Analysis
- max time kernel
102s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 16:14
Behavioral task
behavioral1
Sample
2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.2MB
- Sample260802-tpzy2ace42
- SHA256 bf26920593c8e41340fd6c314a1f2351f63b4b478d65d07435e2cf9943c9fc28
- MD5 efb8d3552bb8510bb21d7bdd8931deaf
- SHA1 be78deb81b4caed20451d9afa9d1ac1818ece43d
- SHA512 1d2e120c0176db2cab73dbeeb0d3fba85effa7d6af10bca571a38de0c283c2dad92e28547cf9a298d4ab5479c1b20ffcbd22b40d4e5c4e283009a096fd35c990
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuoxzHaMD5TvinrmAYTqMi8CtBd2QHCh:A3k03kHRJARJd56r+qJtb2IQPji0Aj
- TLSH T1DAB54A16F6A84765D07BC079C5D2969AEA333C425F308BCB0345DB293F277D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/4436-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002439e-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b67-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4436-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x003500000002028a-524.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021605-1287.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000071d-1972.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002439e-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b67-12.dat aspack_v212_v242 behavioral1/files/0x003500000002028a-524.dat aspack_v212_v242 behavioral1/files/0x0003000000021605-1287.dat aspack_v212_v242 behavioral1/files/0x000400000000071d-1972.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1840 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4436 2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1840 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_efb8d3552bb8510bb21d7bdd8931deaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4436
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 bf26920593c8e41340fd6c314a1f2351f63b4b478d65d07435e2cf9943c9fc28
- MD5 efb8d3552bb8510bb21d7bdd8931deaf
- SHA1 be78deb81b4caed20451d9afa9d1ac1818ece43d
- SHA512 1d2e120c0176db2cab73dbeeb0d3fba85effa7d6af10bca571a38de0c283c2dad92e28547cf9a298d4ab5479c1b20ffcbd22b40d4e5c4e283009a096fd35c990
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuoxzHaMD5TvinrmAYTqMi8CtBd2QHCh:A3k03kHRJARJd56r+qJtb2IQPji0Aj
- TLSH T1DAB54A16F6A84765D07BC079C5D2969AEA333C425F308BCB0345DB293F277D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 9657403b9765f070b4960f027b621502bcaffbf096a5ddea4aa0d207bf771319
- MD5 e4c9caae2e8b25d91b6de88dd77f29e9
- SHA1 ce79fb6da78cdb1a79a71a99b9d04379b82c8b12
- SHA512 94c3afc9d339db8217bc9cf678a63d4f8679a02fccb69b48ffec6c0ed59469b13b68387fb7682e0f74e75d0386edfead55d0fabc3c1245cf166deb923c9c2b86
- SSDEEP 49152:A3k03kHRJARJd56r+qJtb2IQPji0AjKPji0Aj:A3k03kHR+RAr+Zjo0jo
- TLSH T165D54B16F6684775D077C0B9C5D2969AEA3238425F308BCB0385DB283F277D59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
- Size 2.2MB
- SHA256 69fff7b459e8d88f5047c6cd077f1e0cf03165052b97ea1a9432b2e31f5c64d1
- MD5 df92a1a4fb76f107ffe2c9d5d9b268eb
- SHA1 d7fc64df491143e55c4616550bf50058e7c71609
- SHA512 29094ec5c39c20861c2a7439c51cacba109a8d9a51f3b12a427444f7dc6e6705de7551b5091872b1ee185ce8c889c4776ea183887511cdf3d7fbcd534f3b1e03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuoxzHaMD5TvinrmAYTqMi8CtBd2QHCG:A3k03kHRJARJd56r+qJtb2IQPji0AjP
- TLSH T189B54A16F6A84765D07BC079C5D2969AEA333C425F308BCB1345DB283F277D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.3MB
- SHA256 66feac137012226783dfaf9af7803badcdb5e4cc5d539d1b2676ba435b335bfd
- MD5 cc7681049b7d0f70cb8f48fe833e659b
- SHA1 528ce6387ae4ebfec77790c4c739d23747d1ae23
- SHA512 f796e47eede61157790200be1d5d3e3b442d40b4525a17798d03287f362893526e9ad1649c2d048462b971b31c2cdfe2e9f4a15bacf5d56db6eb4c31a8b683dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuoxzHaMD5TvinrmAYTqMi8CtBd2QHCv:A3k03kHRJARJd56r+qJtb2IQPji0Ajq
- TLSH T115B54B16F6A44765D07BC079C9D2965AEA323C420F308BCB1345BB293F377D59A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.7MB
- SHA256 76536d3dfb727d3ea956f2729759787a77bc68eaa420d8c0fc6ded320573a5fa
- MD5 c3f88c31d4997fbc8b82b994361d8b39
- SHA1 8396bf61af1c72d86dd609167c925e9e9d098748
- SHA512 e0cb3b3a8fe209eb03fcef3154259c3f700fb367455a5784f110917507a85796b095e2caaef712d87fd94a871d131b781dbc5bfbea4dd3cb59113f95116dea2a
- SSDEEP 49152:A3k03kHRJARJd56r+qJtb2IQPji0AjRXpiMh:A3k03kHR+RAr+Zjolpig
- TLSH T1F1D54912F6A84775E077C175C9E29656EA323C425F3087CF13859A2C3E73AD1DA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH