Analysis
- max time kernel
106s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 12:30
Behavioral task
behavioral1
Sample
2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260604-ppqcdaex6y
- SHA256 3a3b0371f0ccbf236f648666be97679215f3cfd46b99216163a26cd9408da0bc
- MD5 f55f28a5321a9cc58b3c103f9d802e69
- SHA1 ec1af8d8702ae0f5a06362bf57627c41e4ff1aa3
- SHA512 09c4fb5121d7f4093d15f05198e4b3341c26a718356d023d99f525e928425343b4eb929b8a638b325e7a91046dc7d664e5eec6130e010e8a3140325d4c3c27d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasqdOf3mnXoZ643mnXoZ6i6cMJlCUQk:A3k03kHRJk3k03kHRJ5
- TLSH T1C485AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/2292-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b56b-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1904-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a2a8-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2292-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1904-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028d43-1284.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b572-1615.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00110000000004a9-2066.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b56b-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a2a8-12.dat aspack_v212_v242 behavioral2/files/0x0003000000028d43-1284.dat aspack_v212_v242 behavioral2/files/0x001a00000002b572-1615.dat aspack_v212_v242 behavioral2/files/0x00110000000004a9-2066.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1904 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\RevokeSwitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164640\javaws.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2292 2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1904 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_f55f28a5321a9cc58b3c103f9d802e69_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2292
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 3a3b0371f0ccbf236f648666be97679215f3cfd46b99216163a26cd9408da0bc
- MD5 f55f28a5321a9cc58b3c103f9d802e69
- SHA1 ec1af8d8702ae0f5a06362bf57627c41e4ff1aa3
- SHA512 09c4fb5121d7f4093d15f05198e4b3341c26a718356d023d99f525e928425343b4eb929b8a638b325e7a91046dc7d664e5eec6130e010e8a3140325d4c3c27d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasqdOf3mnXoZ643mnXoZ6i6cMJlCUQk:A3k03kHRJk3k03kHRJ5
- TLSH T1C485AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
- Size 1.9MB
- SHA256 a5e20d730ce15c8a9cfa58d5a6ac0e92cc5aa4a4939a8cf98bb8ca64d0ec8ce0
- MD5 82360781e902b6e888e2ab804af6d1c1
- SHA1 9bf22f949d77e8cb605818a95c4d8092c651d97f
- SHA512 5b61bd58dac30d1863731d3509832670845947968b47253b08233dfbca876d7b7f9088fdea414a4e21082f49e986b7f67aab8e34bcc3a61aeb591cbce5b1875b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasqdOf3mnXoZ643mnXoZ6i6cMJlCUQ3:A3k03kHRJk3k03kHRJvw
- TLSH T11695AF13E79500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD0BF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 c390e0534c504a51f69482952d43986a497f23d197cfdd86bf99a83e3a092521
- MD5 e73ad276a42a7d3d690f874bb143f956
- SHA1 e9f9632f843591737fb009b62792ce8c5ce85af9
- SHA512 d4011055e23429c1ad9032ea8cda9a975cc807fc9de277900b6eae57507db1a9495d4ba63218fbca168b754e541ff89dc71708a7859b0a9ab413f403932e5798
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasqdOf3mnXoZ643mnXoZ6i6cMJlCUQ4:A3k03kHRJk3k03kHRJlPji0Aj
- TLSH T142B59D17FAA401B5D026C178CAD69A66FA717846173097CF1358C7293F63BD0AB3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.8MB
- SHA256 28dae4d7747f55302d50928cdeea5e9e145f6ff9a2897b53db33aed58ac3b848
- MD5 c5cf844549c64717dd86dd5270a3943f
- SHA1 011d185812e016e811157e33177b14e33b2fac55
- SHA512 f8581ef5a6e00d3ae2351a40639f02d3fe660cd82e9f5fdded22bdc6e509d0294fbf8b5b2f3dd99ae028e229ee751c1088376ced63d6cdf197c4171e79a1a18e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasqdOf3mnXoZ643mnXoZ6i6cMJlCUQU:A3k03kHRJk3k03kHRJf
- TLSH T1CE959E03E69500E5D14AC1349ADA8A22FA75BD92176097EF2358F7152F72BC07F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe$
- Size 2.0MB
- SHA256 7b18c28fc2438fbadb4e98ef7af9b59e501d19f38477ea727f493c71fbab9052
- MD5 dc9424512000f5ed134bdc1108d160da
- SHA1 96027f12c1828f6865f19085ad312bb6eb6f31d6
- SHA512 853f7672c26f6b5cd6214acbbc0dcd2311ea8d2a39cc66b6efb969a64073666b7fe85b059a8e1a56f58a9b1e41d11fe9bb81330c331bc9dcbb11f923a346447e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasqdOf3mnXoZ643mnXoZ6i6cMJlCUQJ:A3k03kHRJk3k03kHRJ1i2WH3
- TLSH T165A5AE13EB9400F9D10AC1749AE99636EB75BC52177193CF6358C2092F62BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH