Overview

overview

7

Static

static

3

2026-05-05...ry.exe

windows10-2004-x64

7

2026-05-05...ry.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/05/2026, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-05_fb4baf9465be3042665f974515dfb188_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
  • Size 778KB
  • Sample260505-e52p8scv4m
  • SHA256 57e64b8b04771512e4b89bcc511168a0e6bbf485bb38b6744303375668278ed7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_fb4baf9465be3042665f974515dfb188_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-05_fb4baf9465be3042665f974515dfb188_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:872
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2976
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4132
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4184

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.3MB
        • SHA256 a9355a2f9d9fa7df00f5ae4682bf798fee7373b1d540ff3a5065e59a9a77a819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.7MB
        • SHA256 65c398ab3430ad25b141ff5a1cbcdfee4f00f27c7ffe71963edf5209bd43f354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.4MB
        • SHA256 3dcfe75211e94c38cfa62672edd7e90027fa5364dd9a195f7f0275f512bce3b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 793KB
        • SHA256 80a9ff469e6c8fc8b2acac01065a1876686b1e655ef9b5a2a3ce506b44e1b389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 6.8MB
        • SHA256 284dd2355c837897c5e0a885e1b016c3109ce1f461bcc7217bf2cd552b50261f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.5MB
        • SHA256 31489651fcccb1aab4fc141789d2e6ed054cc5d1e48c5bb2158ed7210a453d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.2MB
        • SHA256 d74b2e4b95c246e88015392abfa4a7c5756f7384eb42ced4c3c8e3bde369c689
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 452b6f9171c6f3d28f1dbe273f5560e92d5a8964731267aae12c21f7e81df67a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.4MB
        • SHA256 85431067acb74a96fa8864a7769bf3e23725ad1192729ee56a7b10eadd0f4834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.6MB
        • SHA256 83ba3b0af7d7042e34c4c1dda15a788f45911601e64364c9f44ba03689300a54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 3.8MB
        • SHA256 4800fb9a2c8d6589a0a1dccc6ef600e16a4089319ff1ccd5a1da143c605e722b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.2MB
        • SHA256 fe5e6ac8923cdf5b94c4844b696c60989196c09c84f849f90c6f9cdc22f6f7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 802KB
        • SHA256 8a8561c69d9680094a440503c367097c4a938f1793355399e1a83c9c26894b2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 802KB
        • SHA256 7da762b9901f317c65600cd75a50089928ba5fce55d3c8a351d6de6a81ac99fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 802KB
        • SHA256 9bdcfe829f6a2e6622e751e1398dc38c4860cdfa8beb3fd8c8cdb1f28f3c2698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 822KB
        • SHA256 358e2422fae32cf71a1bc69a8f7b4ddcfbc3370af00bacd3f7c04d9bd1f3a881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 802KB
        • SHA256 59e4113005dd6fb5585c871e67c44f4b2f6e94d778ce59a7ca21dbb47084b639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 802KB
        • SHA256 45ca8852c804d9785b9f0ff28322ee91ea8c583d1ece9444a23b47cd033bdc68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 922KB
        • SHA256 fcdae2207f44349f4176f53468d8cc61a20453f25346ff0e387bc085012b8e50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 834KB
        • SHA256 a109f237567ad3ef92105f83da76aa684060e485ceb83746ea46b46499dbe4e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 842KB
        • SHA256 48972f1f4eef5c3bebc6859d968dec333b6309923c754aba52057b1717d3d966
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 838KB
        • SHA256 2aaceaafb509929e2a18b0921a167390e0e758e8ff690ebb808f63e176f9622d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 778KB
        • SHA256 57e64b8b04771512e4b89bcc511168a0e6bbf485bb38b6744303375668278ed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 778KB
        • SHA256 20e74dc30e42fe4276a458299a0f5bde63aae85b8048f81ca033fe92dce39797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 778KB
        • SHA256 d0f12e7e1c77dd2e415e0b1c091bb639a5ad65d5a451f454704edf9792ed6e28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 778KB
        • SHA256 c6eb70549f02c4f9935beb023cc5f7c8cb2820c004b93886693a4fdc8afb02e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 778KB
        • SHA256 e81f3af96a5580c58e5ad45193b6862b26c78ebaa92d87d9f0450cecb69309f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 778KB
        • SHA256 06527387eab67565912206549e018416c912608eb4dcc2ddb306c890b3dda06e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 778KB
        • SHA256 bee3d37894c901f689b115fb638b4c5e92f85c506f3c5656e770f03d5a6c51ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 778KB
        • SHA256 1ee7b00a336c080cf0b22a6e8ea68649bdb95abe0953b3d84d37188a76ca5156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download