Analysis
- max time kernel
101s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 17:04
Behavioral task
behavioral1
Sample
2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260809-vlhe9asdke
- SHA256 ec1b5177c3b039add57468a793e42ba71899d30a2c072a2f0c3b37e4ad76af65
- MD5 29a9dc049dd5ea24f10b5642481d4ae8
- SHA1 3876519387cf9d5dc4a6878cf81b4a358797f0da
- SHA512 cc12eff0dcaf1d0d453eb4c68527fa4eb41326e8bb138eaceee18d7ace48007ed0be4554604fe164a17158e74c6b476a8beee6b94c6ae680b839e763f7a571e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gsjs+jYTqMi8CtBd2QHCHmTBW5kD5TvinrmC:A3k03kD4U2v+MqJtb2Ij56rX
- TLSH T130856B16F6548B71D02BC075CAD6A666EA773C514F3087CB1384AF283F366D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/1748-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000019f9b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000016cd1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1748-33-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5332-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00100000000198dc-379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac4c-1224.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c9f-1292.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x0009000000019f9b-5.dat aspack_v212_v242 behavioral2/files/0x0006000000016cd1-11.dat aspack_v212_v242 behavioral2/files/0x00100000000198dc-379.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-377.dat aspack_v212_v242 behavioral2/files/0x000300000001ac4c-1224.dat aspack_v212_v242 behavioral2/files/0x0004000000019c9f-1292.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5332 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 29 IoCs
description ioc Process File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1748 2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5332 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_29a9dc049dd5ea24f10b5642481d4ae8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1748
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5332
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 ec1b5177c3b039add57468a793e42ba71899d30a2c072a2f0c3b37e4ad76af65
- MD5 29a9dc049dd5ea24f10b5642481d4ae8
- SHA1 3876519387cf9d5dc4a6878cf81b4a358797f0da
- SHA512 cc12eff0dcaf1d0d453eb4c68527fa4eb41326e8bb138eaceee18d7ace48007ed0be4554604fe164a17158e74c6b476a8beee6b94c6ae680b839e763f7a571e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gsjs+jYTqMi8CtBd2QHCHmTBW5kD5TvinrmC:A3k03kD4U2v+MqJtb2Ij56rX
- TLSH T130856B16F6548B71D02BC075CAD6A666EA773C514F3087CB1384AF283F366D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 fe50700a7c20423d23388ea3aa1225fa15b160c3c94ec33802ce22551c0d08ad
- MD5 ebc63f6ebf4b77dc9797c84f3e4dac2c
- SHA1 b4be64b7931ad5d6408d78855cafc7f5522b1df9
- SHA512 ed6684136c2bfa14bb53b587ec6f9528a34b7fc5127ee814624972ef783855f5efa4a3816b45cf8db21678e96553f4ffe3f9933b6e8f71fe6ccfe57a8bbbb63d
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gsjs+jYTqMi8CtBd2QHCHmTBW5kD5TvinrmCD:A3k03kD4U2v+MqJtb2Ij56rTPji0Aj
- TLSH T1B9B54B16F6648B71D07BC075CAD6A69AEA7338414F3087CB13859B2C3F376D1963A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 1.7MB
- SHA256 e3dabb2a6d875ea87f050aa07ed82c3d2971667fa57c32dda39a2bd0ea0aa148
- MD5 3b73f4c454a3791524d180ac5e9bd04c
- SHA1 e03c4f1e22acbcdd0eb65ccf325f316544e9d5d1
- SHA512 8b5fad1480508f2600e24074a44acf7fcb25fed4d7cc2f372793e952d3ad2a5556383cdd69b92ad5894fd40d3ae132861be3166929188d40f7181371668c5a3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gsjs+jYTqMi8CtBd2QHCHmTBW5kD5TvinrmtA:A3k03kD4U2v+MqJtb2Ij56rJ
- TLSH T189856B16F6548B71D02BC175CAD6A666EA773C514F3087CB1384AF283F326D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$
- Size 1.7MB
- SHA256 b963e548dd35197f2a83939b01f243749de56dfc0520230c2cd1d0a7cd806e31
- MD5 f95ff2b6e6ce0e8d1d5ab3d12430c251
- SHA1 85ddc24162d86c0a6d26056131c1bb8fcff38810
- SHA512 d0db5363e2b90e40a43b0286bd1cfd69b25105c11f8f827743ec00613f999de16218dcdfbed5e9d04350bc2123c17db6a479bf64acc11e44a3c0f4234e4623a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gsjs+jYTqMi8CtBd2QHCHmTBW5kD5Tvinrm3x:A3k03kD4U2v+MqJtb2Ij56rK
- TLSH T1F5856B16F6548B71D02BC175CAD6A666EA773C514F3087CB1384AF283F326D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$
- Size 2.2MB
- SHA256 39ccf4bf9e26c5c62a4e1e92e3cd42489dc0516ccd3939f159119847a6c5232a
- MD5 df951f9a373fbb35df7848cb8cc24a36
- SHA1 cc05313aaa17d35fbff42ca58a42dc084b4b01e0
- SHA512 5ef6b3adc329ba3b90f84d604cb786841088db08693289506a62fa06447fb5e382871ec3fa2d1428dff26801d9186d0876910d6e14c13627fd1ba1f63bed48e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gsjs+jYTqMi8CtBd2QHCHmTBW5kD5Tvinrm4z:A3k03kD4U2v+MqJtb2Ij56rZi6
- TLSH T19AB53852AB558E71F02F8034C9829279E6733D190FE387C7128EBE196F366C895F9316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.8MB
- SHA256 92790a4b889085545728b425899e00e063bb17b75dcf19627dc0d1938056d2e5
- MD5 b3ae25ffaed82af3e57d7051dd717f27
- SHA1 b45608fddd291ad55f48b3e31ee867c603fdfe7f
- SHA512 dec06473b17cdfb20c1b9bcd34b9a0ff3beb904b7f66d6eec2d97e18b13cb564b7f8b531c10a94c4bb33bd0d66f9ee7171f83ea19a983c496ef0842e4659ecfe
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gsjs+jYTqMi8CtBd2QHCHmTBW5kD5TvinrmgF:A3k03kD4U2v+MqJtb2Ij56r9
- TLSH T125855B16F6944B71D06B8075CAD6A665FA773C910F308BDB1384BF287F326C1A636722
- MD5 SHA1 SHA512 SSDEEP TLSH