Analysis
- max time kernel
93s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 23:44
Behavioral task
behavioral1
Sample
2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260810-3rhbfacj2x
- SHA256 a39125593f930f6f8ff31b83cec46f0d2399737e173da877fd818e2fc0f0da54
- MD5 852e2a54f089089f7af2055560c691e2
- SHA1 21050f9ae29b6200973ebbcf5eeb81724cf5cda0
- SHA512 e6050d76cdf57d1f0689b5017ac2b9cd85a305ce7f7ad4d7c8f83b36a519e4f7be2bdf7fefb9844ea6d556b7af1bdf34a99e7070f04002a2a1e4f3501e483cd1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT3aW+P0Le5ji0hmxNrM:A3k03kB56rqPji0Aj
- TLSH T1EA654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/1784-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243c8-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1056-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1784-64-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1056-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002133d-506.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002166d-1287.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00150000000202e1-1530.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243ef-1672.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243c8-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x000200000002133d-506.dat aspack_v212_v242 behavioral1/files/0x000300000002166d-1287.dat aspack_v212_v242 behavioral1/files/0x00150000000202e1-1530.dat aspack_v212_v242 behavioral1/files/0x00070000000243ef-1672.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1056 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1784 2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1056 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_852e2a54f089089f7af2055560c691e2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1784
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1056
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 a39125593f930f6f8ff31b83cec46f0d2399737e173da877fd818e2fc0f0da54
- MD5 852e2a54f089089f7af2055560c691e2
- SHA1 21050f9ae29b6200973ebbcf5eeb81724cf5cda0
- SHA512 e6050d76cdf57d1f0689b5017ac2b9cd85a305ce7f7ad4d7c8f83b36a519e4f7be2bdf7fefb9844ea6d556b7af1bdf34a99e7070f04002a2a1e4f3501e483cd1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT3aW+P0Le5ji0hmxNrM:A3k03kB56rqPji0Aj
- TLSH T1EA654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.9MB
- SHA256 d363ed442723cbae90983bdbf13a91a1b399ccf35566f524cacad8570ddcd8b9
- MD5 2eec20e923a4c47ca952cd16af832012
- SHA1 02b41bc49d3f66d5c1f9118868de6b925444f56b
- SHA512 0014e12a2380fff56347b350a5d0f1140fa4aa1da1211c6595be9a38981e18a1338e29a1d4814c4e2066a6b2ad71dd8b1e5588cfd121a23494530d62f3c7e282
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT3aW+P0Le5ji0hmxNrMX3Td9CHKy7z:A3k03kB56rqPji0AjoTd9CHKyao
- TLSH T1E0955C16F6A40BA5D07BC174C9E25656EA733C461F308BCF13549A293F337D19A3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
- Size 1.5MB
- SHA256 c7a849007b0a13fbdfd4dab773439da4589b4eb3260c1d68c873fd853130f6ac
- MD5 e3b0c69108ae67ae9096c491ce46c67d
- SHA1 f903c20cec6f81e9cf52e795971fc61d15e1526e
- SHA512 eb327dbd7744ca54de2a0450558377f480792ac0ea8aaf7b88ccf0ee4d2cdb08d6656322633956d0d5c190384919cebb1fde9d2d08e505c7641e5b3a25854269
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT3aW+P0Le5ji0hmxNrMeGen:A3k03kB56rqPji0AjMI
- TLSH T1C5756B16F6A44BA5D02FC174C5D2966AEA733C421F3097CB1354DE283F23BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 8f6dad4ecbbdcd476693436a0d96ad30b30ea047a91d0ab435f72bb183c9ef78
- MD5 464b5029fdb797be356ba9d927af8a98
- SHA1 8a4fd0862a26ab94df5054acba92fbbd42ddd973
- SHA512 08ad2954a302739173e94363c5b3456a18d9ca5745b21aeaa03751c3edc04ae1f2ac9811b15497e81f0273e643c48dd9088552976e6cb4431cc887626ca315bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT3aW+P0Le5ji0hmxNrMD0Le5ji0hmM:A3k03kB56rqPji0AjKPji0Aj
- TLSH T180954A16F6A44B75D02BC0B9C5D2969AEA723C421F3087CB0345DB283F67BD5963A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 1.5MB
- SHA256 8bc4ad5318939dc9e503bb44c8198d068ce85b47e5eafacbac4f40f76785f0da
- MD5 1d48e938cc6e7436f4609d6bf9843c0e
- SHA1 06d1bc2bb5855025adba69f502481c67f7008e26
- SHA512 1dbdd81a9077b4bff7068f06283a19df52dbc675b1d55b0bad91394979424e6a5d0a25dae54cf56279af47b4a7488842be844e21ee8a091b9ebe8f0197aeb018
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT3aW+P0Le5ji0hmxNrMNj:A3k03kB56rqPji0Ajm
- TLSH T1A7655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 1.5MB
- SHA256 23874a43230827bf40a1bf64596459f5b098f00ddc47c4969b7941632eb14da4
- MD5 338482956e2455f29a939e44b36151aa
- SHA1 9d5e17ea3f4cafa392762316370c2bff43df1278
- SHA512 3f75ee0613f5feedefab2c066e69bf8e02691ffefaf2bff051cf2a380f659ae05705aa82ded1b0cb8663ee79448bff0f9930a7f36afb0e902d21acd673ee18c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT3aW+P0Le5ji0hmxNrMPF:A3k03kB56rqPji0Ajq
- TLSH T192754A16E6A44B65D06BC074C9D69656EA333C821F308BDB1354BF283F337D1A63A762
- MD5 SHA1 SHA512 SSDEEP TLSH