Analysis
- max time kernel
60s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 03:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe
- Size 4.0MB
- Sample260730-eblrxsbc78
- SHA256 657aeb6f79dea10eb543da0ea8dbeb23ca9fde3b18b77971605047bd5b4b2756
- MD5 2e2cb39a6ef3419d9d4b7162e7977bdb
- SHA1 bbcfaf7902f4faef6c5c01a7b5b63458804939e3
- SHA512 c45eae963c8aa172ef569dad2a418715bc8affb445feefd31e7305a2b7e75a15e86a00a4b253548ccd2d6503f8e520d01bb0026c43d8e2c8d31c7f0d24ed126b
- SSDEEP 49152:NOwqFpYqe1lkWu0yLeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj:N+6D1lkNLfkZcNfkZcRjo
- TLSH T1D9163B16F6F88723E0B3D1B9C9E2AA49FD3234461B3085CF1259976C2E27BD18536736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4100-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00100000000243b1-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1876-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001e4ea-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021e9d-975.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a4-1253.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4100-1538-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1876-1701-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b00000001691b-1870.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001da3e-2110.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1876 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4100 2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe 1876 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4100
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1876
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.0MB
- SHA256 657aeb6f79dea10eb543da0ea8dbeb23ca9fde3b18b77971605047bd5b4b2756
- MD5 2e2cb39a6ef3419d9d4b7162e7977bdb
- SHA1 bbcfaf7902f4faef6c5c01a7b5b63458804939e3
- SHA512 c45eae963c8aa172ef569dad2a418715bc8affb445feefd31e7305a2b7e75a15e86a00a4b253548ccd2d6503f8e520d01bb0026c43d8e2c8d31c7f0d24ed126b
- SSDEEP 49152:NOwqFpYqe1lkWu0yLeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj:N+6D1lkNLfkZcNfkZcRjo
- TLSH T1D9163B16F6F88723E0B3D1B9C9E2AA49FD3234461B3085CF1259976C2E27BD18536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{74A5E9DB-42A6-4629-9DA9-DE27556EBF1E}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 4.0MB
- SHA256 79ad7547d041cd57e4c8aabf7676281b37a3d3c809b2eeef096453a7f9ebb38e
- MD5 99ce0d527b2c9107b015cef803dcf431
- SHA1 0e0b4744cbe1c89178456b40dd83c8158740d494
- SHA512 1bdcc7c5030a2d2f64c04797caa8f70d50269ca099dd76ff467bcfc144cbd39ddc37d31f9d903d6e4b3cecfe5b7f3d6980ad607cec0f096cfb75c4ceb532c14b
- SSDEEP 49152:NOwqFpYqe1lkWu0yLeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj+BPVAU:N+6D1lkNLfkZcNfkZcRjoSBPVl
- TLSH T1C2163B16F6F88722E0B3D1B5C9E2AA49FD3234461B3085CF1259976C2E27BE1C536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.5MB
- SHA256 09209adbd37d231864482a851a0b7f4ffc2efba9d4e8efae3e22153e51fd9055
- MD5 ea491571f53588d7d09ca9c48e42ba7f
- SHA1 d50eb94db9f42a876a1891aa47fbb922ae44967f
- SHA512 6bf47b698a6d0870e0ffe9ffe062ca2eac49b71c0a37dd666dffea523a819150301d74e1ea5bc628c3e0b7e0e2a3e011f6686e1b97506e70cfdffa5531c46031
- SSDEEP 49152:NOwqFpYqe1lkWu0yLeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0AjKPji0Aj:N+6D1lkNLfkZcNfkZcRjo0jo
- TLSH T162262B16F6B88732E0B3D1B9C5E2A689FD3234461B3085CF1259D76C2E27BE18536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
- Size 4.0MB
- SHA256 e94d739e09e9a44b8525a512fb904e7a5c61624605d6dac81c2978bb6b7d04d7
- MD5 5f522a0d7bd294a2610da24f85db5b04
- SHA1 0c6ab386d207a88c1198c8d67f3b0147d08bce5f
- SHA512 3ec49314c33cc304e66dc583fef58bc23472f389b804d0b465967d62193eb3e6fc4ed5729931f2375e6f85b99e00ce98f2c229bfc1116da583073066466eaede
- SSDEEP 49152:NOwqFpYqe1lkWu0yLeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0AjH1:N+6D1lkNLfkZcNfkZcRjoB
- TLSH T11E163B16F6F88723E0B3D1B5C9E2AA49FD3234461B3085CF1259976C2E27BE18536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 4.0MB
- SHA256 bca0afab078ae33d120bf2312a401c24a44153fe5fada8c1dd5d941c38949599
- MD5 271bb7d4035d3b1891646e587e0ec2ce
- SHA1 d8506a8d3e9f358fbf255687a79c24bd0a8c083d
- SHA512 6ee39d70208db940c7a9829366ba5a2c0d37138e34fef949e7b2695058922a2072fac71de933363a7080fe66776564573f63dbe5956d0f335d6b47210efb9878
- SSDEEP 49152:NOwqFpYqe1lkWu0yLeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Ajq:N+6D1lkNLfkZcNfkZcRjo2
- TLSH T184163B15F6F88722E0B3D1B5C9E6AA49FD3238460B3085CF1259976C2E37BE18536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
- Size 4.0MB
- SHA256 4d67d7c8464514358cb814f465cf359af493bd7889a6dc5cb2a7f340b0c03fa1
- MD5 2071b2137caf715c909884221a2100a2
- SHA1 0b6cb527e34c47003f4f579d7020b2ffd22438c9
- SHA512 4910511436ef8082271b246208cf5f205a710333214ec8f9aabe7c1bf73494f11fd7d7f4f6c2d9262a29003057db3d5a2b7b5937f9805c75288c4ee84dbcd3de
- SSDEEP 49152:NOwqFpYqe1lkWu0yLeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj:N+6D1lkNLfkZcNfkZcRjo
- TLSH T12D163B16F6F88723E0B3D1B9C9E2AA49FD3234461B3085CF1259976C2E27BD18536736
- MD5 SHA1 SHA512 SSDEEP TLSH