Analysis
- max time kernel
92s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 00:42
Behavioral task
behavioral1
Sample
2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260711-a2f7xaby2s
- SHA256 4389eaf65f4caba28d5b5cce45f91a57df8c67a5ef47664ea23f78f52781d8c4
- MD5 2ed17b876ba7125dcd81686071e52fa2
- SHA1 2697d7a45735945fcf1b3c7d5f47a2c930921fcc
- SHA512 2de8b6e7c668e1b4e11355ea304f31536211d145f46e51e369935c866fccc1e1a7854d422919957e33d9b427c1fc14789b4b5f5ed778f4ccd4fa2db5056bc967
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcIQciYICYTqMi8CtBd2QHCHmTBW5M:A3k03kHRJTqJtb2I
- TLSH T143757C27F6A442B5E067C175C5D29A6AFE7138425B30C6CF1349C3282F63BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/4780-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001600000001c357-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4780-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4864-77-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995e-483.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b14-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0fd-1027.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb59-1292.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00190000000187fc-1490.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4bd-1697.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001600000001c357-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000300000001995e-483.dat aspack_v212_v242 behavioral2/files/0x0003000000019b14-628.dat aspack_v212_v242 behavioral2/files/0x000300000001a0fd-1027.dat aspack_v212_v242 behavioral2/files/0x000300000001bb59-1292.dat aspack_v212_v242 behavioral2/files/0x00190000000187fc-1490.dat aspack_v212_v242 behavioral2/files/0x000e00000001c4bd-1697.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4864 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe - Drops file in Windows directory 63 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4780 2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4864 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_2ed17b876ba7125dcd81686071e52fa2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4780
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4864
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 4389eaf65f4caba28d5b5cce45f91a57df8c67a5ef47664ea23f78f52781d8c4
- MD5 2ed17b876ba7125dcd81686071e52fa2
- SHA1 2697d7a45735945fcf1b3c7d5f47a2c930921fcc
- SHA512 2de8b6e7c668e1b4e11355ea304f31536211d145f46e51e369935c866fccc1e1a7854d422919957e33d9b427c1fc14789b4b5f5ed778f4ccd4fa2db5056bc967
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcIQciYICYTqMi8CtBd2QHCHmTBW5M:A3k03kHRJTqJtb2I
- TLSH T143757C27F6A442B5E067C175C5D29A6AFE7138425B30C6CF1349C3282F63BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.6MB
- SHA256 e8b55484078d0e410e2899b494585d5d10c4b7fce307263da1abefe013099415
- MD5 1fff7b2267a0099f5174425826d92179
- SHA1 efc816aa80f6ac96abb40e890fc0a4e2df1b57dc
- SHA512 f7ec035d3259d3ae8432f385a4b53d1eb7c77b787f721c220cd0b289e0f911074f26dca5827c0d9508493a1a587dd03d48809a0d2fae8036f743c1b475978f02
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcIQciYICYTqMi8CtBd2QHCHmTBW5b:A3k03kHRJTqJtb2IJW
- TLSH T181857B27F6A442B5E067C179C5D29A5AEE3238425B30C6CF1349C3292F63BD19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$
- Size 1.7MB
- SHA256 f27c3234ef65817ed2d1f5193d97a065cc10a7f5c0b6138078cf6e17bb2c5b8d
- MD5 141492cadeab650a96dfeb5593ef3a57
- SHA1 58ee651a0f482a306f8a48562273ff4093336a48
- SHA512 7f812f5a12ffef26592dd4cb2360f5f59b6212dce598075743337f899acecc402b4b517527972c20c3b3642dfb9a4604d966417ccf99c17221ebff1f7876b4a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcIQciYICYTqMi8CtBd2QHCHmTBW5G:A3k03kHRJTqJtb2ID7gi
- TLSH T1B3857C27F6A442B5E067C174C5D29A66FE7238425B3086CF1349C3292F63BD1AE3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 8e615b1b3a0c13b9f6d8e31b8843cf55ae2996470b7a351bb5072111a904b634
- MD5 e219daeb1cb6251b05ebba0c6ecfada5
- SHA1 8ea6d91503fcf0520b1bacaa3da70e94c169d942
- SHA512 d1a810692cc745b44b43013514c0f8d23a4e8418f4921cfd96d8866f13f1ab4160a809a64e44c1f3bda42aeadc6f0ea236618b0292cb3762f776b09bdc1d23a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcIQciYICYTqMi8CtBd2QHCHmTBW5E:A3k03kHRJTqJtb2IRPji0Aj
- TLSH T145A56B26F6B44375D073C0B9C5D2A69AFE7134825B308ACB1349C7282F67BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
- Size 1.6MB
- SHA256 c9f6e2b2264cb58e7912046941e14cfa21b7d79598fbefdddde09bd0ddb39863
- MD5 991f79a0a3be96c1502a18ef1c9a94eb
- SHA1 2ea54543b2afefa2a1e9dd041ab63f7bd6ff7eca
- SHA512 998eeb5036994736d880abf4ce7fc92724dc398259bf69f228203d864d84dc7d4b7b541fa29152c161fed08a18cc476864ed31cdd0d1af3902438e4d1e8d0de2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcIQciYICYTqMi8CtBd2QHCHmTBW5d:A3k03kHRJTqJtb2IK
- TLSH T1B0757C27F6A442B5E067C175C5D29A6AFE7138425B30C6CF1349C3282F63BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
- Size 1.6MB
- SHA256 24d3e3b226bce69cb4d6ea37aebc9aca7774a49bd86e56d4bc6fc24db32bd93b
- MD5 a3379b8284ec56462ca34afa8e97bacd
- SHA1 b602872a2bc4407afb1800a4409f42e36423401d
- SHA512 58ec4b5307adb9eae4549fd15377f39ed73dd3da2b585b18e393f6a2c1e06ee6f17ceec5d758769183c81ef0d435d8a720613db601245b51faa598d2d7c3d644
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcIQciYICYTqMi8CtBd2QHCHmTBW5h:A3k03kHRJTqJtb2IK
- TLSH T1C2757C27F6A442B5E067C175C5D29A6AFE7138425B30C6CF1349C3282F63BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
- Size 1.6MB
- SHA256 52eda1a25571e8b507b6d05f5d0b0aca9d052f03d52a9d0e1e1f0712404bbeff
- MD5 14087668bcf3f76c2f8845cb3de38193
- SHA1 5bee0ae71cb4eaaef0d1c33ebcb3749327e22734
- SHA512 4aa8262dac828382b457ed60f3fe0c661bdf4795551d84f07aeb19921177891a9c97d876e4957200feb14e10649883e73120802389da8a7bd6d69c7e8d280cc6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcIQciYICYTqMi8CtBd2QHCHmTBW5Y:A3k03kHRJTqJtb2IT
- TLSH T165757C12F6A442A5D067C074C9D69A66FE313C825B308ADF1349F7292F337D1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
- Size 1.6MB
- SHA256 5b845853822dd1c8db2f9d12b3f03e2def6da25bf3b55b47269a5f0900084cbb
- MD5 111bb673afaab9bb80009c4c7a6ac1e8
- SHA1 4e64b4781f10d19f425081e267b9eca3238ee9d9
- SHA512 bbb40ddb9269f6a2be9d8c42701320d2f8de4468c3f0c6fa78fcdc44eee69d95334db375c16bd119a67c6bdd3d2258fb7c81d9f775e205bc19f7dbff4c0e426f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcIQciYICYTqMi8CtBd2QHCHmTBW5t:A3k03kHRJTqJtb2Ie
- TLSH T145757C27F6A442B5E067C174C5D29A66FE7138825B30C6CF1349C3292F63BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH