Analysis
- max time kernel
80s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 14:12
Behavioral task
behavioral1
Sample
2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260802-rh9tjsvbpe
- SHA256 2eaace167ac021578f75c09e8606e091f4b18238cde7b40cb220dfc5e3eb1616
- MD5 7ad51d0a71713ccc2f98451ac17cda1d
- SHA1 805ee25c644a8a102ac1be6b8ea87d6f135c593d
- SHA512 008d4e0ff40c1da8ba765cc8c1e1dd8a7a7cf74efb6cd6b16169522b5d3b059effcbc42b8c74b21501dc168a4ca8c3025b346044b6269ceaf4e49996baea2d9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6Tb3zD5Tvinrmb:A3k03kHRJARJR56r
- TLSH T1CE456A07A6980FE8D11F81749A964A22E7777C121F2097CF1354AE163F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/4212-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243c7-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1880-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4212-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1880-35-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243cb-125.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000227f3-1535.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00130000000006d1-2063.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243c7-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x00070000000243cb-125.dat aspack_v212_v242 behavioral1/files/0x00020000000227f3-1535.dat aspack_v212_v242 behavioral1/files/0x00130000000006d1-2063.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1880 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4212 2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1880 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_7ad51d0a71713ccc2f98451ac17cda1d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4212
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 2eaace167ac021578f75c09e8606e091f4b18238cde7b40cb220dfc5e3eb1616
- MD5 7ad51d0a71713ccc2f98451ac17cda1d
- SHA1 805ee25c644a8a102ac1be6b8ea87d6f135c593d
- SHA512 008d4e0ff40c1da8ba765cc8c1e1dd8a7a7cf74efb6cd6b16169522b5d3b059effcbc42b8c74b21501dc168a4ca8c3025b346044b6269ceaf4e49996baea2d9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6Tb3zD5Tvinrmb:A3k03kHRJARJR56r
- TLSH T1CE456A07A6980FE8D11F81749A964A22E7777C121F2097CF1354AE163F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 1.6MB
- SHA256 683f41e1ce5105a5691c759066aedaa0490f388ccc02e1004ba5e68fbe8d033d
- MD5 74cfdc92a73902067c555aa4238e2c5a
- SHA1 ee636c0c4941351de18f386b56b03251ec94611c
- SHA512 3d0f0292352036e2a288f4bb9cb76b8ff5b1252d4eb482f5397659e163af9bb9012c17ce81834ee2ac98bed80bb3623498af6a6da8bd566661de31cb3392c069
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6Tb3zD5TvinrmbT3Td9CHKy7GZO:A3k03kHRJARJR56ryTd9CHKyao
- TLSH T147756B12A7980AE8E16FC23489A64522E7777C561F2097CF1354AE193F337D09E39B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.7MB
- SHA256 b5ade99024b2f64dfb4c4fcebcd3a435a72015e43d347c745ce5793a0cf27211
- MD5 64380a92d42a8a5fd05031a6ec6b6e12
- SHA1 1d31a569bd3029a3b1e0be22e6af841081f3a7d5
- SHA512 86ba574651261682fbcb9c896ffa4ce60223b290ed8609f7140cb67a3c523d4dea7fe96a306bfd195f04957260b1b5c5a20b316e395cbc4d5428701b989ec77e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6Tb3zD5TvinrmbP0Le5ji0hmxNrM:A3k03kHRJARJR56r0Pji0Aj
- TLSH T1C1855A16F6A84BA5D06BC178C5D29656EA733C421F3087CB03549E293F37BD19E3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 1.3MB
- SHA256 1495d67524b3d0adc1a211e5108130ff8f34a1e0fb819a71064ffdf10218ff58
- MD5 1d851d53648cfdc9783833c7ecc56449
- SHA1 c937f546a4791ffb4a0f62a9e49f537951025423
- SHA512 349d11950d853f9955e55f49bd466b817b76fe210093b0ba9322aff292aff4d3a8f18413c56b462c69c86861c7a5785eb7b31c40f7b3450134b9e212500ad3e8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6Tb3zD5TvinrmbkD:A3k03kHRJARJR56r5
- TLSH T1FB550506E6980AA8D15F8174C7964622F6777C124FE093CB13D4EA3D3F72690AEF9253
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.4MB
- SHA256 6bd179c505cd209627e9174e60a3c35d0ebbdbf46462187fd5f6d32713715eb8
- MD5 c1121a5af1c7b4642d58cd686dc377fb
- SHA1 11e2c648be1a2c00a9fcbdb22d2952bd5575a2a2
- SHA512 42fdf06a08890fbfe87e6efaf7c928c4bba7941ea52992cf209b2ef65ca16adee0af4aa66728ab7724631037375860493463c8c97f1ef10a4865d606cf736839
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6Tb3zD5TvinrmbLV+PAk2hMH3:A3k03kHRJARJR56rOi2WH3
- TLSH T1CC658D23B6980EB9D11F813499A58526E7777C124F2193CF1354AE1A3F72BD0AE3A353
- MD5 SHA1 SHA512 SSDEEP TLSH