Analysis
- max time kernel
108s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/05/2026, 05:47
Behavioral task
behavioral1
Sample
2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.0MB
- Sample260530-ghctpsex9t
- SHA256 f9ba452fb6aff9c66a0d48e84fccc28a80529a684cf06943d7dc4eea62551e99
- MD5 ccc5726047c6a2726b77865a4d68403a
- SHA1 4fa83491b563516780cdc9f337cde35e7b18826e
- SHA512 6c17001db8fb52fcc1366ef0db18bf85598ef7b282e400158c965d854ee416f93b417ff6a147de8e58b4b2031d390f874eb205863df66c7128482ec5a2deb2d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFplYaERa8D5jcAkSYqyEoD5Tvinrmh5jB:A3k03kHRJARJMpYq+56rapYq
- TLSH T1DCA54A16F6644BB5D07BC179C5D29A56EA333C450F308BCB1385DA283F277E19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/4968-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b551-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4684-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a408-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4968-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4684-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b557-1575.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b56b-1693.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000675-1973.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a07c-2091.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b551-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a408-12.dat aspack_v212_v242 behavioral2/files/0x001900000002b557-1575.dat aspack_v212_v242 behavioral2/files/0x001900000002b56b-1693.dat aspack_v212_v242 behavioral2/files/0x0004000000000675-1973.dat aspack_v212_v242 behavioral2/files/0x000200000002a07c-2091.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4684 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4968 2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4684 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-30_ccc5726047c6a2726b77865a4d68403a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4968
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 f9ba452fb6aff9c66a0d48e84fccc28a80529a684cf06943d7dc4eea62551e99
- MD5 ccc5726047c6a2726b77865a4d68403a
- SHA1 4fa83491b563516780cdc9f337cde35e7b18826e
- SHA512 6c17001db8fb52fcc1366ef0db18bf85598ef7b282e400158c965d854ee416f93b417ff6a147de8e58b4b2031d390f874eb205863df66c7128482ec5a2deb2d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFplYaERa8D5jcAkSYqyEoD5Tvinrmh5jB:A3k03kHRJARJMpYq+56rapYq
- TLSH T1DCA54A16F6644BB5D07BC179C5D29A56EA333C450F308BCB1385DA283F277E19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
- Size 2.1MB
- SHA256 e09664ef4b189749bcd80112c5fcc74d0ecbbe66354a7728e0ba4bd550d2bdf9
- MD5 e0d0fc0ecad5409a7380351d47a03096
- SHA1 61f667dd28dab154de71b24e240581efcbeb8a69
- SHA512 608dc5c9fcea19b9ff97d7b34c6d6e7454b3b8c698c505d1aaae5351f0e65c9e78a5eba859900acc1ba7659e1f619eda08e74aaa06e81b892b242a5a328f87d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFplYaERa8D5jcAkSYqyEoD5Tvinrmh5jI:A3k03kHRJARJMpYq+56rapYqZI
- TLSH T1E0A54916F6644AA5D07BC179C9D29A56EB333C450F308BCB1385DA283F277D19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$
- Size 2.1MB
- SHA256 a3faaa42553382e61e9a43cc883bc82b99b7f67803ea6b534776fc0dec484813
- MD5 65e4c7eaedf3652da9327e2250c1e04e
- SHA1 202fb3537f8486aae555d1d052f6a0db33011cb0
- SHA512 b9733727f0d1b4304dbf18d8b8162188e46141f6b24292a9088aa4023cdbcc793768059b7c5a80783eed174f6906742e326b5fee2701b41f47c18da9eb6a52e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFplYaERa8D5jcAkSYqyEoD5Tvinrmh5j0:A3k03kHRJARJMpYq+56rapYqdw
- TLSH T1F0A54916F6684AA5D07BC179C5D29A56EB333C450F308BCB1385DA283F277D19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 9c7b058dbbe87c377ea100a405f6173a5640656d1cb6e608bff12b38daccdb4c
- MD5 8f5c8f819eebd8a8cd3763d7575603a8
- SHA1 07aebae8437b23d9faf8e4fa25eb0df77870e3c6
- SHA512 859ab509d40e18cbba6cd997bbbc3259080bec78dbdc22b0543537c60ce3eb8af17c5f360b1197111f89bf92d54ed35c20311e410b6e0c3a4bea899a14ee53b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFplYaERa8D5jcAkSYqyEoD5Tvinrmh5j1:A3k03kHRJARJMpYq+56rapYqjPji0Aj
- TLSH T15EC54B16F6644775D077C0B9C5D2A69AEA3238450F308BCB0385DB683F277E59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.4MB
- SHA256 28b5171cca912c31d3692c2e16f03bb6586e8290c4aeb19b089d322e2c61fdee
- MD5 ceabf7d0c06edf23cd396d205462790c
- SHA1 31a45d3723efc2c14bfdd6b292c5cbda1d7095c7
- SHA512 e30145cc37f40eb2331019f45e16f6f7e6b90af45afe489ef8bb603e66c1d22cf40b1a2f3a76bd2e855a56f0cb3b9d7b1ac68bdd56fe20336391944a9ca3cf3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFplYaERa8D5jcAkSYqyEoD5Tvinrmh5jW:A3k03kHRJARJMpYq+56rapYqOXpiMh
- TLSH T1C3C54A12F6A84675E0B7C175CAE29656EA733C514F3087CF13849A282F73AD1DA39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe
- Size 2.3MB
- SHA256 596697e5072451edc02cb0914d913f30e3de43ecaa7a27eda43b3ab2abbf847b
- MD5 0a990744d4d43add8bbe26f5de19ccdb
- SHA1 2a0d1fe3465242815e6b531690952d09ac7f189d
- SHA512 c1add227054299310a9c2e8831d41e8cacf249eab1a845fab2a2becae562c7d338c8bd1d974016792feb1594f09fcee1ccc0fae637785846d9f9d79b689a9bdf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFplYaERa8D5jcAkSYqyEoD5Tvinrmh5jq:A3k03kHRJARJMpYq+56rapYq/i2WH3
- TLSH T109B55B12F6A44A75D07BC179C9D2965AEA323C410F3087CB1385DB293F277E19E3A762
- MD5 SHA1 SHA512 SSDEEP TLSH