Analysis
- max time kernel
76s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 18:14
Behavioral task
behavioral1
Sample
2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260803-wvcf2ade55
- SHA256 be3108c4c8960772feb0836bf0f6dd9ac4b46712acf045dad794014b99af09dc
- MD5 4fd627fefd79c1473b2f0670516606a2
- SHA1 91ebe3679e7ccc253e9fa2a880e37ed5df24fb41
- SHA512 d7fbb4bb9cb6098d53175582b65c58b2b1ff91b211f3942b9216f11acdaefa74e8f3f3db370060ecc6c9d74a688ce8c9f497a10e02bb759bce09c6027125c9ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEaggD5TvinrmbP0Le5ji0hmxNrM:A3k03kHRJARJ556r0Pji0Aj
- TLSH T1A7755A16F6A84BA5D06BC178C5D29656EA733C420F3097CB03549E293F77BD19E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/4304-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024493-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2904-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b67-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4304-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2904-53-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024498-639.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001500000002029e-1522.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000600000000072f-1953.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024493-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b67-12.dat aspack_v212_v242 behavioral1/files/0x0007000000024498-639.dat aspack_v212_v242 behavioral1/files/0x001500000002029e-1522.dat aspack_v212_v242 behavioral1/files/0x000600000000072f-1953.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2904 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4304 2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2904 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_4fd627fefd79c1473b2f0670516606a2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4304
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 be3108c4c8960772feb0836bf0f6dd9ac4b46712acf045dad794014b99af09dc
- MD5 4fd627fefd79c1473b2f0670516606a2
- SHA1 91ebe3679e7ccc253e9fa2a880e37ed5df24fb41
- SHA512 d7fbb4bb9cb6098d53175582b65c58b2b1ff91b211f3942b9216f11acdaefa74e8f3f3db370060ecc6c9d74a688ce8c9f497a10e02bb759bce09c6027125c9ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEaggD5TvinrmbP0Le5ji0hmxNrM:A3k03kHRJARJ556r0Pji0Aj
- TLSH T1A7755A16F6A84BA5D06BC178C5D29656EA733C420F3097CB03549E293F77BD19E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.0MB
- SHA256 a4106d7c7546a789836492b122582c94f58e8834b720fb727bc07525f873e95d
- MD5 cd5e1fb28164e591135bcd8f071d152c
- SHA1 efad6e7812becce157cb817109d7acf83271d555
- SHA512 a47698ad83409e66e6c989fdb0646344db9da64b1526e8aa885987226618b81630af6bc90949859b31cc055294dc76d469f3b957393c547d794d696fcbb29ca5
- SSDEEP 49152:A3k03kHRJARJ556r0Pji0AjoTd9CHKyao:A3k03kHR+RUrSjoKCqo
- TLSH T112A55C16F6A40BA4D07BC178C9A29656EA733C551F309BCF03949A293F337D19E39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$
- Size 1.7MB
- SHA256 d3e4468dddae502a23c48bd8a8e04766e036d3b08a8f2f85279ca6b445a978fe
- MD5 6964e52586f2b81c3ea23616e732931f
- SHA1 179bc418b87bcde4bc682362fa71150c3375a2d9
- SHA512 56f872fe8e435401d7c24cb51b5854d9d2c4a5df7563104936fdcfbbeaa93c27d55334cc8030dbab50b3ad209665319b8f74ec234a10b3b2870dff84ff82c3d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEaggD5TvinrmbP0Le5ji0hmxNrMeT6Nr:A3k03kHRJARJ556r0Pji0AjVTAr
- TLSH T1B1855B16F6A84BA5D06BC178C5D29656EA733C410F3097CB0354AE293F77BD19E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 167a82f892b6b9e53123b016c0305bd48b20176775204a055ba531088650b971
- MD5 126e2fa15eda16db8f2a3901bfb5af39
- SHA1 762ac9e0dcb1b44a94600c7c46d340639ce8cb76
- SHA512 0e9815a9773b30fd997d6299def11b6fb9f85d32e693e0961846303977830bf063af0cbf8875af6e888c7713580944c4039386e669ba3a70bff5919845734fcd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEaggD5TvinrmbP0Le5ji0hmxNrMD0Le5b:A3k03kHRJARJ556r0Pji0AjKPji0Aj
- TLSH T166A54B16F6684775D07BC079C5D2965AEA723C410F308BCB0395DB283F27BE59A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe$
- Size 1.6MB
- SHA256 8198202d108aeed626d42519d4c49a34b13dcc0a04fb76510ebd5bfbfe808701
- MD5 bf22ffc6a6062e35186141d36bb7b6da
- SHA1 fa207761461ad8e623e20071231f1422ad6a7b5d
- SHA512 bfad5b2fe2bb846c46a01c326ee5422cbf23ecaf56833cb0b386747cf81cc5cdd4c86dd24578ffad2a52edb22539182fa19034b9c673ebf91f48263d428ebd26
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEaggD5TvinrmbP0Le5ji0hmxNrMAQ:A3k03kHRJARJ556r0Pji0Ajg
- TLSH T132755A16F6A84BA5D06BC178C5D29656EA733C420F3087CB03549E293F77BD19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH