Analysis
- max time kernel
111s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/05/2026, 15:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe
- Size 3.4MB
- Sample260527-tc7hcacz9v
- SHA256 38563e82a4dda2bbba99565f5b0c1cf5eb5d761b9fbc81ecaff87ff38b592a44
- MD5 1f44ee7966c5698bd5af4cbb26c6be04
- SHA1 aefe4f6298eb1dffd3fac2c15dfb973ff9ce4297
- SHA512 e73232bf0fcdebac0312e353e4dd199f6235d5465b0b916e49d5aacb81955ad70eb31f8cebc68565a2ece2eec20728f70efa12f15e589f6a8407cf0f8b940071
- SSDEEP 49152:Sc8MNFI7c8MNFdv9MN/IabjKoh9WsQeW4SkZP4sz9Mb41lkWu0yPqJtb2IdqJtbH:ScGcX90IabjKoh9Ws8fkZc41lkNPc
- TLSH T123F50911B7B88722E0B3C1BAD5E2A75AED723C411B3186CB5245B76C1E33AD1D636732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4968-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b551-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4684-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a408-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4968-1024-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4684-1067-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029d2d-1236.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a7e2-1858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002625c-2052.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4684 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4968 2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe 4684 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4968
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.4MB
- SHA256 38563e82a4dda2bbba99565f5b0c1cf5eb5d761b9fbc81ecaff87ff38b592a44
- MD5 1f44ee7966c5698bd5af4cbb26c6be04
- SHA1 aefe4f6298eb1dffd3fac2c15dfb973ff9ce4297
- SHA512 e73232bf0fcdebac0312e353e4dd199f6235d5465b0b916e49d5aacb81955ad70eb31f8cebc68565a2ece2eec20728f70efa12f15e589f6a8407cf0f8b940071
- SSDEEP 49152:Sc8MNFI7c8MNFdv9MN/IabjKoh9WsQeW4SkZP4sz9Mb41lkWu0yPqJtb2IdqJtbH:ScGcX90IabjKoh9Ws8fkZc41lkNPc
- TLSH T123F50911B7B88722E0B3C1BAD5E2A75AED723C411B3186CB5245B76C1E33AD1D636732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{98BD060E-1D1C-40BF-8DA9-CB787874DFC8}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 3.5MB
- SHA256 5b0a7198bd26eaf949df9cbd104f20d68f04edd11bbdde4752e09b7c152dd3ea
- MD5 af842a62d96f4dd6fa9df15409cf4183
- SHA1 969da3b01f4951536f3de82490ec254ff46be67e
- SHA512 975ac4623a9cc1b2bc126b5af6acd539b0ae2e1cfda52d3abb968ad53afd6cc86df8baa5b78ca7e312ab8be617b888a729a2a8fe773443acef9da9eeabeb3e30
- SSDEEP 98304:ScGcX90IabjKoh9Ws8fkZc41lkNPc7BPVl:S5aLP+lSc7Bdl
- TLSH T1F9060911B7B88722E0B3C1BAD5E2A75AED723C411B3186CB5245B76C1E33AD1D636732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.9MB
- SHA256 0b826de56b6060ac7fc8a1de1a40b709f8c089e239223fcc5c89cff8ea62fc0c
- MD5 a1f60eb35158fa0ce4fbc1d16f23e539
- SHA1 88d7dc695572070b3d1f0215e5781b5a9b20fb87
- SHA512 65551aa0ef433c66c8def9da37af429125dac869c8a51dfbd3751fa52db8b2595b14acaf62024842f1f4c87017fb6188fb90c69eb9cf678acfd4c4c2183fc84d
- SSDEEP 98304:ScGcX90IabjKoh9Ws8fkZc41lkNPcZjo:S5aLP+lScNo
- TLSH T11D160915F6B88722E0B3C1BAC5E2A75AED723C415B3186CB5245B76C1E33AD1C636732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$
- Size 3.5MB
- SHA256 f1a0ce0b9522b5fb6252f5d2cf3f2968bd5359a165065da59c9c147697a089b8
- MD5 95f0d709714e81a644646b8c7d310989
- SHA1 e3e3234e53c7382087f49cabffc7034aa33e3978
- SHA512 d98d3ed7ba217d13eb3393f1e511635a4fd00c85f50ac5692668c36dc12c15872503c84686654ed5c783a9d6a5eb9c1537832d635d7d2f16a113286536c85805
- SSDEEP 49152:Sc8MNFI7c8MNFdv9MN/IabjKoh9WsQeW4SkZP4sz9Mb41lkWu0yPqJtb2IdqJtbA:ScGcX90IabjKoh9Ws8fkZc41lkNPcr
- TLSH T18DF50911F7B88722E0B3C1B5D8E2A75AED723C811B3186CB5245B76C5E33AD19636732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe
- Size 3.6MB
- SHA256 8d3660b2564cefbd53f4ebecbf6fad9760752a484264ac65dde1c5020e06071c
- MD5 3623331e0a26219eef3800ffcfdad131
- SHA1 b88e09fb1e60daef4b4981b634703302ed3a1804
- SHA512 9c298295418fd9b0cf8d97d7363a4fbe4e2475352ce01bd0a37fef59ef3d8899b4dbf585d2fa5621d3cfd5c9a0e3b124fab811e9965b2f638be7cfae190558f0
- SSDEEP 49152:Sc8MNFI7c8MNFdv9MN/IabjKoh9WsQeW4SkZP4sz9Mb41lkWu0yPqJtb2IdqJtbV:ScGcX90IabjKoh9Ws8fkZc41lkNPcJuX
- TLSH T150061A11B7B88722E0B3C1B6D9E2A75AED713C415B3186CB5245B76C1E33BD18A36732
- MD5 SHA1 SHA512 SSDEEP TLSH