Analysis
- max time kernel
107s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 04:23
Behavioral task
behavioral1
Sample
2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260522-e1bcgshs4z
- SHA256 7ea7692ef40487d730773a748a317f19e8fd4184efe11b9f1cd793a325db1278
- MD5 8fa25a89cbebd92ca86f4ab1b221cff8
- SHA1 1914b68d6781616f7f7303f67d1d1e6901f5ceea
- SHA512 d330b21fddfdc8df62cc2ac3e077b15f417d98d3423c5252ea76e987b3fb251978ca21a8eab2dd966e12bee45dbb6634e4aeff8ca0b3bd41cd82750ce4d6c6f0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8icaDaC3mnXoZ643mnXoZ6i6cMJlancMm:A3k03kHRJARJ13k03kHRJARJg
- TLSH T1A7959D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/4308-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b487-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3500-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a3f9-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4308-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3500-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028d79-1280.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a52-1377.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b487-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a3f9-12.dat aspack_v212_v242 behavioral2/files/0x0002000000028d79-1280.dat aspack_v212_v242 behavioral2/files/0x0008000000027a52-1377.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3500 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4308 2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3500 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_8fa25a89cbebd92ca86f4ab1b221cff8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4308
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3500
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 7ea7692ef40487d730773a748a317f19e8fd4184efe11b9f1cd793a325db1278
- MD5 8fa25a89cbebd92ca86f4ab1b221cff8
- SHA1 1914b68d6781616f7f7303f67d1d1e6901f5ceea
- SHA512 d330b21fddfdc8df62cc2ac3e077b15f417d98d3423c5252ea76e987b3fb251978ca21a8eab2dd966e12bee45dbb6634e4aeff8ca0b3bd41cd82750ce4d6c6f0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8icaDaC3mnXoZ643mnXoZ6i6cMJlancMm:A3k03kHRJARJ13k03kHRJARJg
- TLSH T1A7959D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.6MB
- SHA256 1c4f5c3e1580bf8612d628c249b71a88625c5a65f5cbacb8943eff1b6accb29a
- MD5 dfbb23dda826e151bbcfef6247ef4894
- SHA1 303224a9a5eff71e29751a028805e571f1d828b7
- SHA512 3cf0739b01852b932197533f80f85cf0fb00707dca0827c9819fa00052cd87bbf016f02c84f2afe2103cf6fd02591f31a636fcdd84fde41bc3a4ae8570dc7ff5
- SSDEEP 49152:A3k03kHRJARJ13k03kHRJARJ5Vk0QGTvntQb:A3k03kHR+Rn3k03kHR+RaHaib
- TLSH T11BC58D17E6A901E8D06AC27886978A13FB717C561331A7DF1364C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 a5c62409ea5956bf5a159f42c8ff07b10005f4738b4752b4fcf89f02fa43850e
- MD5 7a0f07d02217e3a03dfed2cf50d8d95c
- SHA1 f9a950a56932a86e84a2afe66d43c7b1401df412
- SHA512 07d7808313529e18c6e1965bbbb0e2d1611fb868f049e32f951f55275cdc9c5e505176bd856c1576a286e4fa4b4c12c3d22b1a57c2ae1b38256148e3e72927cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8icaDaC3mnXoZ643mnXoZ6i6cMJlancMK:A3k03kHRJARJ13k03kHRJARJ4Pji0Aj
- TLSH T166C58D17F6A801F9D066C178CAD69A66FB717846173097CF1358C6292F63BD0AF3A360
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 1.9MB
- SHA256 ada203860a21b530a09dfe7fb81a962faba518a13af3f4c6caf6b81459a617c0
- MD5 127edbc751729310ce1925d5d97292f7
- SHA1 9358c4ff2f903790dba8cd28463730c135caa366
- SHA512 5d2cd27e6a6b4e9ffdf7e93b5f95df0315454bcd1572e3ee783cc8f1495749c8684a529e6a615fd6c4139609b6db06b201ea2e7d646fa67828b34b83ffcb8e0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8icaDaC3mnXoZ643mnXoZ6i6cMJlancMe:A3k03kHRJARJ13k03kHRJARJ4
- TLSH T14B958D03E69900E8D14AC1749A968A22FB757C56172097EF2358F7162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH