe 87 PID 4260 wrote to memory of 820 4260 692.#.exe 88 PID 3816 wrote to memory of 3540 3816 834.#.exe 89 PID 820 wrote to memory of 1932 820 433.#.exe 91 PID 3540 wrote to memory of 4104 3540 855.#.exe 93 PID 1932 wrote to memory of 3768 1932 865.#.exe 95 PID 4104 wrote to memory of 724 4104 503.#.exe 98 PID 3768 wrote to memory of 3820 3768 867.#.exe 99 PID 724 wrote to memory of 4720 724 150.#.exe 100 PID 3820 wrote to memory of 2224 3820 342.#.exe 105 PID 4720 wrote to memory of 3748 4720 12.#.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\692.#.exeC:\Users\Admin\AppData\Local\Temp\692.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\433.#.exeC:\Users\Admin\AppData\Local\Temp\433.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\865.#.exeC:\Users\Admin\AppData\Local\Temp\865.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\867.#.exeC:\Users\Admin\AppData\Local\Temp\867.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\342.#.exeC:\Users\Admin\AppData\Local\Temp\342.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\510.#.exeC:\Users\Admin\AppData\Local\Temp\510.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\220.#.exeC:\Users\Admin\AppData\Local\Temp\220.#.exe8⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\824.#.exeC:\Users\Admin\AppData\Local\Temp\824.#.exe9⤵PID:4316
-
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\905c0769f9a06c95a24ddf945\834.#.exeC:\905c0769f9a06c95a24ddf945\834.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\905c0769f9a06c95a24ddf945\855.#.exeC:\905c0769f9a06c95a24ddf945\855.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\905c0769f9a06c95a24ddf945\503.#.exeC:\905c0769f9a06c95a24ddf945\503.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\905c0769f9a06c95a24ddf945\150.#.exeC:\905c0769f9a06c95a24ddf945\150.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:724 -
C:\905c0769f9a06c95a24ddf945\12.#.exeC:\905c0769f9a06c95a24ddf945\12.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\905c0769f9a06c95a24ddf945\566.#.exeC:\905c0769f9a06c95a24ddf945\566.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3748 -
C:\905c0769f9a06c95a24ddf945\374.#.exeC:\905c0769f9a06c95a24ddf945\374.#.exe8⤵PID:4416
-
C:\905c0769f9a06c95a24ddf945\157.#.exeC:\905c0769f9a06c95a24ddf945\157.#.exe9⤵PID:1772
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.4MB
- SHA256 171f1b7c9d62c43f7bb44086424f5305c138b3eb0b38ec4ab3e4e6abd2efdf46
- MD5 abc1ffca55190104b832bde709b8cb22
- SHA1 8818ec46d0be6d62420848b0cf2c17c9cd53737e
- SHA512 ca9b25da60a0b8fe6bf6675cb414b4e1d95f5f6d76ac05a33d4e7dd86ba2b13af1ea1d5d2d37d370a7b23ee460ab7459c2ba89cd2b7b8bcbc544901b4cfcf3c1
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqN:TID41qW1PszV+tA5mkfkZc
- TLSH T17C266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$
- Size 4.5MB
- SHA256 9f85ca90e1ed2fa5cdfd6b7f93c7cd7567a70ccf592ed9230aeba95bf5809176
- MD5 2d55c1230738defc75ef5fcd0754c202
- SHA1 10d9b5f2312e3a96ce831e8a6882b61fa2ee0ede
- SHA512 ddcb9e6ae3447529f5376f5df9a175e22c7ac4db4c4fc79787b08b9f62043c13eb13d832fb3a5326900c4d04bb8af24c63f47a568cc22f645aceab0cf7c667a7
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqT:TID41qW1PszV+tA5mkfkZct
- TLSH T120265A16F7A88262D0779175C6A796A6BE7334111B3086CF1384E73C2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$
- Size 4.4MB
- SHA256 eeb89b91123b105ecc23ea589c3fb9235b946701185827bc8b10661b77411efb
- MD5 9e56b76906b631ca79d7f7199e96c355
- SHA1 7786aa74b9eddb2891fdff4fc789e2b046b82747
- SHA512 39f027df7b1159a28adc324f742f26e45a043ab9247349d6ce9ed9188057137b057ecad4a15fdacaecf7c0f410b90e618d9253fdaa9964733f7940109bdc6200
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqz:TID41qW1PszV+tA5mkfkZch
- TLSH T11F266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe$
- Size 4.4MB
- SHA256 419eea6488ee61779ab1baca01a55bf2b2c8a190a71e67f3c9b4788bad7d8f4f
- MD5 50e3940bc998389591eb9b9843d637dc
- SHA1 827cde920312604bb2826a42e031eb6dc30520fe
- SHA512 c5397e457cdcbedfa4cf5428fbafda6033ef1cdcf1eb6c4fadec212c25eb2ddcf3bab61a4036f5f050a658ad43887bef95e60cc9560676c22e5522885fee558b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqL:TID41qW1PszV+tA5mkfkZcZ
- TLSH T1F6266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
- Size 4.4MB
- SHA256 151d6b32956ab0ef7e7e3f9371d378074692b79dec3bcca3cc1fce052a9fe4e4
- MD5 d0133ac3427e5be1ef75ca69e0e4df7c
- SHA1 d482c37cd8bfe27d276e04cd094d9f3a1037f98b
- SHA512 8d9cf0c91b253f46410882d228db985f7b842a4cf221c1c55583688b2a8a0096563d5298a2887c492ad44c98010f0acfcc230475aff2f4c742af01175f564ab4
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqu:TID41qW1PszV+tA5mkfkZcc
- TLSH T1D1266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 4.4MB
- SHA256 854776049eeb3195ce76af7ce88a9574b3af47d6ef458ea8617bc6ebd67a785c
- MD5 8904d49808aabcdb23276e2fb0f4f7e4
- SHA1 981f68fa74a4b9924d9932d4fb2d101e6a661efa
- SHA512 b6ca9880293ca9857924e6bac6b6510a8619d56c02251891112e6b5d77783f8a765e3ab66e89d9210ab1f597726432a9538aff5c14b5757fedb18a070b9f8b6b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mq3:TID41qW1PszV+tA5mkfkZcx
- TLSH T1FA266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe$
- Size 4.4MB
- SHA256 5345e946fd16db48aed5247dd1c3c57ca584acdd4e08fd9ceff0de388947580a
- MD5 403ee672db3a8bc90caa6ca07be09991
- SHA1 f4105f90a88e14eaaa136a1150bfbb3df6cd4ff5
- SHA512 805c2a9054f0419302f86ee8deab5b5888c190a5e1e3c2ed9522818468abd29caa4137aaa8a690a9f73c6f3854fdbe6af4eaafa8bea1948a9713a9d01519cf80
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mq/:TID41qW1PszV+tA5mkfkZc9/
- TLSH T1FE266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$
- Size 4.4MB
- SHA256 bf0869f2971455c1bb2a9c9358583bece99bcfdc59ecdf460a1f95a4b358d167
- MD5 d0e9a63320785f704d769d6532cade25
- SHA1 cf903c565476ae44cfeb46d0edbdf0c1ca300556
- SHA512 a45d772c9a6348e38d1570fa66cefa3d38a852e55fe24279dd4c66107066b43656ab78792f862c2b8253868dbd9121cf7876c293ce3da937dc5807aff35eb0ca
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqj:TID41qW1PszV+tA5mkfkZcN
- TLSH T1EA266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$
- Size 4.4MB
- SHA256 c0ab89fdad6e62d4a7724a11d89b98aae88884d31eb070aa433c9a0405bf71ec
- MD5 bd9cfcc6cca51b155abadb73686fcabb
- SHA1 21343f4f511f67a4601f6adedde617febb979ef8
- SHA512 e733bb8f6c7ffdb814626a8f3fa990c0e565c41a8dc17ada66fa425965e6b38267a03f7fd5486ae5760a6aa923cba92b2a7cf1aa2ba1d0bff41e5cee826fbcc8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mq:TID41qW1PszV+tA5mkfkZc
- TLSH T1E8266C16F7A88272D0739175C5A7A6A6FE7238111B3086CF1344A77C2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH