Analysis
- max time kernel
100s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 09:50
Behavioral task
behavioral1
Sample
2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.5MB
- Sample260731-ltyyjadr21
- SHA256 3c63bae7b1df86ba8e5afdd8bfd904735e17e467a42f0c188f08fad41def28b2
- MD5 04ef7b9ddb2d74aa5cf115b3983d60b5
- SHA1 d465c607a286a59115ce4341018b2a14d1ca6109
- SHA512 d0b68f11f992cfe4408645616764c0a5b96bcddc00df9f19669a54d52784fb51be96e8a468a7259b35e9c48dadd09e0cd01965874a4cad95f2d28c8c25e676f0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape3a8D5jcAkSYqyExZe0p4Ek4niOh:A3k03kHRJUpYqLeW4SkZP4sz9Mbq56r9
- TLSH T1C3C53916F6B84762D0B7C079C9D6AA56FA323C410F308BDB0345BB282E377D59A35726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/3836-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024580-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4540-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3836-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4540-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216fa-1252.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00170000000006d1-1707.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024580-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x00020000000216fa-1252.dat aspack_v212_v242 behavioral1/files/0x00170000000006d1-1707.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4540 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$ 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3836 2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4540 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_04ef7b9ddb2d74aa5cf115b3983d60b5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3836
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.5MB
- SHA256 3c63bae7b1df86ba8e5afdd8bfd904735e17e467a42f0c188f08fad41def28b2
- MD5 04ef7b9ddb2d74aa5cf115b3983d60b5
- SHA1 d465c607a286a59115ce4341018b2a14d1ca6109
- SHA512 d0b68f11f992cfe4408645616764c0a5b96bcddc00df9f19669a54d52784fb51be96e8a468a7259b35e9c48dadd09e0cd01965874a4cad95f2d28c8c25e676f0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape3a8D5jcAkSYqyExZe0p4Ek4niOh:A3k03kHRJUpYqLeW4SkZP4sz9Mbq56r9
- TLSH T1C3C53916F6B84762D0B7C079C9D6AA56FA323C410F308BDB0345BB282E377D59A35726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
- Size 3.0MB
- SHA256 ab2a1ceadc7c4cc74f1128d11a0b9aaf003dc91b361ac59e80864793e7a7c055
- MD5 e3fcf6fd1a7e37ad411eca14fadd9dd0
- SHA1 6c16b05a760859ec1902d458ce8457354a507c3d
- SHA512 3e880c8659aaeb39d981748be88a00055d9c297c83f64e53334c3a51364ee9c5523cd6c4cce4efa6176f504f48b39677b263eaeb8ddce45324ac283793723a7a
- SSDEEP 49152:A3k03kHRJUpYqLeW4SkZP4sz9Mbq56rQT9t2:A3k03kHRm6YfkZcHrG2
- TLSH T1BDE54A16F6B84762D0B7C075C9D69A56FA323C850F308BDB0345BB282E377D59A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.1MB
- SHA256 7470235acd310f839ca97b199ba188ae53e5d40fbdfb3e7ee12eaf78c9922798
- MD5 0f090d0a805a225546104ce54b149a46
- SHA1 2db4de0056b2e4d85cd20c8796bf8b8c5d779d65
- SHA512 b6d9df230e831e287de74cbc97843d1c5d30ce0eafaf0b97c9d83bdc257d56b685962613c92784b76d1e61d85ec11e9d5e5fc0f27ac466be9b8320584868a162
- SSDEEP 49152:A3k03kHRJUpYqLeW4SkZP4sz9Mbq56rJPji0Aj:A3k03kHRm6YfkZcHrpjo
- TLSH T139E52916F6B84762D077C079C9D6AA5AFA323C410F308ADB0345FB282E377D59636726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.6MB
- SHA256 2d771d38720526a7399677231bc3c7c0aab21e56e48bfa147b7a2f25d577f72c
- MD5 13357779372dec626a879029974e69b4
- SHA1 61e52689f075cdf28c62f0e672097a4927d4e459
- SHA512 755cb9766acdfbc2747c70f307c5625eef1b176b2fadc6c5726ddfb926a8ae191da32fc0785adbc61729ec90bc535a9cdd3138107aa24304305363b0d6aae2b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape3a8D5jcAkSYqyExZe0p4Ek4niOn:A3k03kHRJUpYqLeW4SkZP4sz9Mbq56r7
- TLSH T10CC53916F6B84762D0B7C075C9D6AA56FA323C810F308BDB0345BB282E377D59A35726
- MD5 SHA1 SHA512 SSDEEP TLSH