Analysis
- max time kernel
95s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/05/2026, 17:06
Behavioral task
behavioral1
Sample
2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 2.1MB
- Sample260522-vmrejsbs5n
- SHA256 2d78129cde4edcd3f77ace51580edaa3b6af0cb6ae59f16123aa83f60d20d3de
- MD5 7cbe45ec51668e0a48ab48d3e7367ae5
- SHA1 41ce2e60a7d2dac38cf9f72bff6927972d549487
- SHA512 af8a00a8583afbaedffc35477888e0f0f687ab82816fcaba8609b285e86d25bd60c85cc4a9713a5dbffd1083447f3f4d25eb3871746c2a50f12a910d493dbe82
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaDapcREEESwgUOlZ7q/cl0Le5ji0v:A3k03kHRJP56rRUOlk0lPji0Aj
- TLSH T1C9A55B16FA684BA5D06BC178C6D29656EA733C410F3097CB5354DA293F337D09E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244a6-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3528-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2328-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3528-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00120000000216e4-1058.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000021651-1271.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244a6-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-12.dat aspack_v212_v242 behavioral1/files/0x00120000000216e4-1058.dat aspack_v212_v242 behavioral1/files/0x0005000000021651-1271.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3528 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2328 2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 3528 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_7cbe45ec51668e0a48ab48d3e7367ae5_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2328
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3528
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 2d78129cde4edcd3f77ace51580edaa3b6af0cb6ae59f16123aa83f60d20d3de
- MD5 7cbe45ec51668e0a48ab48d3e7367ae5
- SHA1 41ce2e60a7d2dac38cf9f72bff6927972d549487
- SHA512 af8a00a8583afbaedffc35477888e0f0f687ab82816fcaba8609b285e86d25bd60c85cc4a9713a5dbffd1083447f3f4d25eb3871746c2a50f12a910d493dbe82
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaDapcREEESwgUOlZ7q/cl0Le5ji0v:A3k03kHRJP56rRUOlk0lPji0Aj
- TLSH T1C9A55B16FA684BA5D06BC178C6D29656EA733C410F3097CB5354DA293F337D09E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 5c1782cafb00ef67f64530946c1f3f110b6de3663d0bf4c30b815a244c8a3247
- MD5 705d7e48d5d2772f132a0edef0a605e4
- SHA1 49cefa69f6da0df4518f09a47a2e063f4c327424
- SHA512 81e99250c2dcf324c7169b3bd4c2ec054104d539e963bf27397bc06a137993a4847b2a1ffa315afba83d36eaf7c9375ce4fb9c93c68e4a1745e5dd549ab8af75
- SSDEEP 49152:A3k03kHRJP56rRUOlk0lPji0AjKPji0Aj:A3k03kHRirj1jo0jo
- TLSH T15AC55B16F6684BA1D07BC078C5D2965AEA723C420F308BCB5355DB293F277D19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$
- Size 2.1MB
- SHA256 5b4d0f9e93f11fe4055c743ec75d4ff51406baba36f47e9d3320e081df58472e
- MD5 0e02c6d6a62fa8219d8aafb4bfcf7e53
- SHA1 2374936777d5ba7c63b1b7277dc3c977fd13c2e2
- SHA512 325edb1e4e6be832fe476a7e0f478ac222b5299ec230b73d6332afff2cce9c72b08ad8ba206a5b2ab85fab1aec2a9c8f8e61f7f164f71793614059e23e7ce541
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaDapcREEESwgUOlZ7q/cl0Le5ji0t:A3k03kHRJP56rRUOlk0lPji0AjC
- TLSH T143A55B16FA684BA5D06BC178C6D29656EA733C410F3097CB5354DA293F337D09E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe
- Size 2.1MB
- SHA256 a86f0846000b03c034b059151865e0b7465a673c74356d869261c5d690b1939c
- MD5 535b714fe7ae6dcb04e9169ab78fb634
- SHA1 05e19bac61f1a223b5527c42915c98751f494265
- SHA512 3ddfbb51884a334e27221ec347be0c29248dd2e0dd63ce309363eec04544dd51522689e972a12ae4c2e4b4eca4ce792e3e3d38a03ae42761aad05dfe5bfbbc6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaDapcREEESwgUOlZ7q/cl0Le5ji01:A3k03kHRJP56rRUOlk0lPji0Ajq
- TLSH T10FA55C16F6A44BA5D16BC174C9928656EA723C410F309BCB5354FB293F337D09E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH