Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 21:28
Behavioral task
behavioral1
Sample
2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe
- Size 2.8MB
- Sample260801-1blmtax1cs
- SHA256 bbc5f30819aa482041de91fb267f47ad2b77d29def7d0f9a034b26fc123872c6
- MD5 47918d7d2c2d3e6d6ad7b10d3feee0a1
- SHA1 45bef87d3b0e0dad11f2840390da25f363c076d8
- SHA512 7b911ad10e060e21662e3eb4a8caab3ad0d274dfd8f26831a5338cf1431f48484b57d3ed1772e36a7334a2cc51f3f16c9c47c6a24100360bb4418ff69a3ec634
- SSDEEP 24576:1IQVOxcXlYjboGxZqwijaahIJpXZ96H0c5jcAkSYqyEMYTqMi8CtBd2QHCHmTBWO:rXlYvoGxUSJpXKHzpYqjqJtb2IjpYqV
- TLSH T19ED54A15F6B48271D073C0BAC9E2A75AEA7238415B308ACB1385A76D2F377D5C936732
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wscript.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\format.com- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\instnm.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\mode.com 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\mshta.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\reg.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\format.com 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe -
resource yara_rule behavioral2/memory/4428-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x002300000001c2ca-5.dat upx behavioral2/memory/4428-845-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4428-2918-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\r\InputSwitchToastHandler.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\unlodctr.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1150_none_51a2aa17b537a668\r\svchost.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.26100.1150_none_bf072f41973cb733\XBox.TCUI.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.26100.1_none_f151d0f42c5c742e\comrepl.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingShell.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\r\bdechangepin.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.26100.1591_none_7622b05853a7428c\BitLockerDeviceEncryption.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1591_none_19bc1d299dc8c2e1\r\LaunchWinApp.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.26100.1_none_3dee2da03b86f50d\SystemPropertiesHardware.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vaultcmd_31bf3856ad364e35_10.0.26100.1_none_e3755908c2899c00\VaultCmd.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-makecab_31bf3856ad364e35_10.0.26100.1_none_f817d499062c355e\makecab.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.26100.1150_none_88a9016fd4655cfd\DisplaySwitch.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFaultSecure.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.26100.1591_none_e980cb58b559b151\RelPost.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\CustomShellHost.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\wlrmdr.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_824861107299001b\r\imecfmui.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_db09ff29aaa57394\wowreg32.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.26100.1_none_5cdbf1a4c5f9fd2c\runas.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\r\sdclt.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-timeout_31bf3856ad364e35_10.0.26100.1_none_93acbf7363320dcd\timeout.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.26100.1150_none_024e4ac09d98d886\OptionalFeatures.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\CredentialUIBroker.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.26100.1591_none_cfa6fd46757cb5b5\r\dwm.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\setupugc.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\showmount.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\dasHost.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1150_none_830db7779a4e1286\r\openfiles.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmstp.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\bdechangepin.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.26100.1_none_a454f54474148daf\dpnsvr.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\r\readCloudDataSettings.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_556624dcc06d0b8d\expand.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\ktmutil.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_e93c3ffc5eae7f6f\autochk.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_db738856a624fee8\help.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\r\msinfo32.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\DeploymentAgent.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_13357425571b7ed9\OpenWith.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.26100.1591_none_09563e96d43be8d8\conhost.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\r\fsutil.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.26100.1150_none_8b65f13ba864c9e1\sysprep.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_4ab0905276b69755\r\CheckNetIsolation.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.26100.1_none_5d765ef408ee3573\tar.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1_none_e76b3de73182bef6\ByteCodeGenerator.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.26100.1_none_713b7d7638176261\TapiUnattend.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_1fb74192d4a9efd6\InstallUtil.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.26100.1742_none_d23b4ab50f085fd0\vmms.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\dcdiag.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\r\IMTCPROP.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevTemplateBaselineGenerator.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.26100.1150_none_1ed5d4d47eca0768\r\wsl.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_10.0.26100.1_none_ed0315824c80c112\fveprompt.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.26100.1_none_b88d2cbd63eb3d30\sigverif.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.26100.1150_none_22d7b78874fa20b2\AppHostRegistrationVerifier.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevTemplateConfigItemGenerator.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\setup_wm.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1150_none_b36c622d6cabda77\auditpol.exe- 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_47918d7d2c2d3e6d6ad7b10d3feee0a1_amadey_cobalt-strike_elex_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4428
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 3.8MB
- SHA256 74301d38c128648e4aca44695d35190fa95638b1db2327e0297a894e04544f6a
- MD5 31c62f4513f4b2d86dc321db9c38f245
- SHA1 d3ea59fd4e70cfaef632c1cc45e73308c96b1168
- SHA512 24eb04d0832b5643178245f44219ed2340ed36d146300cca06c8ca9d78e008a7f09eb5f1da46c58f87441b1a929e3274d6a9a6c8b1aba88e8c6ed581aae0c315
- SSDEEP 49152:rXlYvoGxUSJpXKHzpYqjqJtb2IjpYqu/ezSC6vUzPvMHjyL:rXsRXg62463ezSC6v2XMHW
- TLSH T11D061A15F6B88332D0B3D0BAC5D2A69AFA7234465B308ACB1246D76C2E377E5C536731
- MD5 SHA1 SHA512 SSDEEP TLSH