Analysis
- max time kernel
117s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 12:19
Behavioral task
behavioral1
Sample
2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260716-phancacz8l
- SHA256 8bf12b50d0feef5627783e5d768a5260bb33aa8be7777a0f648c6475c29f14f6
- MD5 014f7bb3073813ed812461c9ab5934dd
- SHA1 aeae728b191635707b0ed22f7e770245b881ea1d
- SHA512 55def4dff08080103e6a5a890266b67b200e686f2b7165b1dfa4f4947897cfc345fb3dc63627e9f3eda0627b9c67a04cf52b1d8ef123c77e774326fb564e0aed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapef6okD:A3k03kHRJJ
- TLSH T190354807E69400E9D10E8174D7964A22FA777C5217E092CB13D4E63D2F72BD0AAFA397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4840-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5c5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4840-87-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0010000000019ea4-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f000000019cc8-1129.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9a-1272.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000000137-2173.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5c5-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x0010000000019ea4-897.dat aspack_v212_v242 behavioral2/files/0x001f000000019cc8-1129.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9a-1272.dat aspack_v212_v242 behavioral2/files/0x0013000000000137-2173.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3720 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\UndoFormat.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4840 2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3720 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_014f7bb3073813ed812461c9ab5934dd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4840
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 8bf12b50d0feef5627783e5d768a5260bb33aa8be7777a0f648c6475c29f14f6
- MD5 014f7bb3073813ed812461c9ab5934dd
- SHA1 aeae728b191635707b0ed22f7e770245b881ea1d
- SHA512 55def4dff08080103e6a5a890266b67b200e686f2b7165b1dfa4f4947897cfc345fb3dc63627e9f3eda0627b9c67a04cf52b1d8ef123c77e774326fb564e0aed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapef6okD:A3k03kHRJJ
- TLSH T190354807E69400E9D10E8174D7964A22FA777C5217E092CB13D4E63D2F72BD0AAFA397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 963a77652292d93947510ce6d2269b4c238e515dc378efe7d0b9d1a351a11acb
- MD5 8979200799401692835b554c8d4725f4
- SHA1 28e1946b8051a56a344fe3fc6f5c965b8c765949
- SHA512 20fc7136d8ecdb32ea6ee72d5c78209383e1a679225271f38db99e604087183c02b1cb695dee479be28c61db41fdfcc7757a663681f5835819fd49ea64dd6786
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapef6ok/0Le5ji0hmxNrM:A3k03kHRJ1Pji0Aj
- TLSH T101755B16F6A402A5D06EC078C7D29656FA73384217F086CB13D4D63C2F63BD19ABA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1.1MB
- SHA256 bbf6783b4034d6681e94184aaf656b9f47b50c3021d5c302aa420d3f1e425000
- MD5 fd2e8ddf0a1c315eedae66caf5cab66d
- SHA1 4575a205b0de0df8e43e74c48f8f12d6d475a2cb
- SHA512 e3c697edbe99322b9b7404b3e17511dfd8a508f8aedbb76cce240cb0179d1214f50dd73954986011ba867d3a10b68c67b75795e15a9d15238071a8ec1ee781de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapef6okbF:A3k03kHRJP
- TLSH T171454902E69400E5D64E8130DB968A12FA37BD9117E096EB13D4F63D2F327C0AAF9757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$
- Size 1.2MB
- SHA256 45223709e00bbb5c7d09a0b2da0a51c1429a435888b8e0af9bfaa7e5666e5d86
- MD5 db0c014abcb3c93a83bb73effef65722
- SHA1 a81faf56782fbed743d6d5f42e45044528700af7
- SHA512 c8e7b65ea46e494d8923746da348f9f724b054a2f4684dbbf08ee59ed0db1fb7b8d951d6aea800a8af628a005e79fa6e207bd5d41fc1359c0fd535cd8592acfb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapef6okDGq9:A3k03kHRJUi
- TLSH T18F454806E69400E9D11E8174C7969A22FA37BC5217E092CB13D4E63D2F727C0AEFA757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$
- Size 1.5MB
- SHA256 6dcce26e2104a387a8192a78d4b1acc57fa8a7f09d30373b4bec1975a828bb0a
- MD5 657efcdef962ab2f81eedc1d8d20b03d
- SHA1 c59c2ec1592b0383e0bbdf38032690cb5f313bc2
- SHA512 4afbe76849103de19de81a9754cbd2805c369c6a2bdc87da567fb2919e88b00dc06778a6167b9b03ad83809c6c1d05ffd79914a80b3f4161b3b397d8c99611a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapef6ok61owkWu0ya:A3k03kHRJc1lkWu0ya
- TLSH T14E652902E7E500A5F1AE8630DBB59612BA77BC611AE1C2CF13D4D53D1F32A809EB5763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$
- Size 1.1MB
- SHA256 fc5c246960440124fd8aeb3a837888f9c1666d1f7ce56f4fac9c833f065850fa
- MD5 74eafd4779fe6ed6b27d733ec42f092b
- SHA1 da3d503cf07f8226a68c43e25ba2221135e96b4d
- SHA512 dc04fce5e7fc64adcd628e955ed7222a616010c88f432b10a330aa49c4b4279a2a89da300fab7a3c037432d8e114826d91f6aef48674a8d7ed078e5518eae422
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapef6ok52:A3k03kHRJ6
- TLSH T1E5354907E69400E9D10E8174D7958A22FA777C5217E092CB23D4E63D2F72BD0AAFA357
- MD5 SHA1 SHA512 SSDEEP TLSH