Analysis
- max time kernel
79s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 00:37
Behavioral task
behavioral1
Sample
2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 4.3MB
- Sample260808-aygn9sy1ds
- SHA256 9f97b933304a7d6441a24f30895d2cd8cf334cbdb43525768eff080e38748f17
- MD5 d5788e4b95c08076c28456b55104fbe8
- SHA1 d0b2eb48fef5cbcd31784572be46dd252bc11ffe
- SHA512 3f78a13f538acc5b2eb5e6693f82e180e31d9a95c3358578b0d72b7bc12bacb7b22bf0b0461847158db5bd96419b93303455d275e85d9f70699f6af41f33eb9a
- SSDEEP 49152:A3k03kHRJsqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb356rbeW4SkZP4sz9Mb:A3k03kHRCFfkZcNfkZcYr7fkZc
- TLSH T1F3260916F5788722D0B7C0B9C6D6AA99FA3338455B308ACB0285D73C2F277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4148-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c586-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c587-13.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4148-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2372-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000000432-125.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0fd-1020.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9e-1271.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00190000000187fc-1484.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c586-6.dat aspack_v212_v242 behavioral2/files/0x000e00000001c587-13.dat aspack_v212_v242 behavioral2/files/0x0013000000000432-125.dat aspack_v212_v242 behavioral2/files/0x000300000001a0fd-1020.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9e-1271.dat aspack_v212_v242 behavioral2/files/0x00190000000187fc-1484.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2372 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4148 2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2372 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_d5788e4b95c08076c28456b55104fbe8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4148
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.3MB
- SHA256 9f97b933304a7d6441a24f30895d2cd8cf334cbdb43525768eff080e38748f17
- MD5 d5788e4b95c08076c28456b55104fbe8
- SHA1 d0b2eb48fef5cbcd31784572be46dd252bc11ffe
- SHA512 3f78a13f538acc5b2eb5e6693f82e180e31d9a95c3358578b0d72b7bc12bacb7b22bf0b0461847158db5bd96419b93303455d275e85d9f70699f6af41f33eb9a
- SSDEEP 49152:A3k03kHRJsqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb356rbeW4SkZP4sz9Mb:A3k03kHRCFfkZcNfkZcYr7fkZc
- TLSH T1F3260916F5788722D0B7C0B9C6D6AA99FA3338455B308ACB0285D73C2F277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 4.4MB
- SHA256 fd22b8b434f6651949c8c3d57cc2b770ef60e0e3ce46d607867ea79184076e62
- MD5 ceb3afae358e83d68be919e2e60e0754
- SHA1 39cf0b5c43c9ca82111301167f02364f2122dd66
- SHA512 1aa7dc811f8d08ccaffd1ce09dd9428b57f55ec380a78cac9e1cc39a5728b147aec0de086938837e8af6f2e61003a43f52aa25f02f7029093635abc3175a5ac6
- SSDEEP 49152:A3k03kHRJsqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb356rbeW4SkZP4sz9Mb5W:A3k03kHRCFfkZcNfkZcYr7fkZc5W
- TLSH T1E8261A16F5788722D0B7C0B9C6D6AA99FA3338455B308ACB0285D73C2F277D58936736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.8MB
- SHA256 cd651292671863d58c1c4f9a27733eb4b513f45f93576bc1ab6a6eba301919de
- MD5 17736f67e324d33ac5b6e9f58b228c68
- SHA1 6a6c1f31ecf24421aa299ee053f1b2959958c690
- SHA512 42dff796c295f03224289a962820215807915caec523f1e71414780dd0c1b65861d86c6f7f305d9f0d5440b222f24fc27d2ecf2674cb1a8be9aea0e5af1b346d
- SSDEEP 49152:A3k03kHRJsqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb356rbeW4SkZP4sz9MbBO:A3k03kHRCFfkZcNfkZcYr7fkZcRjo
- TLSH T178361A16F5788722D0B7C0B9C6D6AA9AFA3334455B308ACB0285D73C2F277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$
- Size 4.4MB
- SHA256 234672540b2821d041e35910c75a186a3c124648924144c70195e395866cb67c
- MD5 f4edf33fc7baa0eec82cc87cf53facb1
- SHA1 25e622284fa43e78c42f001f83515e2f2c7001bf
- SHA512 b1c1909a3b5cf8af56ae08dd43d449c087721c0cd6c4dfbf7129ad09fe4cfd34028e51cce1b55161fb2a4b71bf1e1dc41d8272dd6f9729d813b57c208a4be94d
- SSDEEP 49152:A3k03kHRJsqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb356rbeW4SkZP4sz9Mbq:A3k03kHRCFfkZcNfkZcYr7fkZcq
- TLSH T151262A16F1788722D0BBC0B9C6D6AA99FA3338455B708ACB0285D73C2F276D58576337
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 4.4MB
- SHA256 4a761a6e19dc536b5a64ebfdeb2525982a005799cf212021457220cd7b9429dc
- MD5 e6930f99bac99ef36998e4e843a6542f
- SHA1 18b0424a6f0a15eb79e269ffa0bf1de322583b7a
- SHA512 f45f237660e8bb3332ce75460eb19db33b953d9432a113e947bfd5aa2fe6631b0a64d50e5e1d0d5fe9e321be69660c82974dbf46881a8ec1e02fc023eb6d95d1
- SSDEEP 49152:A3k03kHRJsqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb356rbeW4SkZP4sz9Mbj:A3k03kHRCFfkZcNfkZcYr7fkZcj
- TLSH T13A261A16F5788722D0B7C0B9C6D6AA99FA3338455B308ACB0285E73C2F376D58536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 4.3MB
- SHA256 90ea5dc1a0c743365d9dd56b334f830c40c8098ef27ad9bc96d98370666d79c8
- MD5 02705ea07c7cd130ff8555a81e00af58
- SHA1 61238a8809e18aa3b735fe674c6ac91a31f81dfe
- SHA512 992ed98539f999db44b473c0a2e39b01666b62b436874b8feaa5a4923d54d5f2deb33ac0020b8a2ae2c8c3b3da91ef35696cb3de25b5e03d77df4b2e9f2f7b57
- SSDEEP 49152:A3k03kHRJsqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb356rbeW4SkZP4sz9Mbu:A3k03kHRCFfkZcNfkZcYr7fkZcu
- TLSH T191260A16F5788722D0B7C0B9C6D6AA99FA3338455B308ACB0285D73C2F277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH