Analysis
- max time kernel
92s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 12:45
Behavioral task
behavioral1
Sample
2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260528-py547af15m
- SHA256 241700aa255ca9f085297971e949668156adea3c5a68a1c7915d2e8477f86b07
- MD5 6fed9280c2f3298a0482c363e54c8d06
- SHA1 78399e452f7e6f5a9df6bd55d8b1324b5e057936
- SHA512 0f3ee302247a767facc368221dc6435bd7d4c2d914e377277aae4ea1155f1cd2eea66175a9e626d9e73d7f47a5292fef8c1905d68c25c5ca6043f4edd8faf3c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPbl33Ze0p4Ek4niOkl/A04szE872:A3k03kHRJzeW4SkZP4sz9MbBPji0Aj
- TLSH T1E3B54A16F6784372D073C0B9C5D6AA9AFA3234465B308ACB0349C72C2F277D59A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/3848-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002432c-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4996-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000228e0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3848-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4996-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021635-1281.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002331a-1533.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000231c1-1662.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000230ca-1671.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002432c-6.dat aspack_v212_v242 behavioral1/files/0x00080000000228e0-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021635-1281.dat aspack_v212_v242 behavioral1/files/0x000200000002331a-1533.dat aspack_v212_v242 behavioral1/files/0x00070000000231c1-1662.dat aspack_v212_v242 behavioral1/files/0x00020000000230ca-1671.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4996 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3848 2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4996 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_6fed9280c2f3298a0482c363e54c8d06_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3848
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4996
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 241700aa255ca9f085297971e949668156adea3c5a68a1c7915d2e8477f86b07
- MD5 6fed9280c2f3298a0482c363e54c8d06
- SHA1 78399e452f7e6f5a9df6bd55d8b1324b5e057936
- SHA512 0f3ee302247a767facc368221dc6435bd7d4c2d914e377277aae4ea1155f1cd2eea66175a9e626d9e73d7f47a5292fef8c1905d68c25c5ca6043f4edd8faf3c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPbl33Ze0p4Ek4niOkl/A04szE872:A3k03kHRJzeW4SkZP4sz9MbBPji0Aj
- TLSH T1E3B54A16F6784372D073C0B9C5D6AA9AFA3234465B308ACB0349C72C2F277D59A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 2.8MB
- SHA256 9ac27aeff309760a335334c713ed1e68c7753d4fef0747df1e129d4c411b7303
- MD5 4d12a04282117ffa3ae92ca51b0a038b
- SHA1 56e451040136ae40695e951dfe73b1056c1f79b1
- SHA512 4bbdbd280bd968916230557dab9bd69676bf2c278df7b2c13453679b3b06335abccf51f737c9dbeec9576159e53c7aba258583d3a5f67d4796a95fd26c197437
- SSDEEP 49152:A3k03kHRJzeW4SkZP4sz9MbBPji0AjoTd9CHKyao:A3k03kHRpfkZcRjoKCqo
- TLSH T101D54B16F6B84376E073C079C5D6AA5AFA7234461B308ACB0349D72C2F277D19A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$
- Size 2.4MB
- SHA256 6ac28d347b85781e63e05e72c5a9a17aa479329726c7b8335d91aeb9b86ec093
- MD5 729cb19ef54bade5cf62a32e38cd5d89
- SHA1 1d4d76d5f0a2f837d7df4a32281ac21415df19e6
- SHA512 c3ca13f1e0dac39041fec729899e62cd287905ae050ca964bfd5e5ada24b8220a72c9e2c9883d4eeaa38cd9e5c394cdd13fd06461ba16473b12c0ef6bc9dde0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPbl33Ze0p4Ek4niOkl/A04szE87r:A3k03kHRJzeW4SkZP4sz9MbBPji0AjMI
- TLSH T123C54B16F6B84372D073C0B9C5D6AA9AFA32344657308ACB0349C72C2F277D59A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
- Size 2.8MB
- SHA256 4a46c77ebd679f0c875a40233cfb5f9de1aefdea6234d7c9572fbc324e910e45
- MD5 711805201d74e62ac6044c7304f53052
- SHA1 9ddc63fc1bf4496b33d4bbe6ffcf6cfba1707e6f
- SHA512 c3dd29ad0873ba6aa958824379db6629049203ec86279a8b27903d0d498b1f86bef4ee85b2a2a584e16658f9720d88e2c501ff10f75aecdb0d6c3b68ab06c8aa
- SSDEEP 49152:A3k03kHRJzeW4SkZP4sz9MbBPji0Aj1T9t2:A3k03kHRpfkZcRjoJ2
- TLSH T131D55B16F6B84376D073C0B9C5D6AA5AFA7234461B308ACB0345D32C2F27BD59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 522683c90b8155e98f0a4d7857de3226da8ccece10e2cc79695e48ea5a147618
- MD5 993d1b1a32e2bbc989fe88a3bd594e27
- SHA1 087d16b715e01ea4838e0fa2bc992e317b6ce432
- SHA512 b05575603b8afc3ffdb568e2125defb83df9978ecf0c1639f07c1e7636cf803bc79e7040a4ebf8262dde14b2e37947f059f1629ea387380910c13cec867117d5
- SSDEEP 49152:A3k03kHRJzeW4SkZP4sz9MbBPji0AjKPji0Aj:A3k03kHRpfkZcRjo0jo
- TLSH T197D53A16F6788372D073C0B9C5D6AA9AFA72344657308ACB0349C72C2F277D6963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 2.4MB
- SHA256 cc3e7c6eef65d9d0a459ea686166030409482fe9e39dcd94a1086bbebe957b7d
- MD5 7cdb23b556f98f06ef06eee7e5b9e263
- SHA1 aa5de47c0f59cc0ce7e63979460ed212f51066b1
- SHA512 9ea9baa6009d032500e3a901aea2dd2ab9c2ebf79f19630b344c0fda035eae488b30f536d92fb0cdd4185626d3e62188aff018a2d97acce7b9c695aab2ddd9ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPbl33Ze0p4Ek4niOkl/A04szE87Y:A3k03kHRJzeW4SkZP4sz9MbBPji0Ajq
- TLSH T1C6C53B16F6B84362D073C0B9C9D6AA5AFA313C4617308ACB1349E7282F377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH