Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 16:29
Behavioral task
behavioral1
Sample
2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.9MB
- Sample260529-tzlt6ahs71
- SHA256 895a1042759b2d856a2584d426df2b22a686bd9e6c9b55cfd47d586960da0032
- MD5 920ca0dc042b1cdf04af3633e730b4d4
- SHA1 764649e507189fdfbcd01a5df7a83b5f43edac4d
- SHA512 54b3b14591ebc66ac1d1f3f762a6fdbd489ff04e522117bbdd6756eadadd73e85433043063ffbe3b00e21ec80076aa153435514d9ac8de0f44ac9dcad575266a
- SSDEEP 49152:A3k03kHRJ+qJtb2Ij56rbeW4SkZP4sz9Mb1Pji0Aj:A3k03kHR8Jr7fkZcljo
- TLSH T125160512E5684722DC6ECC74C592A679F9323C4F7F2CB6CB0E45B6282E376D19536322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/6056-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b566-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4776-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a322-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6056-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4776-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000028efa-1259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002100000000f65f-1573.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8dc-1622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001100000001041c-1877.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b566-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a322-12.dat aspack_v212_v242 behavioral2/files/0x0009000000028efa-1259.dat aspack_v212_v242 behavioral2/files/0x002100000000f65f-1573.dat aspack_v212_v242 behavioral2/files/0x000200000002a8dc-1622.dat aspack_v212_v242 behavioral2/files/0x001100000001041c-1877.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4776 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 37 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zG.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6056 2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4776 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_920ca0dc042b1cdf04af3633e730b4d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6056
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.9MB
- SHA256 895a1042759b2d856a2584d426df2b22a686bd9e6c9b55cfd47d586960da0032
- MD5 920ca0dc042b1cdf04af3633e730b4d4
- SHA1 764649e507189fdfbcd01a5df7a83b5f43edac4d
- SHA512 54b3b14591ebc66ac1d1f3f762a6fdbd489ff04e522117bbdd6756eadadd73e85433043063ffbe3b00e21ec80076aa153435514d9ac8de0f44ac9dcad575266a
- SSDEEP 49152:A3k03kHRJ+qJtb2Ij56rbeW4SkZP4sz9Mb1Pji0Aj:A3k03kHR8Jr7fkZcljo
- TLSH T125160512E5684722DC6ECC74C592A679F9323C4F7F2CB6CB0E45B6282E376D19536322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DEDD914E-84D0-49B4-9D48-44B1238479F9}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 2.7MB
- SHA256 027baa18ec8d4d4a54644398396d5204e556719afd57606a996a3955b4629e17
- MD5 f1cd1c1a1c888c43ef369da3a6af5468
- SHA1 369941ee578f9a29a9b6d14d221d442206c2a3b5
- SHA512 2ff44e44af70bcb3be9e60e96da45d666c4515b3a7dea55553f8ed161dfbe22c31be23839f8306830d3f3a70b9a1401deb0d11ca6600c89823779926c0bc6904
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcqpHfwcYTqMi8CtBd2QHCHmTBW5l:A3k03kHRJ+qJtb2Ij56rbeA
- TLSH T14AD52812E5584660DC2F8D74C5819676F9323C8F7F2CB6CB1E44BA292E736D0A939363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
- Size 3.1MB
- SHA256 54e37f6b29f741195320eb49fd78746ee1f88d5d1df4f4be64db13d6f3d66385
- MD5 7bb3d32e1cbdd8e4169b25611ef339a9
- SHA1 043ad7b9e6561dd583cb5d30f5fbd371a9950ab2
- SHA512 3d349a09b5ff1c07f73e700bc863b85a7a957b35865be58cd7b18a6ece05ca9b0b71aef0564f03e130fe21517c3e2c2b34240a55397e309e26f358fdee6034dd
- SSDEEP 49152:A3k03kHRJ+qJtb2Ij56rbeW4SkZP4sz9MS:A3k03kHR8Jr7fkZV
- TLSH T127E51816A5684621DC2FCC74C582A676FA323C4F7F3CB6CB1E45B6282E376D19935322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$
- Size 3.0MB
- SHA256 0b3b11b4ffa2ec848df615827a53450a2de4e28a02982d39de42ca4db3697011
- MD5 76b2442852b625d25e0a9c7390cafba7
- SHA1 5b239ef2c331db186f124b02fecfae6535fe6013
- SHA512 114aeeebfe83531a9b70500006ea6a42dcad378b41e973b6b5070747293adb0ae49092e4774685488c8897fe40f19d24adc81b24e81f82636742184dd01a71bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcqpHfwcYTqMi8CtBd2QHCHmTBW5z:A3k03kHRJ+qJtb2Ij56rbeW4SkZP4szc
- TLSH T157E51816E5680261DC6ECD74C582A636F9323C4F7F3CB6CB1E41BA292E376D19539322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.4MB
- SHA256 0a03aad95b959d64bbc59b23229b63895c09071e7595e4c8046153b744303b39
- MD5 88c23b42dab77a1b05f5d8b376b77f5c
- SHA1 2aa2c253a399bf8352c7b9729b88ebfff18fc843
- SHA512 6de758fc89f1ef39f9ed55916f1a3fc01c3c238784f3e6f3d5ddab6c010666e029ef97b8a8e2e9203bed74853e5e9471501d895b7e3d515bf07447d992414274
- SSDEEP 49152:A3k03kHRJ+qJtb2Ij56rbeW4SkZP4sz9Mb1Pji0AjKPji0Aj:A3k03kHR8Jr7fkZcljo0jo
- TLSH T14726F515E5684722DC6ECC75C492A67AF9323C4F7F2CB6CB0E45B6282E376D18536322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 4.0MB
- SHA256 8aa224d5a0f38e8fe3062aa0679385d08fb20c89365498bfa147e120301cc623
- MD5 ecf7d2c08a826e66610f2b5f9e7b6b01
- SHA1 fd2b3aceee0b507e1a05be705b2ac9c16a04d50c
- SHA512 c19c8bc4aec9ec96420457981c741128f799b294f4fe0ed07d803cbbf087445b976e13f139702f3cb1832f78b59271482a1d65d89fcf3c7038d858e7c86ae738
- SSDEEP 49152:A3k03kHRJ+qJtb2Ij56rbeW4SkZP4sz9Mb1Pji0Ajq:A3k03kHR8Jr7fkZcljo2
- TLSH T151160512E5684722DC6E8C74C592A675F9323C8F7F2CB6CB0E45B7282E376D19536322
- MD5 SHA1 SHA512 SSDEEP TLSH