Analysis
- max time kernel
95s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/07/2026, 04:28
Behavioral task
behavioral1
Sample
2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.9MB
- Sample260713-e3ywkaby8m
- SHA256 f9c2b99e732e4e4066b792fb2e27ed0558a3f23198a1bbf1834740962395a6ac
- MD5 4ab09c20dae3b532cab2cd408d670276
- SHA1 b6501770f47cd12f01c73b923c01f4abb262bc6a
- SHA512 9c3bad3f7f59d0c31c85384ebfa443e5d00b1e42510bcd8402b8ba27869de01dfac4260f9af172821aecadbea983921d771aa48ed1bca5a8645b12ec93e08c64
- SSDEEP 49152:A3k03kHRJzqJtb2IkqJtb2IEeW4SkZP4sz9Mb:A3k03kHRpHFfkZc
- TLSH T109E51916F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/5128-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b6f5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5128-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4600-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a626-1004.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b000000019cef-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb3-1272.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1426.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000f0000000188c1-1428.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b6f5-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000300000001a626-1004.dat aspack_v212_v242 behavioral2/files/0x000b000000019cef-1005.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb3-1272.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1426.dat aspack_v212_v242 behavioral2/files/0x000f0000000188c1-1428.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4600 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe - Drops file in Windows directory 31 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5128 2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4600 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_4ab09c20dae3b532cab2cd408d670276_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5128
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.9MB
- SHA256 f9c2b99e732e4e4066b792fb2e27ed0558a3f23198a1bbf1834740962395a6ac
- MD5 4ab09c20dae3b532cab2cd408d670276
- SHA1 b6501770f47cd12f01c73b923c01f4abb262bc6a
- SHA512 9c3bad3f7f59d0c31c85384ebfa443e5d00b1e42510bcd8402b8ba27869de01dfac4260f9af172821aecadbea983921d771aa48ed1bca5a8645b12ec93e08c64
- SSDEEP 49152:A3k03kHRJzqJtb2IkqJtb2IEeW4SkZP4sz9Mb:A3k03kHRpHFfkZc
- TLSH T109E51916F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 2.9MB
- SHA256 ead39703d4b0cbc34b7156b4d3bf96643f5aa48c45fb366c4784d2bcddbe142e
- MD5 abb46e1ed4622952ad23b9bce623320d
- SHA1 8711123ea0bb65de630d577f89d0e7c9d6ffa866
- SHA512 7f60821296b51f4f0ad204dc05b45e0b72b730bedaa56386b0be1f728a987ba6af2c82326fb8962b81c4ff4992801a751b810da95c10baef74f50f5baf98866a
- SSDEEP 49152:A3k03kHRJzqJtb2IkqJtb2IEeW4SkZP4sz9MbP:A3k03kHRpHFfkZcP
- TLSH T1FAE51916F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$
- Size 3.3MB
- SHA256 6640be68ad88a0a880d3a432f59dd1bb59b0b073be65a1fa6006447d8b055a3e
- MD5 692543f68af8b0e2e02afb915f785451
- SHA1 b7ecaede8ee31a3291462e4b5cdadcccb617a2d0
- SHA512 d4672cd2b34d6ed1b22a6eb4eb404faca8b6ac73fa493166371a4f354f289d8aba8694214b8ddbcbff63c6fd88d3a9339480440b97726cb370b742445aacabe5
- SSDEEP 49152:A3k03kHRJzqJtb2IkqJtb2IEeW4SkZP4sz9MbR0Ia:A3k03kHRpHFfkZcCI
- TLSH T130F52A16F6B88362D077C079C5D2AA9AFE7234465B308ACB1345932C2F277D5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.5MB
- SHA256 db1f006a8384bfffd722a3eac1528724dd54ad7d3190daf5e71796e0b5431df5
- MD5 89e5eaaa0349543934a7bd846b90f1e4
- SHA1 cccfd414ed93ae5c46ad1d8f0b3529eec7ffb913
- SHA512 fe607157e37a9665b8cc092c0a0a9a5ef07b8d803e9ce9e3ea6198b1da8ad3cc6e8907aa8496e731ea034aee684b3ab81fae0af41e6cf8e56aebfd3cccb47280
- SSDEEP 49152:A3k03kHRJzqJtb2IkqJtb2IEeW4SkZP4sz9MbdPji0Aj:A3k03kHRpHFfkZcdjo
- TLSH T1EEF51A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D76C2F277D5963A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 3.0MB
- SHA256 dc929a8fa0d135ceada79783724f4c44982dfb8ec462baa4d02b6988c58eda17
- MD5 d83f7cf71bdff5be45e247263709eb5b
- SHA1 3317ffc582fa84f34a7b69967f24e1e665d668bf
- SHA512 b59181838ba312a2208d0ea7419a58f0abb86ddb0ce1f7ab9c5e016c17927ab0edaeece86a81ca9853334b10332e3a3f207b8fb462ed4d7c9d6e9ce33cd02f72
- SSDEEP 49152:A3k03kHRJzqJtb2IkqJtb2IEeW4SkZP4sz9MbH:A3k03kHRpHFfkZcH
- TLSH T1FBE51A16F6B88362D073C079C5D6AA9AFE3138425B308ACB1349E72C2E377D5953A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 3.0MB
- SHA256 68e6d956f902afbc387029fc3f1839b511a34f0d9c51dd61ec4a8e67a3838155
- MD5 9e6d437f6401da3a53b1d1097b946ff2
- SHA1 5c0c195d6c5b9d4eca1d601f64aafd119618e833
- SHA512 6ea58a474194018be9cfefa7f63da772824926ee91f45c24624995e5cbf3f3c6dcb135c46fc273de5dddd2f0b48c9fe98d983a8b48a7f99eb2ea60f68d872429
- SSDEEP 49152:A3k03kHRJzqJtb2IkqJtb2IEeW4SkZP4sz9Mby:A3k03kHRpHFfkZcy
- TLSH T149E51916F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$
- Size 3.5MB
- SHA256 81fac784f2d601e29c405d14a6d1c0c7a8561f4f2ae4ec51c056e7ffecff94ac
- MD5 45f8088c6998c7ad96cebe49cc51487e
- SHA1 53982776cb208b12ff555f0890a7ff78b1ba10ef
- SHA512 4de31de07e69bfba11095df86f9b609cbda324db60357ebf41c88621743695ad844a01594b8618b7c66ec8303d9e5111e002c8afbe31c2ce7ad1e25526d39faa
- SSDEEP 49152:A3k03kHRJzqJtb2IkqJtb2IEeW4SkZP4sz9MbH8tDZqrKV:A3k03kHRpHFfkZcHm
- TLSH T11EF53B16F6788372D073C079C5D6AAAAFA7234425B308ACB1345D32D2F277D19A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH