Analysis
- max time kernel
67s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 15:22
Behavioral task
behavioral1
Sample
2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.9MB
- Sample260727-ssbj6sware
- SHA256 162371e209d46c81b500cb100ced650cf81fc430ab31bc71a9f35f8525b70bdc
- MD5 f39efd5e24d9cf9df7409ea4ec96e764
- SHA1 d0ca4b2db6b2058904f748c176d19c527b014c3f
- SHA512 fe7ff73b480e0e79b0beace6a5735a9273bdf89deb7a8d75b0a7816df0cfc7f65a7cfe1119060bced9349a237fe9574e27266847f9a47c9b0cd00f2c07d6e0f3
- SSDEEP 49152:A3k03kHRJ/qJtb2Ij56rbeW4SkZP4sz9MbKpYq:A3k03kHRJJr7fkZcK6
- TLSH T1DBE53A16F6788762D077C0B9C5D2AA9AFA3238455F308BCB0345D7282F277D1993A736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/3360-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4948-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b000000024390-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3360-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4948-52-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023544-163.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a2-1262.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023192-1766.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000001691b-1914.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000b000000024390-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x0002000000023544-163.dat aspack_v212_v242 behavioral1/files/0x00020000000216a2-1262.dat aspack_v212_v242 behavioral1/files/0x0002000000023192-1766.dat aspack_v212_v242 behavioral1/files/0x001400000001691b-1914.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4948 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3360 2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4948 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_f39efd5e24d9cf9df7409ea4ec96e764_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3360
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4948
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.9MB
- SHA256 162371e209d46c81b500cb100ced650cf81fc430ab31bc71a9f35f8525b70bdc
- MD5 f39efd5e24d9cf9df7409ea4ec96e764
- SHA1 d0ca4b2db6b2058904f748c176d19c527b014c3f
- SHA512 fe7ff73b480e0e79b0beace6a5735a9273bdf89deb7a8d75b0a7816df0cfc7f65a7cfe1119060bced9349a237fe9574e27266847f9a47c9b0cd00f2c07d6e0f3
- SSDEEP 49152:A3k03kHRJ/qJtb2Ij56rbeW4SkZP4sz9MbKpYq:A3k03kHRJJr7fkZcK6
- TLSH T1DBE53A16F6788762D077C0B9C5D2AA9AFA3238455F308BCB0345D7282F277D1993A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
- Size 3.1MB
- SHA256 47b07fb838efd943a75ba1eb90b967002930f5934c247563f9bdf1808ddfb2b2
- MD5 4ba1df9fde8dc187a0700bcc956899c2
- SHA1 59e644b7a4a05551b0eb204b0dcfe3f52fa61876
- SHA512 3fac83c09780e248dd673b13fd03c70506958b46143a368a2422fa5e2010344f11f4c33e844237749c0e4115168514f28b817c63161ba5d6f08122d31a0c7ba4
- SSDEEP 49152:A3k03kHRJ/qJtb2Ij56rbeW4SkZP4sz9MbKpYqdw:A3k03kHRJJr7fkZcK6L
- TLSH T114E53B16F6788762D077C0B9C5D2AA9AFA3238455F308BCB0345D7282F277D1993A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
- Size 3.1MB
- SHA256 d30f064dd388f44bfd624298640c72255a0bb987c1d28720ec99ddd59e392fcd
- MD5 a72641db2a68eeb6bce42d2797389d0c
- SHA1 6af7cda30f03dbc19c22cd1093fedf90eab463ee
- SHA512 eb5f3e1194a0fb1a1cdbc728449453b7fa1c43338f1dbefe8cbafa502c42e9b08a6da4e6d13c4661ec6b9f7cc7b45605a38992df5116bd431aa0c2ad14d69d71
- SSDEEP 49152:A3k03kHRJ/qJtb2Ij56rbeW4SkZP4sz9MbKpYqZI:A3k03kHRJJr7fkZcK6KI
- TLSH T1C0E53B16F6788762D077C0B9C5D2AA9AFA3238415F308BCB0345D7282F277D5993A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.5MB
- SHA256 94ab84524a264fcb6aead60ff2314ed0b5454f90153ccdf80af7c69af860baff
- MD5 1e4e30ce269bbb634f67cbd45d65ab9a
- SHA1 e3fa2e798731a450a0b11cbecaa1845859ee87ee
- SHA512 8a97dc90b6b3821f46b19d96287e2191afef5780dfcafc0553ac12800f8dd062ad6726b6cac1dc16862c35929bd0f6b809580a2eeb9c8f7791c8c915cac6a145
- SSDEEP 49152:A3k03kHRJ/qJtb2Ij56rbeW4SkZP4sz9MbKpYqjPji0Aj:A3k03kHRJJr7fkZcK6Gjo
- TLSH T193F52A16F6788762D077C0B9C5D2A69AFA3238465F308ACB0345D7283F277D5993A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$
- Size 3.1MB
- SHA256 7e9b41f3fe2ea102ae07babfc93e06e2b89738217db056afa0cd76386baa9451
- MD5 0b5facd82b6a694fa7e39b5eec0df546
- SHA1 c81dc5d10c43930ffcbfe9b6fdf12c5f91e971ee
- SHA512 b5a4933383d419011a835df61d541e774a05dec862818341ce5dc5e1d33cd59e2527219a6ad26056de376274614ce808b25236de1ec02e0a898333d9536abfb7
- SSDEEP 49152:A3k03kHRJ/qJtb2Ij56rbeW4SkZP4sz9MbKpYqk:A3k03kHRJJr7fkZcK6F
- TLSH T1D4E51916F6788762D07BC079C6D2AA5AFA3338455F7086CB0285D73C2F276D1993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 3.4MB
- SHA256 ce473a63d327ab3555ad87f67009c03d847e18eba07d20c9e1b0107f24ee8e82
- MD5 f66c161aa2b7c0c3c7d9ec6221547258
- SHA1 eed49d4b7d385065fe6ce88782fed1371b4188dd
- SHA512 b1f3bf3eccca9b527bfb964bafebc179ecf0f2bc5b50644be0f8eb6180c42b80d52912f272578724bb1bb6f2c1589028ccc6ad865fc2fbb53692b6aadf2202fa
- SSDEEP 49152:A3k03kHRJ/qJtb2Ij56rbeW4SkZP4sz9MbKpYqJi6:A3k03kHRJJr7fkZcK6Si6
- TLSH T153F51956F7688F72F06BC074C5D2A669E9323C450BF186CB024EAB282F376D585F5326
- MD5 SHA1 SHA512 SSDEEP TLSH