Analysis
- max time kernel
82s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/05/2026, 18:01
Behavioral task
behavioral1
Sample
2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.0MB
- Sample260522-wma81act4p
- SHA256 9f892be93407c67a78821a6f3ca4c81e31e7899bfb564ca8f22d1e47c13ee52d
- MD5 bafc19611c270c8839761dbb63d446d7
- SHA1 2889a12011eb0d9d00676f23643397b8d9980265
- SHA512 e1d5cc5c154f3b9da74d4a5ef3f6da8e91fd626c71168885e48392ba23c2222e199d130f66fd0bfadc7d5b96adce07c5f1950dd1cc8f6d53b19c9da4ddfee4ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiiZRYTqMi8CtBd2QHCHmTBW5D25jcAkSr:A3k03kHRJcqJtb2I5pYq
- TLSH T1BBA52916E6A44265D06AC079CBD29656FA333C8117B08ADB13C5F73C2F337D19A7A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/676-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024520-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/548-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/676-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/548-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024291-675.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000215db-1283.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001500000001daac-2058.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024520-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x0008000000024291-675.dat aspack_v212_v242 behavioral1/files/0x00030000000215db-1283.dat aspack_v212_v242 behavioral1/files/0x001500000001daac-2058.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 548 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File created C:\Program Files\7-Zip\7zG.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 676 2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 548 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_bafc19611c270c8839761dbb63d446d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:676
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 9f892be93407c67a78821a6f3ca4c81e31e7899bfb564ca8f22d1e47c13ee52d
- MD5 bafc19611c270c8839761dbb63d446d7
- SHA1 2889a12011eb0d9d00676f23643397b8d9980265
- SHA512 e1d5cc5c154f3b9da74d4a5ef3f6da8e91fd626c71168885e48392ba23c2222e199d130f66fd0bfadc7d5b96adce07c5f1950dd1cc8f6d53b19c9da4ddfee4ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiiZRYTqMi8CtBd2QHCHmTBW5D25jcAkSr:A3k03kHRJcqJtb2I5pYq
- TLSH T1BBA52916E6A44265D06AC079CBD29656FA333C8117B08ADB13C5F73C2F337D19A7A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 44a156ef6f9c9797677d26c88027f25095c9c1578bb2abeb6302fa3f06013f83
- MD5 787051da7900c02c1856e3e88a43f06d
- SHA1 55a3c34cb98ab0af94ed58af03f124147c6853b2
- SHA512 8e2a80f45e36ff57babf39a53f6dc9c2cde62ffcb12c405043dee7ab1f9dcaf8c42d9e61fe0d5eaf6dec9bd4de435e3df232e1064841d7485efdfc96c61a0c33
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiiZRYTqMi8CtBd2QHCHmTBW5D25jcAkS7:A3k03kHRJcqJtb2I5pYqjPji0Aj
- TLSH T131C52916F6A44261D07BC079CAD2965AFA33388117708ACB13C5E73C2F377D59A7A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe$
- Size 2.0MB
- SHA256 c17a095da0f30bc872e07ce77ff5ba2b965c8a7244306a1e393268677dc477b1
- MD5 89d32ae69e75b93c47b8515cd43f8a07
- SHA1 a167183d88323be823012af525e1330cf9fd6790
- SHA512 8718fc49589978eb4ee249efccb3d32508c8deb39c80be7238a67806d1c0dbacf47bbc4a2ec6c08ebb63e25566008ef621af0b2555a621b7c755119a14f894d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiiZRYTqMi8CtBd2QHCHmTBW5D25jcAkSV:A3k03kHRJcqJtb2I5pYqp
- TLSH T15EA52916E6A44265D06AC075CBD29656FA333C8117B086DB13C5F73C2F337D19ABA722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.1MB
- SHA256 8b76236b6119efb6c26bee67d0eff683c4a3cf5143fbb9c8dd4e840d7270e53b
- MD5 e472c598e9ff64834eff98aeb9fd7973
- SHA1 628533fd4f8276f748e59771c5199fc7af5b0a9f
- SHA512 b679c7eaaad53ed43f363c6d99f0c38cd8404a5b26337a323da25a253fe596a796349a11c04a872ccdb231e206f6abcee6edb9e982991d4684893848690aca5b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiiZRYTqMi8CtBd2QHCHmTBW5D25jcAkSR:A3k03kHRJcqJtb2I5pYqt
- TLSH T134A52916E6A44265D06AC075CBD29656FA333C810BB08ADB13C5F73C2F337D59A7A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.3MB
- SHA256 79469183cdf3d703ce5cf69f987fad1045edfcd317f43a025fb46c5125f37cd9
- MD5 99e31075cdbb75928b804a8d9705161a
- SHA1 50f0af18edfd8ce8d4c7b7ba0140b64208faba6b
- SHA512 d7c048675bb27c8b8ff1dbbfb8fead0e5e216790fe93f1f27d5a975af44ab7d012ecbd05fdc1294158d720829ee48cdbe97791e2e652efac88da84b837fd8796
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiiZRYTqMi8CtBd2QHCHmTBW5D25jcAkSc:A3k03kHRJcqJtb2I5pYq/i2WH3
- TLSH T130B52922E6A44265D06BC075CBD6965AFA333C420BB086CB13C5F73D2F376D1997A722
- MD5 SHA1 SHA512 SSDEEP TLSH