Overview

overview

10

Static

static

10

2026-06-02...ry.exe

windows10-2004-x64

9

2026-06-02...ry.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    111s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 03:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_f28c9fcff96705c5effc61d8b2ec6679_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
  • Size 3.4MB
  • Sample260602-d86b6aev5q
  • SHA256 4505f776cd21fbdb5d579384efa41f42210fece9bdc4f87527fbbfb322ff4246
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
aspackv2discoverypersistence

Malware Config

Signatures

  • Custom signature
    Detects executables packed with ASPack 13 IoCs
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_f28c9fcff96705c5effc61d8b2ec6679_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_f28c9fcff96705c5effc61d8b2ec6679_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:5040
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1852

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 3.4MB
        • SHA256 4505f776cd21fbdb5d579384efa41f42210fece9bdc4f87527fbbfb322ff4246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DisabledGoogleUpdate.exe$
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
        • Size 3.9MB
        • SHA256 3ad658be1a0b9da50cc1b884947528ca202178c3700745615239db919fb5e8c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_pwa_launcher.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe
        • Size 3.5MB
        • SHA256 1917fe951162498c3d198461e70e2b87df6c565ad5a6a597af0b2b61f3fc2130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 4.0MB
        • SHA256 497fb5a33cb4a1f6cfb3f4569b886633fe93eb844debfa1444fcbf0328edb44c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 3.5MB
        • SHA256 73a1f9bc392fdd41656fe7f902313f8fffd3b50d939872e7bad87da59a409aea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe$
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$
        • Size 3.9MB
        • SHA256 652715d46984125c76785fcc33c17af9473be593a2f9a82ba207ecc8fa3af419
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dbcicons.exe$
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$
        • Size 3.5MB
        • SHA256 e9aa5bd3f5b3850af13ca0478e56459987dbc571255a108f13b254e0df3c1c83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdge.exe
        • Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        • Size 3.7MB
        • SHA256 15ee3f09e7f6b125ec19742e8dc417f5d20ba09891ca0d68ac663cb92a369ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dfsvc.exe$
        • Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
        • Size 3.4MB
        • SHA256 79cc4008ea5cc5780119cd7c124060f7fe4d8085e8672f9822701429c5b33db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1852-53-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1852-7-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/5040-34-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/5040-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download