Analysis
- max time kernel
117s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/06/2026, 12:19
Behavioral task
behavioral1
Sample
2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260605-phnvzagt7n
- SHA256 0d07abe820dba7d91f3fa7f5b492a6deec22a8e727fc1f21f1ed6ef24804dc92
- MD5 42e7370ee1f93ecc3a302d5ba424432e
- SHA1 286efca41adab5f8e26dc5c078455cfeb6d82b37
- SHA512 602305f7247934e7acd58e55b0080465d7dcbeeaa0b01522532e0ce0699c4c4051f83925c1b3b27366242bdd02143d7c8d09bbe94c78753b601c8c79949a507f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GoXGBOKaMD5TvinrmGZe0p4Ek4niOkl/b:A3k03kHRJa56rbeW4SkZP4sz9Mb
- TLSH T195953916F6784B62D07BC079C5D6AA56FA323C465F3087CB03459B283F277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4776-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b48f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/796-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a212-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4776-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/796-53-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00b4000000027277-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000002a8c4-1647.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a1d6-2076.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b48f-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a212-12.dat aspack_v212_v242 behavioral2/files/0x00b4000000027277-1378.dat aspack_v212_v242 behavioral2/files/0x000500000002a8c4-1647.dat aspack_v212_v242 behavioral2/files/0x000300000002a1d6-2076.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 796 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4776 2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 796 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_42e7370ee1f93ecc3a302d5ba424432e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4776
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:796
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 0d07abe820dba7d91f3fa7f5b492a6deec22a8e727fc1f21f1ed6ef24804dc92
- MD5 42e7370ee1f93ecc3a302d5ba424432e
- SHA1 286efca41adab5f8e26dc5c078455cfeb6d82b37
- SHA512 602305f7247934e7acd58e55b0080465d7dcbeeaa0b01522532e0ce0699c4c4051f83925c1b3b27366242bdd02143d7c8d09bbe94c78753b601c8c79949a507f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GoXGBOKaMD5TvinrmGZe0p4Ek4niOkl/b:A3k03kHRJa56rbeW4SkZP4sz9Mb
- TLSH T195953916F6784B62D07BC079C5D6AA56FA323C465F3087CB03459B283F277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.6MB
- SHA256 579331f64954480cc3806cfd3c2d2d247adf82fc128846d980e86f34968f6854
- MD5 b1573bdc249b2865306d5752b422302c
- SHA1 19a0b3eac5ae3a557c0f30b95a6fa5bf1ddcbb66
- SHA512 85b35e7aa2bb03b3eaf3fa69cd74608e1970ecd8e08d55b0215a9839b3ce3cf8c939fd69142f18e825cec750546a25f5c821177d2fb56d7e3d8afc4929944c48
- SSDEEP 49152:A3k03kHRJa56rbeW4SkZP4sz9MbMVk0QGTvntQb:A3k03kHRZr7fkZctHaib
- TLSH T1F4D56C16E2B847A6D0BBC179C5979A56FA323C061F3087CB0355DB293F277D09A3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 2.4MB
- SHA256 d765400d2c76cabd1291e36772ff05277f743191204a050d304facf615ea075c
- MD5 3753764efb639a66604379730b69b838
- SHA1 00ed0e6ee89d5c2f3b696f69078afe9dc7be87d0
- SHA512 d04aa5fcdd9c98093154fcfe056dc1e8375c40a96e7bd53c2ffce2d805f5b3375bf846f6eba16b86cec6a761227f173050992c5ed5bac991619eddf898885286
- SSDEEP 49152:A3k03kHRJa56rbeW4SkZP4sz9Mb9UidGl:A3k03kHRZr7fkZc1dGl
- TLSH T1C9C54A16F6B84BA6D07BC075C5D69A56FA323C460F3087CB03459B283F277D59A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 4bb55b5f234c3b1294dc28c083ae30efe32d49384630d8fe9a4a4ccf013e38f3
- MD5 bf02f1e0b6794e824ca84482ee31971c
- SHA1 28cbb4bd637ce918b53d82d4bc0ad84c990076d7
- SHA512 b81b14aec29b1ce1b50303d3becd6d351d1afc9e402bd24115441b65b09e17a5fddea181d92051df0eae4165794be20c95a62f2de1029a09a80c1704f6b7fb76
- SSDEEP 49152:A3k03kHRJa56rbeW4SkZP4sz9MbBPji0Aj:A3k03kHRZr7fkZcRjo
- TLSH T18AC53A16F6784762D077C0B9C5D6AA5AFA3238461F3087CB0345DB283F277D59A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python3.exe
- Size 2.2MB
- SHA256 3391f07d4ae80b7003ee0a128cda71a4e1d37b14b592009ac7b98052a8484461
- MD5 3b3c09fcb9b5014b797e67c04a04eb5c
- SHA1 febfbc289dbeb7f0f718d0d879d7954d4b3be61c
- SHA512 2656a9df91c4fe08eeb5c0d15e1c0da69cdc04b0bf2b092be0bf1e2490b1c88c55107cb751147abafddf9bc9eddc0f80417150623b5be5bab7edb539eee15f0f
- SSDEEP 49152:A3k03kHRJa56rbeW4SkZP4sz9Mbxi2WH3:A3k03kHRZr7fkZcxuX
- TLSH T1C4A54B16F6B84B62D07BC075C5D6A66AFA323C455F3087CB03459B283F277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH