Overview

overview

10

Static

static

10

2026-08-09...ry.exe

windows10-2004-x64

9

2026-08-09...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    89s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 15:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_d7a9e6124c51bfd879ba0935d2cf47cb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
  • Size 1.8MB
  • Sample260809-tca45s1dnc
  • SHA256 f5f7a8c0d88ce0bf7b896f01e6420312a249ec7edad0594cec2af0cbcaa6ecd2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
aspackv2discoverypersistence

Malware Config

Signatures

  • Detects executables packed with ASPack 14 IoCs
  • ASPack v2.12-2.42 10 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_d7a9e6124c51bfd879ba0935d2cf47cb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_d7a9e6124c51bfd879ba0935d2cf47cb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:1056
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1296

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 1.8MB
        • SHA256 f5f7a8c0d88ce0bf7b896f01e6420312a249ec7edad0594cec2af0cbcaa6ecd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe$
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
        • Size 2.4MB
        • SHA256 c81574f509f30dff9b9d8543ae1e1d9fb9789b2846b73a59d481ee9964c7cb20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
        • Size 2.0MB
        • SHA256 51a641db34664db830490d3e314d0aa31cd28782d2959c5f125d3db23258fefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 2.4MB
        • SHA256 44476dea8659368cfaa9706e24ab6ccffb72cb14c7ed3fd2cb3b68def61bbb8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OneDriveSetup.exe$
        • Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
        • Size 2.3MB
        • SHA256 16433d0fc2416279717b20e11d711192f7130610ba512f4e96d65c33a554e3f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        XLICONS.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
        • Size 1.9MB
        • SHA256 1a1b33f3ba51ce7b830f57e3387750eaabf84fa4b7dc441ba8b4d6575ef30e4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        integrator.exe$
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
        • Size 2.3MB
        • SHA256 29c10aa02431eb26cd3c117f0a080cd94c511fc50c32c4bb04b88e39360097e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdge.exe$
        • Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
        • Size 2.1MB
        • SHA256 a1e87c93af1a57c98c4a13a55ffb13a70b0114e4018f8e37ff6475a6b7c617a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        integrator.exe
        • Path C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
        • Size 2.4MB
        • SHA256 bb3f967b9e1bd105f3c289d75c2f3b52bde09095785dba7551bc8823fcfce76b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        integrator.exe$
        • Path C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
        • Size 3.7MB
        • SHA256 8cbdcf4763f78030f1385f9c3e74c336bae4fb1c6ec41e41bba5ff7ab7389af9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1056-22-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1056-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1296-23-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1296-7-0x0000000000400000-0x000000000040F000-memory.dmp
        Download