Analysis
- max time kernel
117s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 01:23
Behavioral task
behavioral1
Sample
2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260602-br2arsbz5q
- SHA256 0b4973ff155ca7fda7667b011c3c4c0ac14973294181d8e61faf8d79002f9733
- MD5 553921774066ce55334ba587035a7741
- SHA1 f526751069d423110fc02ba506d7738ccc95b636
- SHA512 101f5d3fae07738b9ecfcca4a255223c19bf9e5cfb963db00e4edeff515827ce9c8f713a02ad729ac7ee2f3b82f22a2c999de5c42090a940aaa00861440260e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPXQcMYTqMi8CtBd2QHCHmTBW5w5d:A3k03kHRJDqJtb2IRpYq
- TLSH T1E8956C26F6644675D073C0B9C5D2AA9AFE3134425B308ACF1389D7282F27BD1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4636-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b450-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2448-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a408-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4636-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2448-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028d77-1287.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00060000000259ac-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0029000000000478-2060.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b450-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a408-12.dat aspack_v212_v242 behavioral2/files/0x0003000000028d77-1287.dat aspack_v212_v242 behavioral2/files/0x00060000000259ac-1379.dat aspack_v212_v242 behavioral2/files/0x0029000000000478-2060.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2448 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4636 2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2448 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_553921774066ce55334ba587035a7741_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4636
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 0b4973ff155ca7fda7667b011c3c4c0ac14973294181d8e61faf8d79002f9733
- MD5 553921774066ce55334ba587035a7741
- SHA1 f526751069d423110fc02ba506d7738ccc95b636
- SHA512 101f5d3fae07738b9ecfcca4a255223c19bf9e5cfb963db00e4edeff515827ce9c8f713a02ad729ac7ee2f3b82f22a2c999de5c42090a940aaa00861440260e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPXQcMYTqMi8CtBd2QHCHmTBW5w5d:A3k03kHRJDqJtb2IRpYq
- TLSH T1E8956C26F6644675D073C0B9C5D2AA9AFE3134425B308ACF1389D7282F27BD1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.7MB
- SHA256 aff6d9bbc2073eacecbad80ec4597fcc1f2bfc4509376ab62a310053a229a006
- MD5 aafc9464921ab25c485a0243df1926dc
- SHA1 a3c419e38584165566155fa13a31502f27215392
- SHA512 89ef6af81605cfa13d3d9a27307c497c677495240e9047c2b2e052a3bc33bcee748829c49a394d3021ef918575a58acd425469dabb94bd6e8652db5bf71119f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPXQcMYTqMi8CtBd2QHCHmTBW5w55:A3k03kHRJDqJtb2IRpYqKVk0QGTvntQb
- TLSH T1A5D57C26F6A843A5D077C179C6D39A57FE71384617309ACB0395C3292F63BE19A3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 f359b57d12ca3aa8d8430aeb115bedcad537a672e160d09f935b69791f8a8e03
- MD5 d5fd1196d03bc6e269445663a4e8bd7e
- SHA1 208ad9fb0457d25c39b84483ddd7a501d0c3b845
- SHA512 72d579526a8ab8077fff8dd06ec06424af640005fd6f3ace5c2403e594b6e1f1bf183002fd093d974e753ee88acb45978c6d4f0994b4ec854ce61beddeb0e03e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPXQcMYTqMi8CtBd2QHCHmTBW5w55:A3k03kHRJDqJtb2IRpYqjPji0Aj
- TLSH T110C54B16F6748375D073C0B9C5D2A69AEE3134825B308ACB1389D7682F277D6DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.0MB
- SHA256 2b96d47f368f7e38c7761917ae2754986a0b397708f5acfe35f3ac2839098ef0
- MD5 175a8561cbeadd9b8b6dea17ba7efeeb
- SHA1 69eac1a6b6744fe8de5e63ca35a0fe70ed75489e
- SHA512 bff89f626e7e473b2073be94671f53d3b5ebfe8db3fd4afb60a5e96f3bdb3e96448ce3c76cb7643bff63384287f46116442e99a6e0975dba061886303bd9054c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPXQcMYTqMi8CtBd2QHCHmTBW5w5n:A3k03kHRJDqJtb2IRpYqt
- TLSH T1A6A54B16F6A44675D073C079C9D2AA5AEE313C821B308ADB1349F7282F337D59A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 2.2MB
- SHA256 10d70ec7ad2cafee2926f6ece123f64d57d5aec509e0ae596dd5ede262fbfde9
- MD5 d042866f78eb646953208a2a5a01445d
- SHA1 b1ff474fce40c9e15218ca777cae6c7ee9756b27
- SHA512 ede29531da770941e86cb96bf27a56d64f8ef4359de048d8aee8e2c1d72eab2db0940b996262856372539eed375a5ae44ed8e4571cd4646c4bd9bc22f7a599e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPXQcMYTqMi8CtBd2QHCHmTBW5w5W:A3k03kHRJDqJtb2IRpYq/i2WH3
- TLSH T1A2B56C22F6A44675D073C079C9D2A6AAFE3138425B3086CB1349D72C2F67BD1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH