Analysis
- max time kernel
94s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 23:03
Behavioral task
behavioral1
Sample
2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260810-21vsfs1bne
- SHA256 7fec3a27cfee843dfe7fd11a7101a6ca8d76e266c7cff1e8b5b7a0d45cb272d9
- MD5 03b794c56c10e15511ab1e9d06e16925
- SHA1 e66904dd8ad61376419dc265f1eefb37c16f6b50
- SHA512 61fea58c9aac8e794d4d6e15fe0e855707c0198951a7293657f4931645835e0f53b5afaaa80dc9fc3dfaf7cfdcaad7084afc47074bcd22f7155fe5fa0ebba351
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vbnD5TvinrmC:A3k03kHRJi56r/56rX
- TLSH T1FF455A17A6980FA8D11FC1788A964662E7737C125F2097CF1354BE253F72AD0AE3A353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4252-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e69b-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4656-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000016909-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4252-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4656-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0015000000016909-149.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021619-1284.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000002023a-1383.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023173-1623.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000300000001e69b-5.dat aspack_v212_v242 behavioral1/files/0x0003000000016909-12.dat aspack_v212_v242 behavioral1/files/0x0015000000016909-149.dat aspack_v212_v242 behavioral1/files/0x0003000000021619-1284.dat aspack_v212_v242 behavioral1/files/0x000a00000002023a-1383.dat aspack_v212_v242 behavioral1/files/0x0002000000023173-1623.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4656 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4252 2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4656 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_03b794c56c10e15511ab1e9d06e16925_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4252
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4656
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 7fec3a27cfee843dfe7fd11a7101a6ca8d76e266c7cff1e8b5b7a0d45cb272d9
- MD5 03b794c56c10e15511ab1e9d06e16925
- SHA1 e66904dd8ad61376419dc265f1eefb37c16f6b50
- SHA512 61fea58c9aac8e794d4d6e15fe0e855707c0198951a7293657f4931645835e0f53b5afaaa80dc9fc3dfaf7cfdcaad7084afc47074bcd22f7155fe5fa0ebba351
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vbnD5TvinrmC:A3k03kHRJi56r/56rX
- TLSH T1FF455A17A6980FA8D11FC1788A964662E7737C125F2097CF1354BE253F72AD0AE3A353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 1.4MB
- SHA256 c927863a7c5d6bf8d12dc299a7712683c3282e0c5b5e4ccfcf40776cc805ec4e
- MD5 ed14ea6fc05e9ae870dac3580c6bdfab
- SHA1 97bad3b0cf16651f8e1d2cb492cee835d9846846
- SHA512 4918efb2812813333611f967e03ef11d044ebb2cf3ac7fbe0eabf728508270f945cdbd74de092ba2527eb07f515eebb4b4811bef3e754a54ad2e86f5f5bdc512
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vbnD5Tvinrmc3UNUpEisI:A3k03kHRJi56r/56rtUN+Eir
- TLSH T1E8654A16A6984FE5D12F917889928662F7737C110F2197CB1350AF2E3F376D0AE3A253
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$
- Size 1.2MB
- SHA256 33392ad3c3e847abd5bda21caee61843380c6fa97aeb2f858c6f91efb5615d04
- MD5 1d6cf026c431a045d967ae98064eda45
- SHA1 cc02bea38103367910106897189daaef40dfdf49
- SHA512 58026864a314a3c936cb6a390d12442aafe07beeebc25a5ee0d1b850c827b83965c0a2d7ecd01b647770be14013b9f7d4849bb95168482643022658a77098881
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vbnD5Tvinrm+TjE:A3k03kHRJi56r/56rNw
- TLSH T1DD555A17A6980FE8D11F81788A924662E7737C125F2097DF1354AE253F32BD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.7MB
- SHA256 619e955a5f0c7f248d2527ca10b12555b73e173ae13a3be01c018d3e77542d8c
- MD5 fcaefc7fa6634b3c5037138bf72b8063
- SHA1 562da1bdbc9da84a5330ed526d7380e67676d065
- SHA512 1a1957d2deea8cad4074aa3afd5c6a8a5b0ee8d871ff32394c16089845d9ee8724a30ba906a7fec68c2cae9e697f5c451045e8642c3fe278f78382a74f3dbfce
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vbnD5TvinrmC0Le5ji0hmxNrM:A3k03kHRJi56r/56rTPji0Aj
- TLSH T10E854A16F6A84FA5D02FC178C5929666EA733C415F3087CB0354AE293F376D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$
- Size 1.3MB
- SHA256 1bfbc5f88da37e0fb4513a3e62dc3a9de9b15d8642bbff990499a09afcf71232
- MD5 4421610a2fe4aad9160bb4bcacf77d3d
- SHA1 9c06535707e4ff97f5894c00acaee7128fad69ce
- SHA512 51ef86684f88140248bc3dfbe3d4e8fcc97731c42a284c892ef957607b36cbceca46e41bb5eb733a5dc5e854bb9fbe7f05d7ff534ee17665b4d7cd559a96d598
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vbnD5TvinrmrD:A3k03kHRJi56r/56rU
- TLSH T10E55F406E2980FA8D11F8174CB964562F6737C115FA097CB13D0EE3D3F72A90AAB9653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.2MB
- SHA256 d57b7ad285fb8a228bb14bde72b0aa31363c5cbbbb98eae8c5a7ca310e3431bb
- MD5 8a4e43213c84aab8d8c21893a9964a6d
- SHA1 df4aef2e0d25d9cc5ce038fa2f3c390c063b7bd4
- SHA512 f66829842397055449802d93ba176a68ffa3f155bf20ebc6ebc575f6900830fc11d94c2a1b055d0044ecdd9556ce195357b8ebfe055f1af938d4082f71febd70
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vbnD5TvinrmgF:A3k03kHRJi56r/56r9
- TLSH T1FC455A03A2990FA4C15F8174CA968A62E6777C524F2097EF1354BF263F327D0AE39653
- MD5 SHA1 SHA512 SSDEEP TLSH