Analysis
- max time kernel
88s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/06/2026, 09:06
Behavioral task
behavioral1
Sample
2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260630-k2rzhsbv21
- SHA256 2ec44f6f13089b95e6585a26d6f8d0c4872a0a71c7b3e241ef507b163993cf88
- MD5 5e287e23d988f8013946eb323cf60b2b
- SHA1 e0c77e22b2b6433d80b5487dde2e3b7a46d40ea4
- SHA512 47ed1b4379e6b9b93ffeee5fd4a3855d76a7e105c520b82416402965d4361d9eaa6278d0b2bb7fcb613f69885f673043bf7b4c8d17c47c6e83368a5307f19ae2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvbjYTqMi8CtBd2QHCHmTBW5x:A3k03kB56rUqJtb2I756rTPji0Aj
- TLSH T1B6B52916F6A44B65D06BC075C9D29696EA333C425F308BCB1345BF283E376D1963A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/3036-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244e6-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5068-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-13.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3036-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5068-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000214d2-711.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001a0000000006d5-1533.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244e6-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-13.dat aspack_v212_v242 behavioral1/files/0x00020000000214d2-711.dat aspack_v212_v242 behavioral1/files/0x001a0000000006d5-1533.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5068 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3036 2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5068 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_5e287e23d988f8013946eb323cf60b2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3036
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5068
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 2ec44f6f13089b95e6585a26d6f8d0c4872a0a71c7b3e241ef507b163993cf88
- MD5 5e287e23d988f8013946eb323cf60b2b
- SHA1 e0c77e22b2b6433d80b5487dde2e3b7a46d40ea4
- SHA512 47ed1b4379e6b9b93ffeee5fd4a3855d76a7e105c520b82416402965d4361d9eaa6278d0b2bb7fcb613f69885f673043bf7b4c8d17c47c6e83368a5307f19ae2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvbjYTqMi8CtBd2QHCHmTBW5x:A3k03kB56rUqJtb2I756rTPji0Aj
- TLSH T1B6B52916F6A44B65D06BC075C9D29696EA333C425F308BCB1345BF283E376D1963A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.8MB
- SHA256 725e06089583f0e65d79aebff655c0343c6a5b84ebae7e63f7207b7cea9e0ce1
- MD5 a4a2ef9a7e16472fa67d7972aea6cb98
- SHA1 50997bcee46ae624a4f4a051eb6ca4f1e9054d21
- SHA512 9c4f12fc92c40a1dc67a91b8c35db8b39d2f015fbe447cff5bbdd745431e59690285b1e6456ca8ad63f1a344f8c90928fc94455c52a3bf00f25da25ced81a6ac
- SSDEEP 49152:A3k03kB56rUqJtb2I756rTPji0AjoTd9CHKyao:A3k03kCrUvrLjoKCqo
- TLSH T1C3D52816F6A44B65D07BC174C9929656EA733C425F308BCB0385BE293F336D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 541a675826fc000789d2ce2e9ad0cb076127f0b6d77c1447ab9a051f99310e77
- MD5 64af6ea2c7bc91fc437ad876348a745c
- SHA1 da405ad8c69caeeabb67b5dabeb30d9c67ef8302
- SHA512 5967d4b5205d31cbe64ec9a2c26b8511f36892ff81d6dcea262d39e44ab72ee49f5f7c3e231c5199cf319e9b9ef9ebc5c179a4ec9cba7d03e9e3a4a44f6c1433
- SSDEEP 49152:A3k03kB56rUqJtb2I756rTPji0AjKPji0Aj:A3k03kCrUvrLjo0jo
- TLSH T11BD52A16F6A44B65D07BC075C9D2969AEA333C425F308BCB0345AF283F376D5963A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 2.3MB
- SHA256 a219290724b4e1fce458cd25d8a00c457dcdef48cbdfbacb50308d2383d29f07
- MD5 0dc953352f7ce680c32df787e38dac4e
- SHA1 5d0e4c6d0bf3b9fec5c361f0228c004d30e08b23
- SHA512 2e0b99ab4fb3b0356a1ca5c6ab60f218a4b4966ea91c41c0de78b1a1bb5c6f46da15c151f10c8fdeaeb3809bf78a1b2f5b6965476c2166958d104c4e2dca28e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvbjYTqMi8CtBd2QHCHmTBW5L:A3k03kB56rUqJtb2I756rTPji0AjG
- TLSH T128B52916F6A44B65D06BC075C9D2969AEA333C425F308BCB1345BF283E376D1963A723
- MD5 SHA1 SHA512 SSDEEP TLSH