Analysis
- max time kernel
115s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/06/2026, 08:55
Behavioral task
behavioral1
Sample
2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.5MB
- Sample260603-kvvf3abs9t
- SHA256 cb9056e8a309a3c29d58ca754114ce961c103a4bf2c2d9767e44bba2b3790f74
- MD5 39b20f4421016603835790046982b0eb
- SHA1 f122a105e0b23aef8ad87d81b4359593386bd2ca
- SHA512 472a3df988e35a619687317af22a34e584381ab660cc2c7550c123d3a9306ecb40bb80d1ae1186fb1c05ebc258983fd3610f46d916308525a6f10ca3fe20742b
- SSDEEP 49152:A3k03kHRJARJt7eW4SkZP4sz9MbBPji0Aj:A3k03kHR+RTfkZcRjo
- TLSH T16EC54A16F6784362D07AC0B9C6D6AA5AFA33344517708ACB0385D33C2F277D58A7A736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2124-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b4a1-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2044-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a408-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2124-64-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2044-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028e17-1251.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00060000000259ac-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b4ae-1616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b4b3-1700.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b4a1-6.dat aspack_v212_v242 behavioral2/files/0x000200000002a408-12.dat aspack_v212_v242 behavioral2/files/0x0002000000028e17-1251.dat aspack_v212_v242 behavioral2/files/0x00060000000259ac-1378.dat aspack_v212_v242 behavioral2/files/0x001900000002b4ae-1616.dat aspack_v212_v242 behavioral2/files/0x001a00000002b4b3-1700.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2044 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2124 2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2044 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-03_39b20f4421016603835790046982b0eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2124
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.5MB
- SHA256 cb9056e8a309a3c29d58ca754114ce961c103a4bf2c2d9767e44bba2b3790f74
- MD5 39b20f4421016603835790046982b0eb
- SHA1 f122a105e0b23aef8ad87d81b4359593386bd2ca
- SHA512 472a3df988e35a619687317af22a34e584381ab660cc2c7550c123d3a9306ecb40bb80d1ae1186fb1c05ebc258983fd3610f46d916308525a6f10ca3fe20742b
- SSDEEP 49152:A3k03kHRJARJt7eW4SkZP4sz9MbBPji0Aj:A3k03kHR+RTfkZcRjo
- TLSH T16EC54A16F6784362D07AC0B9C6D6AA5AFA33344517708ACB0385D33C2F277D58A7A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.2MB
- SHA256 33947f5fbfc358a63c271e0f033e56a638893586ca77d74796f1badc545409fd
- MD5 98a8d27bfbcfe17fa5bf141dcddd8416
- SHA1 83e5c8402d04c9510ddde4660b52ddf8710a486a
- SHA512 b178b688dbabe46e05586b058fe972ec1b3021e5495a3b52b51ef79c3508eeda715c8be65c83fa1c57438f8166402aff542b2978119a17fbb5456ba6fbeda2cd
- SSDEEP 49152:A3k03kHRJARJt7eW4SkZP4sz9MbBPji0AjPVk0QGTvntQb:A3k03kHR+RTfkZcRjoCHaib
- TLSH T143F55C16F6B843A6D0BAC179C6D79A46FA333446077086CB0395C33D2F277D19A7A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
- Size 2.6MB
- SHA256 45a80df4f8781d5461c2d5f5769ba4de311ed5191e1f3b324abffc30df427942
- MD5 ebc9b0022aa86c9df0a49ecb96056a04
- SHA1 b84c08b29ae9a2dc8682f0479af631e8225abd86
- SHA512 6e1c49feeeb790e667d1f2696548610df50b760b88fe3f9e743c68862f183f09218dd4ad180870fe5bec1fba656fa8569011dc45012703264829a4a99f4c596a
- SSDEEP 49152:A3k03kHRJARJt7eW4SkZP4sz9MbBPji0AjMI:A3k03kHR+RTfkZcRjogI
- TLSH T1FCC54A16F6784362D07AC0B9C6D6AA5AFA33344507708ACB0385D33C2F277D59A7A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
- Size 2.6MB
- SHA256 a14fd3216422d0616724717c89441630503cdbd5c037c4faee69f03146424088
- MD5 05733a4b16f6484d94e2abb1f1c0b601
- SHA1 a03007e7e6118f09b64a93a2dd3942c7f2259f7d
- SHA512 88e38dcfc368b9fb3d44f96e849ad1bc9fcb0384a1fbf35863697c7eb5af4adebec0caa1ef4c377539cdae421933e58e1928a6886b951a8873d7252545e09123
- SSDEEP 49152:A3k03kHRJARJt7eW4SkZP4sz9MbBPji0Ajow:A3k03kHR+RTfkZcRjoB
- TLSH T1ADC54A16F6784362D07AC0B9C6D6AA5AFA33344517708ACB0385D33C2F277D19A7A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.0MB
- SHA256 d594499f7917d7e15322be0fc1f02c244232f7c86dec3d22af5ddc8346264b69
- MD5 63299e605b3f0a2ec1eae1164e67c2c1
- SHA1 54f5afe8dcc8a4b0be5ac21f58d0b1fd680387c6
- SHA512 050ccf68c79798f9e7226becf0f193c8915ba2c9434096e3048fa72a261ff44117bc333d8b614b68e0573837c9969c796d3080feabe0a8420a7e2258d61f2a54
- SSDEEP 49152:A3k03kHRJARJt7eW4SkZP4sz9MbBPji0AjKPji0Aj:A3k03kHR+RTfkZcRjo0jo
- TLSH T15CE52A16F6784362D076C0B9C6D2AA9AFA33344517708ACB0385D73C2F277D58A7A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.6MB
- SHA256 22a50a46d0b91f28bb5166a9ce6cf88f24a799e98d9ee67bbda03b47cb8ac89a
- MD5 934a123a9a580506adb7f6c7ce1b6ac8
- SHA1 a47d0786b3ff870f55960f1f419c1bea1130f555
- SHA512 57057c30a103b9743efeef0b797506d71ce173d2135da1d257729c595e0b48121854a78e2b8ffee59582325ea024065967547bd5f33d4537da512ed618c58448
- SSDEEP 49152:A3k03kHRJARJt7eW4SkZP4sz9MbBPji0Ajq:A3k03kHR+RTfkZcRjo2
- TLSH T199C53A16F6784362D07AC079C6D6AA5AFA33384107708ACB0385E73C2F377D59A76726
- MD5 SHA1 SHA512 SSDEEP TLSH