Analysis
- max time kernel
11s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 12:21
Behavioral task
behavioral1
Sample
2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260604-pjskjsfv2m
- SHA256 44b2d05a88556e57fc00ff3b1266daabb0e8281e3a60301277590eb7952ddc5f
- MD5 e53b8dcc8fe7fc204f64e5ac4914e02b
- SHA1 6d750dcadaa8d455a070a5d135a775903527cedf
- SHA512 aab827a9fa50b9a58749eab0f4a8a741fdcf7dfad82b2e6e08823656f491d6e183dbff41872c76aac1dcb829aab6866010428b292ee924e7fbe8df2fa55cb519
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasqdECD5TvinrmZf:A3k03kHRJx56ra
- TLSH T181357B03E6980FA8D10F81749A964662EA777C565F2093CF1358AE153F72BC06F3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/3384-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a213-8.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4592-13-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3384-64-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4592-77-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00ad000000027277-1274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00160000000279a2-1549.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000300000002a213-8.dat aspack_v212_v242 behavioral2/files/0x00ad000000027277-1274.dat aspack_v212_v242 behavioral2/files/0x00160000000279a2-1549.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4592 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 33 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3384 2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4592 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_e53b8dcc8fe7fc204f64e5ac4914e02b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3384
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4592
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe$
- Size 1.1MB
- SHA256 44b2d05a88556e57fc00ff3b1266daabb0e8281e3a60301277590eb7952ddc5f
- MD5 e53b8dcc8fe7fc204f64e5ac4914e02b
- SHA1 6d750dcadaa8d455a070a5d135a775903527cedf
- SHA512 aab827a9fa50b9a58749eab0f4a8a741fdcf7dfad82b2e6e08823656f491d6e183dbff41872c76aac1dcb829aab6866010428b292ee924e7fbe8df2fa55cb519
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasqdECD5TvinrmZf:A3k03kHRJx56ra
- TLSH T181357B03E6980FA8D10F81749A964662EA777C565F2093CF1358AE153F72BC06F3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 1.6MB
- SHA256 c0a334c7280dd070669559cae60d815da0a49b219c31865972b69365635d368e
- MD5 e11fd7af59169588054ffb3ff1dab8fe
- SHA1 b39198a71161b145634e6261d4d2e590caa43072
- SHA512 95e66fb3d2a4f70d2edaccbcf01f05994d120f0aac5b28ebee03e10ae1e7a4c0ba670f0ccde0683fb50026471bfee4954657c1b467f8ee24180cc7c5d1449139
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasqdECD5TvinrmZP3Td9CHKy7GZO:A3k03kHRJx56rITd9CHKyao
- TLSH T12D757C02E7D40AE4E16FC23489A64522EA777C561F2097CF1354AE153F32BD0AE39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 1.2MB
- SHA256 033b3c199e4f4e44d007ab09ffcb7752ef95fbc501a66e39da55f9307d0415a7
- MD5 b0fd50c9da1ccfd6df498d778a2995d3
- SHA1 e74e6e406c0bf53c749ec1534c4d986351fa6147
- SHA512 4bf30401fae5172b663e7c362f51d0f362fa9aadc6df744854382e8c2fd4eea73211e8ec8439ef76cb2454e3843f2b7b23c2a980f62017d3dd4812c2d97bface
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasqdECD5TvinrmZHF:A3k03kHRJx56rK
- TLSH T167456B03E6950FA5D24F813499964A22EA377D921F2097EF1358BF253F327C0AA39357
- MD5 SHA1 SHA512 SSDEEP TLSH