Analysis
- max time kernel
60s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 12:11
Behavioral task
behavioral1
Sample
2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 969KB
- Sample260525-pcyszsaw21
- SHA256 383b5cc35eb5a80b570168236e7bb2259378d7772d99180c1407e6562d8f4d25
- MD5 0f8902a231789b52aeacdeba35d2d9be
- SHA1 6f48007a6c3117188316f7c0ed717b23deb238e2
- SHA512 55cdceb0275444d349f838d544f56fe09ea07cecbd8efb1318dae61b446f8f07b85d4a2ded5fa8a6e62480712654dbbfdf79d325491f620b5cbbe8947fa3523c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERayb:A3k03kHRJ1b
- TLSH T1BA25AE03E79400E5E14AC174AAE58A23EB75BC521760D7DF2358D6152F72BC0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/5048-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b635-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6096-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a322-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5048-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6096-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00ab0000000272d8-1258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00b20000000272d8-1345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000900000000f65f-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001500000002b642-1601.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b635-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a322-12.dat aspack_v212_v242 behavioral2/files/0x00ab0000000272d8-1258.dat aspack_v212_v242 behavioral2/files/0x00b20000000272d8-1345.dat aspack_v212_v242 behavioral2/files/0x000900000000f65f-1387.dat aspack_v212_v242 behavioral2/files/0x001500000002b642-1601.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6096 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5048 2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 6096 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_0f8902a231789b52aeacdeba35d2d9be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5048
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 969KB
- SHA256 383b5cc35eb5a80b570168236e7bb2259378d7772d99180c1407e6562d8f4d25
- MD5 0f8902a231789b52aeacdeba35d2d9be
- SHA1 6f48007a6c3117188316f7c0ed717b23deb238e2
- SHA512 55cdceb0275444d349f838d544f56fe09ea07cecbd8efb1318dae61b446f8f07b85d4a2ded5fa8a6e62480712654dbbfdf79d325491f620b5cbbe8947fa3523c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERayb:A3k03kHRJ1b
- TLSH T1BA25AE03E79400E5E14AC174AAE58A23EB75BC521760D7DF2358D6152F72BC0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$
- Size 981KB
- SHA256 b7f80954aaeb5b68077809a3f500fcd32ab11b01f687b526d90bc3fcc9f86e6b
- MD5 08f9329564ca13732368e314a3b75125
- SHA1 54e953571592db224ff08eb3c701e30c2759cec9
- SHA512 4d742c6714716378538c5bc0d537742c82e1720ae86f7213b241f98d68ad47aae382856c9dae42595e73324bd62e1b66cca9dc3e53730865b45c87102814cd51
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERay:A3k03kHRJ1
- TLSH T12B25AE03E79400E5E14AC174AAE58623EB75BC521760D7DF2358E6152F72BC0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
- Size 1.1MB
- SHA256 60d44139f12afdddbafb3e394fc859b9fc53d1f2e3528fa676a61562d534b262
- MD5 8da9f50b8d41693dd8d081653a30d1fe
- SHA1 d7fb91e5ad57dc67d91e8c73ac4dfa142fdff107
- SHA512 6723b20c4c8c06db31f07e9928f96f0dbb704ec83f546e94323c66d13f47ada4f614b139f9b1d0b77959c6ccfdeb0c2fc6b8ee13dcc08a5ced29f2895aaeeeaf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERayZTjE:A3k03kHRJ1pw
- TLSH T19F35AE03E79400E9E15AC2349AE58A23EB75BC521760D7DF1368D2152F72BC0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 1dacc5c86fecd2a6ee34ead9d7e61ab8a164dc15f5f0e498175fff1ed62b7314
- MD5 576eb3f721d2a172047b3f077575fa5e
- SHA1 4eb9152b127954ea003bc3c061a2019571b3e7af
- SHA512 d2b1e37916cbd652a4e5ebb0580aa814a05d13cf0a75cca0626bd07d8e4cb27b54be4c6a686ad9b57e701d2b95ea66c8a2fba745b49c25c8148f0c98f2859327
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERayH0Le5ji0hmxNrM:A3k03kHRJ1HPji0Aj
- TLSH T19C758C17F6A402B5D067C178C9E6965AEA7138821B30CACF1358D7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.0MB
- SHA256 d87855ec9b4538904e830d5cbf93924993aefdf9af0c0d056fe06c948c27cd43
- MD5 1a8e59668490e14b3d89dea2bd736e78
- SHA1 15a3758794e08719d6a198b51acce0618fe890a2
- SHA512 4e1dedcd053e0599788f95b5be8d624f5f491779e99c6fc074868caf3bde27f87d325ef7f2f3236183c3fe7a866b55750b9cba77d4b0f3235195b364f2b0b0c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERayTF:A3k03kHRJ1Z
- TLSH T111359F03E7D500E5D64A8130DE9A8A22FA75BD921B2097EF1368F7152F727C0BB3A754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\updater.exe$
- Size 1.4MB
- SHA256 3f3bf09679c9bb393895c2a110e6df1e23e9c780fabb3e4e828474e2d1d1085b
- MD5 bd71bfee659f3303083fa383b7657380
- SHA1 a7938d16745fc2967be7b29da22932ab44527bb4
- SHA512 6ceacda2e1c719f0af93b6329c4107f0a39b4cdc67a8d5647f1f2e6d71a5051ab1733a539ac28da6ac6b65624da3abd445105b68aa5bce1b51f5ed2fe59e2133
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERayaecLWREJYQBGJ+Rf:A3k03kHRJ1kW+3f
- TLSH T1EB65BE17E79404F8E41AC2349AE68622EB72BC56076097DF2368D6152F337C0AF3E795
- MD5 SHA1 SHA512 SSDEEP TLSH