Analysis
- max time kernel
99s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 08:30
Behavioral task
behavioral1
Sample
2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260804-kefmzagb49
- SHA256 9c52af75c69fc896c33af1e9d8cc9121d0430c09a32b674acd7c9c453eba3ba8
- MD5 090cf8b7d36b2cc40ad698c456cf2b96
- SHA1 1c5ebb15b8be168a8eef5bd8a079934bcb016730
- SHA512 b8c678a80ffa939cf8a8600cf9fabe8262edf64c21aca89ed66e263010b63d2760eca5cd3b9821c634f86d5d82600531082b865a5efd17061c5a9687d97208c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliNZ0Le5ji0hmxNrM:A3k03kB56rQRJePji0Aj
- TLSH T128655A16F6A44BA5D06FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/4808-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001000000001c545-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4808-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2452-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019981-538.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019976-539.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001acaa-1294.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001000000001c545-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019981-538.dat aspack_v212_v242 behavioral2/files/0x0003000000019976-539.dat aspack_v212_v242 behavioral2/files/0x000300000001acaa-1294.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2452 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4808 2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2452 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_090cf8b7d36b2cc40ad698c456cf2b96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4808
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 9c52af75c69fc896c33af1e9d8cc9121d0430c09a32b674acd7c9c453eba3ba8
- MD5 090cf8b7d36b2cc40ad698c456cf2b96
- SHA1 1c5ebb15b8be168a8eef5bd8a079934bcb016730
- SHA512 b8c678a80ffa939cf8a8600cf9fabe8262edf64c21aca89ed66e263010b63d2760eca5cd3b9821c634f86d5d82600531082b865a5efd17061c5a9687d97208c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliNZ0Le5ji0hmxNrM:A3k03kB56rQRJePji0Aj
- TLSH T128655A16F6A44BA5D06FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 eb9b09417700586a33477b0dd6104e6fdce5a6002cf76c29775e3334488cc3bf
- MD5 91dd9a5e2d432c2f42dd87d56eb15f89
- SHA1 4f86b4090c92a767c04120071fa737634d2a4bcd
- SHA512 a2b18a8c3608455083bbd0679aa6819da363cdb7ead8f8d47b786dabee8e929995ea190e276296e78f96de97fe110eddfbef0613457fabe987d603819e07b7aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliNZ0Le5ji0hmxNrMD0Le5ji0hJ:A3k03kB56rQRJePji0AjKPji0Aj
- TLSH T1CFA54A16F6644B75D07BC079C5D2969AEA723C421F3087CB0345DB283F27BE59A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
- Size 1.5MB
- SHA256 f9013221b431fbdf023ef216c907c981778b61aa490158ac27815f939d73f8b0
- MD5 7abb981271505c9a4d53a10a2862c3cd
- SHA1 201a14a3bd219b17e51425de994742fda52101f2
- SHA512 1cf0afca4af589912641a25d8753fbb85e4c56d20dfd42031c9d997d2043b31753485cef1fa11458144d571f17f5ecda82077a7488652cc61d4eb046c816b2df
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliNZ0Le5ji0hmxNrM393:A3k03kB56rQRJePji0Aj6
- TLSH T145755A16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
- Size 1.5MB
- SHA256 57958914dbf7972394eb0e2436712dc7e9796e17c2524e0b967fae2bbf7564aa
- MD5 08485ad7ba07286af951f39759162a47
- SHA1 8e82e4905b11ac5bcf1e7cffc1b88585154a0632
- SHA512 7d5f510089afb343d0705d7d32c3737a57a476d78628b3545fda93c5adff84d0170d13d5dd4418250237d2814c14a98d0ed4e923769c80f45d1d1b39a56af473
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliNZ0Le5ji0hmxNrMoW:A3k03kB56rQRJePji0Ajw
- TLSH T129755A16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 1.5MB
- SHA256 a5e8b9152e0fdb0a618e2d500bb7e9c45672fb1175f49916effc000da0d3aa8b
- MD5 fd48cfd55d49e92869f8a79bc9ec2675
- SHA1 dd86d925a39c8286d2c7a28ae2ba28a1e723a35b
- SHA512 257f17c7f69aa9c189a471658b2bd66d1d801f29394f4d5b23ceaa93de1cbf8e5767b60aa76d5521e40f22f17b553331bc0b472f7fcafb402f6c918155babe09
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliNZ0Le5ji0hmxNrMPF:A3k03kB56rQRJePji0Ajq
- TLSH T1BC754A16F6A44BA5D06BC074C9969656EA333C810F308BDB1354BF293F377D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH