Analysis
- max time kernel
103s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 10:33
Behavioral task
behavioral1
Sample
2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 5.3MB
- Sample260813-ml1b3axejg
- SHA256 5912cba5945515948d43569c8c5f6190c907cd5d967a04408f8f11cb17b87a73
- MD5 1323f369f28dbba803eacdce75014370
- SHA1 44c525184ec90d7e3a05a36337eae6c48fdc5b31
- SHA512 156bd425731f145c96d030f8e798de45d3385a226cb87f14ecf1eb49d51315d5c34a29d66cae2af523c13fdd0c8173bd75d7eeb3eca231fd7fd182758e92bb2c
- SSDEEP 98304:A3k03kHR5FfkZcer7fkZcBr7fkZcNfkZc:A3k03kHHhPSzP1zPpP
- TLSH T12246F816F5788722D0B7C0B9C5D6AA9AFA3338455F308ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/4584-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c555-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4584-9-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5236-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00160000000188be-1214.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019cb3-1288.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c555-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-12.dat aspack_v212_v242 behavioral2/files/0x00160000000188be-1214.dat aspack_v212_v242 behavioral2/files/0x0004000000019cb3-1288.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5236 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4584 2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5236 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_1323f369f28dbba803eacdce75014370_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4584
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5236
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.3MB
- SHA256 5912cba5945515948d43569c8c5f6190c907cd5d967a04408f8f11cb17b87a73
- MD5 1323f369f28dbba803eacdce75014370
- SHA1 44c525184ec90d7e3a05a36337eae6c48fdc5b31
- SHA512 156bd425731f145c96d030f8e798de45d3385a226cb87f14ecf1eb49d51315d5c34a29d66cae2af523c13fdd0c8173bd75d7eeb3eca231fd7fd182758e92bb2c
- SSDEEP 98304:A3k03kHR5FfkZcer7fkZcBr7fkZcNfkZc:A3k03kHHhPSzP1zPpP
- TLSH T12246F816F5788722D0B7C0B9C5D6AA9AFA3338455F308ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.8MB
- SHA256 2ff23bf860d1d802dbe7d54ce7bf8dc59b56b02a6167a9ac83ca9765d0256790
- MD5 d5d1ce46846c28ee36fd9b19bbdc28d6
- SHA1 12998c7406d18e8e3387f9214b4e6131c80c1dba
- SHA512 9d7126486b666da5ade403b3507ce95977ad8e00421c2badbd8e92317f3e2d546f95f7951b93a241de33565b1114ab2190a371ebc9bb3280776ecf6bad9493e6
- SSDEEP 98304:A3k03kHR5FfkZcer7fkZcBr7fkZcNfkZcRjo:A3k03kHHhPSzP1zPpPVo
- TLSH T1DB560916F5788722D0B7C0B9C5D6AA9AFA3338455F308ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe
- Size 5.8MB
- SHA256 1b8c87422a84a1647b9549fafb0dab212726872063222e5f9951365056baada6
- MD5 d567def79a202beddccf97c0e7dd4a41
- SHA1 69575738638ef2949331ec230318d69f968bab47
- SHA512 542a612a06b1afec7bf6ace6122e39c196359cfe15d83d9b4f874697fadad7f969ee2a7b28cd7caf6f27b40110d668e6a8bd25551d1915dc43bc99dc65348626
- SSDEEP 98304:A3k03kHR5FfkZcer7fkZcBr7fkZcNfkZcDi6:A3k03kHHhPSzP1zPpPO6
- TLSH T118560856F6788B32E0BBC079C5D26659F93338450BB18ACB024DEB2C2F376D585B5326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 5.4MB
- SHA256 006caea74c55af9f2e036c4910f910f2bb5f4bd6d1c69687d8b905ca3d100298
- MD5 92326f884222d544f169bdb93c57c7e4
- SHA1 b47d870af95de43ea5d375f48f997f731a35a48d
- SHA512 d3e58f7ab53a8d97ac20f5148e69b8e67a6d5283d5f979a68ca1efe227dbe46428e4c57f0850e577b4723df4fd28463ef83f5c2d929b43a27d37228105b8530d
- SSDEEP 98304:A3k03kHR5FfkZcer7fkZcBr7fkZcNfkZcj:A3k03kHHhPSzP1zPpPj
- TLSH T16046F716F5788722D0B7C0B9C5D6AA99FA3338455F308ACB0285E73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH