Analysis
- max time kernel
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 15:47
Behavioral task
behavioral1
Sample
2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.9MB
- Sample260807-s77adsgf56
- SHA256 620aee4f9660845397373d968e1042147b335d49f672ed08912d15d6cfd3b9d4
- MD5 8cc5839e60ab64d628c9e890b88a76e7
- SHA1 b92c5a3db662395f466e0bc722fb552984d79474
- SHA512 dc126ec2c81b587b53a3088735b6d88c173c8902a3f8d71d9840d36e4eacf0c659660fc37a63ba9b4bd5ece3a8cc81ad67312eeec4408427bf92e1e3be169fbd
- SSDEEP 49152:A3k03kHRJ9qJtb2Ij56rbeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj:A3k03kHR3Jr7fkZcNfkZcRjo
- TLSH T157162A16F6788722D077C0B9C5D6AA9AFE3238465F308ACB0345D72C2E277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/3480-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c44b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3480-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4996-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9e-1274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000006549-1895.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c44b-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9e-1274.dat aspack_v212_v242 behavioral2/files/0x0003000000006549-1895.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4996 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3480 2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4996 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_8cc5839e60ab64d628c9e890b88a76e7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3480
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4996
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.9MB
- SHA256 620aee4f9660845397373d968e1042147b335d49f672ed08912d15d6cfd3b9d4
- MD5 8cc5839e60ab64d628c9e890b88a76e7
- SHA1 b92c5a3db662395f466e0bc722fb552984d79474
- SHA512 dc126ec2c81b587b53a3088735b6d88c173c8902a3f8d71d9840d36e4eacf0c659660fc37a63ba9b4bd5ece3a8cc81ad67312eeec4408427bf92e1e3be169fbd
- SSDEEP 49152:A3k03kHRJ9qJtb2Ij56rbeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj:A3k03kHR3Jr7fkZcNfkZcRjo
- TLSH T157162A16F6788722D077C0B9C5D6AA9AFE3238465F308ACB0345D72C2E277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$
- Size 4.1MB
- SHA256 2c205b38361398164210c8259d5c752ffe88efaa055e3ead1159e4e7dd3ba2ba
- MD5 9e5b1f8731be19d0e5886fe595a50210
- SHA1 75b42c09e2d17c88dff03a475a9cb21987e54f59
- SHA512 f4f70c30e98a200a3dbefac1620dedaa998ce5852e728feb661a642a07a7f012197e0001a9c81c60e486f38a57ffca352009a82ca1b7187c27aeda7203892417
- SSDEEP 49152:A3k03kHRJ9qJtb2Ij56rbeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0AjzlNtqna:A3k03kHR3Jr7fkZcNfkZcRjoXlNtqa
- TLSH T1DB162B16F6B88722D0B7C0B9C5D6AA5AFA3238455F308ACB0345D72C2E277D5C636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.4MB
- SHA256 5b86e68577a81e70258319df7d668a63ae30ea0ba6ec4f96873ce27033292606
- MD5 740bb252e0f705f77adb56c4a5594692
- SHA1 0dd103db2bf929c197d9ab9092904cfd37827bfe
- SHA512 dba11410070d946b9ef3cb4632f04c3fcb35db81c5b6e0f343614549d1858f94d7c6169f296b8325d2183c1d4aa349fad13e806f05785b1b4866b8d38b03f7e2
- SSDEEP 49152:A3k03kHRJ9qJtb2Ij56rbeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0AjKPji0Aj:A3k03kHR3Jr7fkZcNfkZcRjo0jo
- TLSH T14D262A16F6788732D077C0B9C5D6AA9AFE3234465B308ACB0345D72C2E277D5863A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 4.0MB
- SHA256 b6a077a33641f2def8684390dcee3957061c6ceb9b430d98357c5225d49bab04
- MD5 4e8b6bb86b32b62463148cd95c9febbf
- SHA1 d38c1d5ec12fe8fbb2ee305abb107ccbbda9efa2
- SHA512 14b3e51d1f80de388c709902ff6f03ddac05c5e840fcc29a5a25506826ce47f592389c8b0905cf069cefe9cd5cdd7c911fa2ece86fbc42ba80e474bd6effa952
- SSDEEP 49152:A3k03kHRJ9qJtb2Ij56rbeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Ajq:A3k03kHR3Jr7fkZcNfkZcRjo2
- TLSH T142163B16F5788722D0B7C0B9C5D2AA9AFA3238455F308ACB0345E72C2E377D59636736
- MD5 SHA1 SHA512 SSDEEP TLSH