Analysis
- max time kernel
120s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 12:52
Behavioral task
behavioral1
Sample
2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.1MB
- Sample260703-p4ejeshx3t
- SHA256 c40cb0702a262be94601338a6bcb8ad81b0c2b4c2316b6311269c3038ebf85fc
- MD5 0d753ffa32ca7a11f508bd50e71eb125
- SHA1 41b109d0d849f3ede50f5e1f1398f37f3781a409
- SHA512 b345e6592c980968b418d45835cb6ad87abac77ae0139fc2914327475bd4e242b7b97532421308aecda8a891c41c53925fe50c6a0784f2a817473f446dd95da6
- SSDEEP 49152:A3k03kHRJveW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9Mb:A3k03kHRdfkZckFfkZc
- TLSH T124E50A16F6788323D0B3C0B9C5D6AA9AFE32344657308ACB0349D72C2E277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/2900-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c56a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c5-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2900-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5992-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001abd2-1004.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d000000019d98-1221.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c56a-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c5-11.dat aspack_v212_v242 behavioral2/files/0x000700000001abd2-1004.dat aspack_v212_v242 behavioral2/files/0x000d000000019d98-1221.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5992 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2900 2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5992 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_0d753ffa32ca7a11f508bd50e71eb125_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2900
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 c40cb0702a262be94601338a6bcb8ad81b0c2b4c2316b6311269c3038ebf85fc
- MD5 0d753ffa32ca7a11f508bd50e71eb125
- SHA1 41b109d0d849f3ede50f5e1f1398f37f3781a409
- SHA512 b345e6592c980968b418d45835cb6ad87abac77ae0139fc2914327475bd4e242b7b97532421308aecda8a891c41c53925fe50c6a0784f2a817473f446dd95da6
- SSDEEP 49152:A3k03kHRJveW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9Mb:A3k03kHRdfkZckFfkZc
- TLSH T124E50A16F6788323D0B3C0B9C5D6AA9AFE32344657308ACB0349D72C2E277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.6MB
- SHA256 defe351341b3e881916a3af47cca3c2dd3957f53214973b58eb59f56e02e018a
- MD5 1624963df4ede7070a62617499c3bab6
- SHA1 b5c1070caba9b6358c6b4c52246662f9dbadb993
- SHA512 51761d226b3b734bd500ad58271c5a2d77f2bf7aa53e7f83f7ac59a59e84842fbd0f4e0eed7e563241481b714ba45642d2f8fa4cd9d899b0fe52acde979003d7
- SSDEEP 49152:A3k03kHRJveW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MbBPji0Aj:A3k03kHRdfkZckFfkZcRjo
- TLSH T1C2060A16F6788322D0B3C0B9C5D6AA9AFE32344657308ACB0345D76C2E277D6D63A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
- Size 3.7MB
- SHA256 46aef6c798814b4233bf76451c09de6b0a91b42eb01c692e1c93e76d449bb976
- MD5 ca34118de17d0673c175888942984743
- SHA1 fbd49ff44d0e65bdd68cae1c6148c252a981eb10
- SHA512 dfcc9654a9d7e726581cee13f35911edefe724196578326f5e6d7d9e902255a5f21aa2f80871f570baf31e60c00905c45f50da4ad006f636faa21d1a081548c4
- SSDEEP 49152:A3k03kHRJveW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MbL8tDZqrKV:A3k03kHRdfkZckFfkZcLm
- TLSH T195062B16F6788362D073C0B9C5D7AAAAFA7234451B308ACB0345D32D2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$
- Size 3.6MB
- SHA256 b0789b28257996147f15c5b7ce7602b4ae093efca37c52e41ffbf0a679b18433
- MD5 0268382301ad92f68c16669e5b89da92
- SHA1 dac38a4063233d63563b0042370230e89bfd9bd6
- SHA512 7c02ba78aea9283c182bc9e69de98d0fc6fd608723eb406b467102c868ef708f9b751678561b1b203a70b190d4e82c9737636a39d57597cdf7cb63ede22c30de
- SSDEEP 49152:A3k03kHRJveW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MbDi6:A3k03kHRdfkZckFfkZcDi6
- TLSH T179061856F7788B32F0B6C079C5D2A669F932384907B18ACB024EA72C2F376D585F5325
- MD5 SHA1 SHA512 SSDEEP TLSH