Analysis
- max time kernel
101s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 21:46
Behavioral task
behavioral1
Sample
2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260712-1mt4bsbs9w
- SHA256 a431931541fbbd6a25753eaf13a55c9890a257408efbba71ba209677232a27d3
- MD5 88e9184a79d29e4c9cb1655e396119c3
- SHA1 6cf69cdecead19a94d5ffdc67deae5f3e3218c49
- SHA512 1abcb88fa81e519ba5c7874190afb7dfd2ccbfa7c26c09b715cca55175fc8cadde90fbb625834bfea33f8a2da0ed30923f5ccf7889a1253ddd1ff0488fac3ce1
- SSDEEP 49152:A3k03kHRJARJ5qJtb2IEeW4SkZP4sz9MbH:A3k03kHR+RXFfkZcH
- TLSH T14BB53B16F6788362D0B3C0B9C5D6AA5AFA3234465B308ACB0345D72C2F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/4296-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c53c-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4296-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2540-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019df8-1254.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b6e0-1892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00060000000064b6-1983.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c53c-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x0004000000019df8-1254.dat aspack_v212_v242 behavioral2/files/0x000200000001b6e0-1892.dat aspack_v212_v242 behavioral2/files/0x00060000000064b6-1983.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2540 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4296 2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2540 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_88e9184a79d29e4c9cb1655e396119c3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4296
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 a431931541fbbd6a25753eaf13a55c9890a257408efbba71ba209677232a27d3
- MD5 88e9184a79d29e4c9cb1655e396119c3
- SHA1 6cf69cdecead19a94d5ffdc67deae5f3e3218c49
- SHA512 1abcb88fa81e519ba5c7874190afb7dfd2ccbfa7c26c09b715cca55175fc8cadde90fbb625834bfea33f8a2da0ed30923f5ccf7889a1253ddd1ff0488fac3ce1
- SSDEEP 49152:A3k03kHRJARJ5qJtb2IEeW4SkZP4sz9MbH:A3k03kHR+RXFfkZcH
- TLSH T14BB53B16F6788362D0B3C0B9C5D6AA5AFA3234465B308ACB0345D72C2F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
- Size 2.8MB
- SHA256 0113f675a306251f2bd3f4052069bdc54f98194290f84568b647df0d36d017fc
- MD5 ff8348596c4ea9610aed914110f53cb1
- SHA1 9b716ae273f93c7f4e9eb05b9a794368632aac91
- SHA512 1759cd9ac904b4cb94de1e93d65f3a941dc895169b56c3a0a4ad119ce7b5b730e8331782413643bd7c603f194fdfe83f137655ad8b4877969631aedb2a24d65c
- SSDEEP 49152:A3k03kHRJARJ5qJtb2IEeW4SkZP4sz9MbvmWD:A3k03kHR+RXFfkZcvmW
- TLSH T168D54B16F6B88376D0B3C079C5D6AA5AFA3234465B308ACB0345D32C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 7dc3469deff8f47645e41474a5bcfefd4cdc63de09bf35d6738430b26aedc80e
- MD5 3979befb83d4b8064cbb1924a23a45f5
- SHA1 7fcfce8b617a6c32c9afab7205901265729db9ad
- SHA512 d9199fa09179cc47dce5a5582e024512bf84b396843bb1d6869c6e79aca3846e9b7192904e9fc40212462d1339a0a29dc0266ffa686d93c462c6915ded5969d2
- SSDEEP 49152:A3k03kHRJARJ5qJtb2IEeW4SkZP4sz9MbCPji0Aj:A3k03kHR+RXFfkZcIjo
- TLSH T101D52916F6788372D073C0B9C5D6AA9AFA3234465B308ACB0345D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
- Size 2.4MB
- SHA256 51d8607b400b28038aaf62a6d78d4e1679997dbf8d56fbdb42cec21ef322d7ca
- MD5 0ec4725354d47e79cd36337913ce3037
- SHA1 d751abe32ff996d457280a58c073b2c05d2b2580
- SHA512 5b318d60468e8a289c2e9ae3e90b07c9ff649a70be1c13c2f61e73db6309fecfcfa6158ed44537c184e97d6aa4aef8e4d7383fe04e188d9a4a872e361e185809
- SSDEEP 49152:A3k03kHRJARJ5qJtb2IEeW4SkZP4sz9MbS:A3k03kHR+RXFfkZcS
- TLSH T171B52B16F6B88362D0B3C079C9D6AA5AFA313C4557308ACB0345E72C2E377D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.7MB
- SHA256 bbb6ff01eecacb4d05b61298055a53d87f41bb6a20972ca5074dabc75ee41319
- MD5 2f01483e8b42dedfc019e83e3ff8890c
- SHA1 3a94704f560de83dd1c29312c880b3ff29760377
- SHA512 12581c58272cba3cb6aa4291948bb412c252c375512fff00cbcc541a64d0653c3bde00779a0adfad8d3f51a567430dfe4c458afe1c0ff6b939e23de16f0085a9
- SSDEEP 49152:A3k03kHRJARJ5qJtb2IEeW4SkZP4sz9MbJXpiMh:A3k03kHR+RXFfkZchpig
- TLSH T160D53A16F6B88372E0B3C175C9E6A656FA3238415B3086CF1345972C2E376D1DA3A736
- MD5 SHA1 SHA512 SSDEEP TLSH