Analysis
- max time kernel
88s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 13:21
Behavioral task
behavioral1
Sample
2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.3MB
- Sample260712-ql6qmacw7w
- SHA256 7626bc3fb43fda50f1ebd8ef5798a7d75b7a78abfe5ddc9f0f7644881fa5ab88
- MD5 4b9589f25676c2465e0523b2fe36b85c
- SHA1 e1abbeb7d7eabb0214e5992631e76f8ea80f8af4
- SHA512 092240e0dcf08bd19186d653cb61be0835f67d238fa667d36552a40556de3b0070601960a37300027223839d56eabd50ab443dd316091047c6a8fd7e1be45ce1
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsbaWZ0Le5ji0hmxNrM:x7iw22Pji0Aj
- TLSH T11D553917B6A84661E073D174C5E6964AEA72B4451B3087CF02A9CB3C2F27BF1AD39731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/2284-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c585-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c58a-38.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c588-32.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2284-189-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4516-256-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001999b-584.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019997-586.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0040000000019997-1027.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a37f-1026.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c9e-1294.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c585-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000d00000001c58a-38.dat aspack_v212_v242 behavioral2/files/0x000d00000001c588-32.dat aspack_v212_v242 behavioral2/files/0x000300000001999b-584.dat aspack_v212_v242 behavioral2/files/0x0003000000019997-586.dat aspack_v212_v242 behavioral2/files/0x0040000000019997-1027.dat aspack_v212_v242 behavioral2/files/0x000300000001a37f-1026.dat aspack_v212_v242 behavioral2/files/0x0004000000019c9e-1294.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4516 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2284 2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4516 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_4b9589f25676c2465e0523b2fe36b85c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2284
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.3MB
- SHA256 7626bc3fb43fda50f1ebd8ef5798a7d75b7a78abfe5ddc9f0f7644881fa5ab88
- MD5 4b9589f25676c2465e0523b2fe36b85c
- SHA1 e1abbeb7d7eabb0214e5992631e76f8ea80f8af4
- SHA512 092240e0dcf08bd19186d653cb61be0835f67d238fa667d36552a40556de3b0070601960a37300027223839d56eabd50ab443dd316091047c6a8fd7e1be45ce1
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsbaWZ0Le5ji0hmxNrM:x7iw22Pji0Aj
- TLSH T11D553917B6A84661E073D174C5E6964AEA72B4451B3087CF02A9CB3C2F27BF1AD39731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 079716d7cd443323533e3486286bfe723306102782b4ed66acd29d45edda6eff
- MD5 5250f36b81398a32d3ba406519be48b3
- SHA1 aac4f8aae8cb589759c5ddf24d427e883c2605f0
- SHA512 12ce403ef96123241383aa07d17d0ae254ec894379ccf29189fe53a8d1e962d1f676e1eed52e34051b712f3b96cf1e7b774f57d48b76036fb3452418da4376e5
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsbaWZ0Le5ji0hmxNrMD0Le5ji0hmxNrM:x7iw22Pji0AjKPji0Aj
- TLSH T196953A16F6B84761D073D079C5E2964AEA7274461B3086CF0299C73C2F27BF69A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.3MB
- SHA256 9e84ed78c9ebabb4d7c6a1705555488d0a9ed24c255bf473fac03c4eb21df3d3
- MD5 8f59a2af4634e16ec4733ce79c9a5f7a
- SHA1 61153d8b16d64b7e77d92ae6f07ddba118f9ad83
- SHA512 54cae369928ffde91341b2b7a2cc85f6fdbcd78f47d239ffb5da3dce1f5e576d44133ff06d6c3786912f1f30af083e0bb69de20d73a0d116031b6b8ee1714224
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsbaWZ0Le5ji0hmxNrMVa:x7iw22Pji0Aj
- TLSH T1E3553917B6A84661E073D174C5E6964AEA72B4451B30C7CF02A8CB3C2E27BF1AD39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 2.0MB
- SHA256 32f956e0c636dc596452e10ffe12e84147aaab4069fa53e9c10af401500321bd
- MD5 5932d8c19d08ab3b201a36e469209f64
- SHA1 e49dfb9c5ee66414c1711cbd7ce4d96c74e918dd
- SHA512 ef318cdc9700781be253421ae463955186344d05713f7eb8fccd324cad22cf4f6249e1e9743b5fac77431d96eedfeef7d3799d746ec018727814050d19e9ce84
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsbaWZ0Le5ji0hmxNrMbVbqPb88hv/l+7:x7iw22Pji0AjqVO88hXl+
- TLSH T140A54A16F6B88661D073D079C5E2964AEA7274421B30C6CF0299C73C2F67BF59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 1.3MB
- SHA256 fdd95ac1a267e3ab33160c1829599b82cbb1b60b368d27339fdef45fb1a06194
- MD5 ae5d94b2b1cf5fd4a3ca55eb80244aea
- SHA1 ebb05faeaaaf9fd4eeac49ec8bc8f6e3712e8cd5
- SHA512 b56e89824d0e38b89cd93b2cc56db5f1c992eb01fd1f61bbd4557f4893511740768169c1b6e0129a6c9a941f6deaa8c35638da80389fc842efcbcb7a3a56233f
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsbaWZ0Le5ji0hmxNrMX9:x7iw22Pji0Aj+
- TLSH T110653917B6A84661E073D174C5E6964AEA72B4461B3087CF12A8C73C2F23BF1AD39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$
- Size 1.4MB
- SHA256 aba331f0cdcfd8a66fcaaa780e3c408cb4b2ae27e9031c082bed80995f870bf3
- MD5 07b7db2c052c3e9122d5475bf4f5d23a
- SHA1 499b52a149c702701a08bcf3d1415ebf4190fd37
- SHA512 20be52958e64ea9af8ce002fd64acff4adfccc8fd1d9f9d3a5b1f6bd69d51180718af1a6c392f9dffdb7d7aa33109d0311cd27620aaca32b1850fa0f477b429f
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsbaWZ0Le5ji0hmxNrMPf2a9:x7iw22Pji0Aj+7
- TLSH T1C7652917B6E84661E073D174C5E6864AEA72B4451B30C7CF12A8872C2F67BF1AD39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 1.4MB
- SHA256 ad1455d6496c741f7446117802bb20a229431c364d9b76432c0fc98642b4c03a
- MD5 f6cc38fe2ee998ab63ebd1d9bb0ebbbc
- SHA1 2c015f5847b17b3817787bce30ed85cc25ab33ee
- SHA512 5376752df1cd8e7309064525bac590800b1f98b6c5a2e225519da41a5846075bf14cbf6e891abc4d0641773aed193527bc77e531dee3e90ba0eba490a2e39fec
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsbaWZ0Le5ji0hmxNrMuwE:x7iw22Pji0Aj7
- TLSH T1E6654A17B6A84661E073D174C5E6964AEA72B4461B3087CF02A8C73C2F63BF1AD39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$
- Size 1.9MB
- SHA256 78985f2afb36994bda6124d2c60db9af21340b44e7263970ae93682fc572d845
- MD5 9e9a4b3fa3f96f05ec90f9033c8d5d47
- SHA1 dd28f7d944252815277588f8926d0200d3aeaede
- SHA512 6612fe82858aeca3264191a89bc1715c7518930b43e7d5a795fb8e05b1cefdae37a00c4622fd8cef31c0daa597d9294f490efa7af97ef2c0e716938f71e2fec3
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsbaWZ0Le5ji0hmxNrMR3N+tCn50ChWdArKV:x7iw22Pji0AjW8tDZqrKV
- TLSH T168953A56B7A846A1E073E174C5E68676FA72B4450B3087CF02A4C72D2F37AF1AD39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.4MB
- SHA256 c38a847b9bb9d774f0ae81fc2d1bfd0260534d9c216c397950116632394225ad
- MD5 d7f40c216c6b99330dad19759b46b0b6
- SHA1 13a881106fc4e636b42324a592d603accf3d58a5
- SHA512 6036744133cab036949f68849d89f34f45820d5550bddefd0833334899e711cd0c0e5aef9fbb6d8f12c43fc304d8bfe960841d3f11f8f810725f08705c48be60
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsbaWZ0Le5ji0hmxNrMPF:x7iw22Pji0Ajq
- TLSH T16A652A16F6E84661D0739134C9E69646EA72BC850B3086CF1268F73C2E33BF5AD39725
- MD5 SHA1 SHA512 SSDEEP TLSH