Analysis
- max time kernel
82s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 00:16
Behavioral task
behavioral1
Sample
2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260629-akyevsas6m
- SHA256 7999a44987c1d8ed542470b8d35801745cfe27a4c145f61e750893c49241a0c7
- MD5 1556017b8a85e258996d174d5daeca89
- SHA1 674a690ac5b91a18ceeae26a9adbbf906bff19e6
- SHA512 51a219e063ed10b3065a6970d9f3c8eb9c2c9eb9beab93dbf906a99601a3802dc2aa918c14a89a50b29ae1bbdd0a47d17985d313d0cbd8c5c593b1355d5f2218
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaLLaguioEMD5Tvinrmh5jcAkSYqyE:A3k03kHRJz56rapYq
- TLSH T1E5755B16E6644BA5D06BC174C9D29A66EA733C461F3087CB1354EE283F337D19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/3736-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244b4-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6da-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3736-39-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2268-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244ba-809.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216a1-1269.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00180000000168fe-1590.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244b4-5.dat aspack_v212_v242 behavioral1/files/0x000300000001e6da-11.dat aspack_v212_v242 behavioral1/files/0x00070000000244ba-809.dat aspack_v212_v242 behavioral1/files/0x00030000000216a1-1269.dat aspack_v212_v242 behavioral1/files/0x00180000000168fe-1590.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2268 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3736 2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2268 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_1556017b8a85e258996d174d5daeca89_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3736
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 7999a44987c1d8ed542470b8d35801745cfe27a4c145f61e750893c49241a0c7
- MD5 1556017b8a85e258996d174d5daeca89
- SHA1 674a690ac5b91a18ceeae26a9adbbf906bff19e6
- SHA512 51a219e063ed10b3065a6970d9f3c8eb9c2c9eb9beab93dbf906a99601a3802dc2aa918c14a89a50b29ae1bbdd0a47d17985d313d0cbd8c5c593b1355d5f2218
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaLLaguioEMD5Tvinrmh5jcAkSYqyE:A3k03kHRJz56rapYq
- TLSH T1E5755B16E6644BA5D06BC174C9D29A66EA733C461F3087CB1354EE283F337D19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
- Size 1.7MB
- SHA256 5a9fa23e58296bb603cae46ccef6613d55a338ad291bb4c8df627719756ce0dc
- MD5 63feffd7cdc8e8cf67624c66a59175e0
- SHA1 f477bef29bbd80bc60b65dbfe16a3348bdfa1f7d
- SHA512 0b72e8457334926f8a44083dae2e9ded2cbf0f2580de57dc5f6326099c72170476fe745dc1497dd96adeeb8ea98a56327fb1084d2f5657712d8ec62db65a468a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaLLaguioEMD5Tvinrmh5jcAkSYqyEdc:A3k03kHRJz56rapYqdw
- TLSH T120856B16E6A44AA5D06BC178C9D29A56EB733C421F3097CF1354DE283F237D09E3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 7b23c8e557da30ee0500f2d3153127471d0d62432bfc2a59d6cc1b7ec9421310
- MD5 3bc011a554e91c1f0487a986821b7a21
- SHA1 64ea721da8325a2d8e42506bc583e2e85d3f5bd8
- SHA512 5852179e363fb8d854282a9b73e5f9bc12c385250f30487adabe3c3e7dd4cac13b76d925eafea88863611784607e20225cb868b60c9c9205fae64db4d729a4e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaLLaguioEMD5Tvinrmh5jcAkSYqyEDD:A3k03kHRJz56rapYqjPji0Aj
- TLSH T1C5A55B16F6644B75D06BC0B9C5D2969AEA723C421F3087CB1345DB283F27BD19A3A372
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 1.7MB
- SHA256 b2e695008d6acc4371a971ccec3b1a45244c8e3b8ba15c989853904291dfa0a6
- MD5 20c883c44c7620ab04a5d78ce0e15150
- SHA1 2da93d7ee6093255e3bb8365c510ea3ccb8f4d77
- SHA512 34c58c285df9a1cf9a8a9e7220f604af2834c25887ce2a05182ee91f1ebc45d328b1a6717f8b070b9e25cc77c3d036ecd4ad5495dcbadf679f9ff1151f73957f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaLLaguioEMD5Tvinrmh5jcAkSYqyEPF:A3k03kHRJz56rapYqt
- TLSH T1EE855B12E6A44BA5D16BC174C9D69656EA333C420F208BDF1354BF293F337D0AA39762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE
- Size 1.8MB
- SHA256 cb1cdac7618575704148e27d05a6b4662e56dc6f09465bb7e83e87569fe15b97
- MD5 3da689b95122383926248d8b4f46a6fa
- SHA1 609debd23811a90f12197a420b63a8833e2f7ed0
- SHA512 91a1ded83eeaa3a18c459539c8d58d20185ec69a3ec72fb0c557bd2394d7159e2e23da9234d4f682e589db070a25b905e6e5a0dc7f17900486ca613bc9828d51
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaLLaguioEMD5Tvinrmh5jcAkSYqyEd0:A3k03kHRJz56rapYq9TeX
- TLSH T13E955A16F6A44AA5D06BC174C9D29666EA737C421F2087CF1354DB293F337D0AE3A362
- MD5 SHA1 SHA512 SSDEEP TLSH