Analysis
- max time kernel
112s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 20:18
Behavioral task
behavioral1
Sample
2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.0MB
- Sample260628-y3rl2ad18n
- SHA256 95d65e9dae5d9da1865ff994a0a6a282130348a3e1e086b3a189e5622584b8e6
- MD5 9d3caca279f6ceb94e08371a98980ac3
- SHA1 fa28954af5e52d7cd992a6acb8f9229781498bde
- SHA512 a6c3111646a530db53a70818b43e04f4bfdb3c69c10be7284dcc8993343889cebc5c708df16d9c620d13753c3bd1698956ba3837cd8a4c3562de83c7ddfd2a8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaagg+QqF:A3k03kHRJX
- TLSH T13A359F03E6D500E5D64A8130DDDA8A22FA75BD921B6097EF2368F7152F727C0BB39394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/4792-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b7ff-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2ff-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4792-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/684-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x005e000000018968-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c579-2120.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b7ff-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b2ff-11.dat aspack_v212_v242 behavioral2/files/0x005e000000018968-746.dat aspack_v212_v242 behavioral2/files/0x000d00000001c579-2120.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 684 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4792 2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 684 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_9d3caca279f6ceb94e08371a98980ac3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4792
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.0MB
- SHA256 95d65e9dae5d9da1865ff994a0a6a282130348a3e1e086b3a189e5622584b8e6
- MD5 9d3caca279f6ceb94e08371a98980ac3
- SHA1 fa28954af5e52d7cd992a6acb8f9229781498bde
- SHA512 a6c3111646a530db53a70818b43e04f4bfdb3c69c10be7284dcc8993343889cebc5c708df16d9c620d13753c3bd1698956ba3837cd8a4c3562de83c7ddfd2a8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaagg+QqF:A3k03kHRJX
- TLSH T13A359F03E6D500E5D64A8130DDDA8A22FA75BD921B6097EF2368F7152F727C0BB39394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 b1e33eb1f3cdf50cf148c0bccfc124ee12a4dd15f8b42deda38cf6e174be302f
- MD5 d430f9828465e493fef47731d8578b55
- SHA1 084b79a01e17203c147b4c2461a0775f9bebabf1
- SHA512 6128234093b9b5484d4e5202a56d292e38c1782f4ccf12e8a4ff61213bc0b5c71ad66df44f81ebe5f521c6df8a88e34fc6067ad63459effd560a951553f2c01c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaagg+QqB0Le5ji0hmxNrM:A3k03kHRJTPji0Aj
- TLSH T10D757C17F6A402B5D067C074C9D6965AEA313D821B308ADF1358F7282F73BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 1.5MB
- SHA256 994f5a40d35cb6c30acfcd881f8b03229dde3b262da739fb4bb3bcaee6372955
- MD5 3afe359aadc69cac87ca1b07091c3d3f
- SHA1 1a0f6b5f6063163c4806fe3903859b10c4d7508f
- SHA512 a4c65b83d1b0ef61ddfd35b50fa0a71509329ad0f5660ef64d4c7b7bdc06c105208e6d48acdc13a0eed11345a35d270f2577d40453f025c9badf876cbd0b3daa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaagg+Qq9UOlZ7q/c9:A3k03kHRJjUOlk09
- TLSH T1CE759E13EAA404E5C26B85749E968612EA717C520B60D7DFA368F3291F337D06F39F60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
- Size 1.1MB
- SHA256 e500a4edf805fbd58c5b7ad419891dcced9defffbd15c9d74b83a1107557300a
- MD5 217db253e858ca7721bf5299d64efef0
- SHA1 d35e45aef2e8f6b853bd2c1973ec694734099100
- SHA512 0523a5bc16a2855e2478210c946cf288b3115c8639745b3d60d686c6ab6f9c7e02f8f572fb89cf0ca00e999c382c03fe76d739ff7c699322a18ddf06c0fb0d86
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaagg+Qqb:A3k03kHRJ9
- TLSH T1D9358E03E6D500E5D64A8130DDDA8A23FA35BD921B6096EF2358F7152F727D0BB39398
- MD5 SHA1 SHA512 SSDEEP TLSH