Analysis
- max time kernel
105s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 22:51
Behavioral task
behavioral1
Sample
2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 4.4MB
- Sample260728-2s2wssyard
- SHA256 efdd7bd3dc8441a14db48d9b9f9c13e4d150bb5d45c84388173d7761ed66633e
- MD5 688a0e8269ba8a97f643d09e4a378fc6
- SHA1 b8f2bf3b91bf3c65eae36ca41d587802d7ccd5fd
- SHA512 0b913c23298f2afb5910c6be7278ceb4f21e5be63051a15b0c8d2495cf79b54e330e7fb78be5dcc9403db9354b2d1c51ad98528629496ccab191b222f615c95c
- SSDEEP 49152:A3k03kHRJs56r856r+qJtb2IdqJtb2IpeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rX:A3k03kHRzrZr+cWfkZcNfkZcBrX
- TLSH T1DE261A16F5788B22D07BC079C5D2AA9AFA333C455F308BCB0245AB283E376D59536736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/624-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024463-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/732-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/624-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/732-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002351f-140.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000217be-1025.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001100000000071d-2062.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024463-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x000200000002351f-140.dat aspack_v212_v242 behavioral1/files/0x00030000000217be-1025.dat aspack_v212_v242 behavioral1/files/0x001100000000071d-2062.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 732 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 624 2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 732 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_688a0e8269ba8a97f643d09e4a378fc6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:624
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:732
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.4MB
- SHA256 efdd7bd3dc8441a14db48d9b9f9c13e4d150bb5d45c84388173d7761ed66633e
- MD5 688a0e8269ba8a97f643d09e4a378fc6
- SHA1 b8f2bf3b91bf3c65eae36ca41d587802d7ccd5fd
- SHA512 0b913c23298f2afb5910c6be7278ceb4f21e5be63051a15b0c8d2495cf79b54e330e7fb78be5dcc9403db9354b2d1c51ad98528629496ccab191b222f615c95c
- SSDEEP 49152:A3k03kHRJs56r856r+qJtb2IdqJtb2IpeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rX:A3k03kHRzrZr+cWfkZcNfkZcBrX
- TLSH T1DE261A16F5788B22D07BC079C5D2AA9AFA333C455F308BCB0245AB283E376D59536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.9MB
- SHA256 2ef13140959b56208af3329b3b62c2a837bbca9893a05763a4dce0f3039a057c
- MD5 841c3e0c936bb97e2d5c3b4290a2f302
- SHA1 807077a986f11fdbee2b98c8173ff43d5c445996
- SHA512 ca349bd7dedfb2b1efd1f084832d943a98e5cc5779c34040def64b6ae76d54aff39425f11333f627499911bd16a1e9f9c374c609795d581380a997cc61e8f93e
- SSDEEP 49152:A3k03kHRJs56r856r+qJtb2IdqJtb2IpeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56ra:A3k03kHRzrZr+cWfkZcNfkZcBrLjo
- TLSH T141360916F5788B22D077C0B9C5D2AA9AFA333C455F308BCB0245AB283E376D59536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$
- Size 4.5MB
- SHA256 10b2d0d5af61bf9fa131c026089f5f9792d3d77d363c366fbabc661e34537721
- MD5 ce9467bacc4b0acfd506fadf9ecf0e07
- SHA1 54de3048a6d80d0372b444b7eaaab2dd8d29d7ea
- SHA512 b221957a8630967d83bb73d49deea9baa049f06de03e831e8f2c5fc3c1669ca8e313a81403d69f4774a10130ce6d243cd96e914dba5ad63998b880ab1f678f53
- SSDEEP 49152:A3k03kHRJs56r856r+qJtb2IdqJtb2IpeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rU:A3k03kHRzrZr+cWfkZcNfkZcBrU
- TLSH T11426E615F5688B62D07BC079C6D2AA59FA333C415F208BCB0285EB2C3E376D59936727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 5.0MB
- SHA256 4747537cfc636b1d96bc4175dbad4b8b27046e886833c3e9c9917fd81d39df97
- MD5 fcaaaec7b940670de9b1e78df9eb0d15
- SHA1 6408dbd2fb2e9530036010eb075d632fcb7a7048
- SHA512 c92419362883e46515e207013563cc25a38ce511a8318f350e4f7f65ae6930df7a656e1fc4d6a47df37485b0a70b2979ebb958affb3599da9412a363c4269d6f
- SSDEEP 49152:A3k03kHRJs56r856r+qJtb2IdqJtb2IpeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rU:A3k03kHRzrZr+cWfkZcNfkZcBrBm
- TLSH T1E0360915F6788B62D07BC079C5D296AAFA333C415F3087CB0245EB293E376D1993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 4.6MB
- SHA256 c9608f85142841bdeca2f1f0469ab9f10a7d2997fe76175de67170e43867844d
- MD5 7046b1f13d7e85a8823766f729ebd03d
- SHA1 609ca766e3fbd2dee112fbbceea43121e3d73e2e
- SHA512 c381dee1f412724ae5f5d63034e86cdba4f16e7c874059d8819d895494aa07edcf2196e05cb0ef21febfb3cedfd3fdf9da5155829bdb25af24891d6ee4a69d2e
- SSDEEP 49152:A3k03kHRJs56r856r+qJtb2IdqJtb2IpeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56ro:A3k03kHRzrZr+cWfkZcNfkZcBrPuX
- TLSH T140261A15F5788B22D07BC079C5D6AA9AFA333C415F308BCB0245AB2C3E376D59936726
- MD5 SHA1 SHA512 SSDEEP TLSH