Analysis
- max time kernel
97s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 14:55
Behavioral task
behavioral1
Sample
2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 954KB
- Sample260813-saxppasdne
- SHA256 c710d843101bb276bc2e03048d1d634236a0d00832373427d3260bcf5b61353e
- MD5 bd8aed3763da7f138c6a074302b3eff0
- SHA1 555e6744399b9e95621eb97cec7fedaee39aa75f
- SHA512 fbfd6fe4504e387f4c02ae82dfc328778634ebc29f3b7f8e54ec61b9d42b25e9d70ddd4d3ef067fa2c6332fef37b02089ac2867c1b7c13a991f8d59feeb7a509
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjNascMJlANa:A3k03kB56r5RJ
- TLSH T160255A07A6880FA8D11FC1749A968A62E7737C121F2097DF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/4188-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c553-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4188-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3272-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f9-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-421.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019e47-783.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a03d-821.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001abd1-1062.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e0000000066a8-1867.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c553-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b2cd-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f9-41.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-421.dat aspack_v212_v242 behavioral2/files/0x0003000000019e47-783.dat aspack_v212_v242 behavioral2/files/0x000300000001a03d-821.dat aspack_v212_v242 behavioral2/files/0x000700000001abd1-1062.dat aspack_v212_v242 behavioral2/files/0x000e0000000066a8-1867.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3272 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4188 2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3272 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_bd8aed3763da7f138c6a074302b3eff0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4188
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3272
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 954KB
- SHA256 c710d843101bb276bc2e03048d1d634236a0d00832373427d3260bcf5b61353e
- MD5 bd8aed3763da7f138c6a074302b3eff0
- SHA1 555e6744399b9e95621eb97cec7fedaee39aa75f
- SHA512 fbfd6fe4504e387f4c02ae82dfc328778634ebc29f3b7f8e54ec61b9d42b25e9d70ddd4d3ef067fa2c6332fef37b02089ac2867c1b7c13a991f8d59feeb7a509
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjNascMJlANa:A3k03kB56r5RJ
- TLSH T160255A07A6880FA8D11FC1749A968A62E7737C121F2097DF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.1MB
- SHA256 c16f384bb43a50cd9c5b9e02815056dc47aeb38b7d66856362b130bcc79cb6de
- MD5 42861446dce45475bc964c0e0e1276ab
- SHA1 a0c786a1381fa5feee696587b6837eac46db4efd
- SHA512 9fe464b57ca87a9bf9ca16679a7bd877b164470cf99aae026771a9d4e22560754793926022f29061dc3f40f13013971026a87a41c6aaa01b753971b31d9d3e70
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjNascMJlANalbBPzBAFUj:A3k03kB56r5RJdBPVAS
- TLSH T14F457C17A6980FE5D11FC1748A918922E637BC125F209BDF1350AE153F32BD0AE3AB57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 b291c2ad9b6f8d3ebda921328c2112b3f125c73cfd76376c69bdff1874f7495a
- MD5 13d00ebf0f36342e4c2c17b5decf833d
- SHA1 59e97bc90e883772f9dd7c1aaa145c776ee147a2
- SHA512 9e70580a4ab8e5a9c3eab77e55da353f42e0328c3eac43e26a24d36668912a7c2251133c0e895d651be61af549feadd93158daab7f3572857ee66c89166bbdf5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjNascMJlANaP0Le5ji0hmxNrM:A3k03kB56r5RJzPji0Aj
- TLSH T1BB655A16F6A44BA5D06FC078C5D29666EA733C421F3087CB0354DE293F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 969KB
- SHA256 888ecd859942101f2d0a0ffdcb98ef66bdfecf138fa6f0a8cb0a5591b39e4034
- MD5 9204b308f900f1ae8213d5a4974b7911
- SHA1 5cba368ad1be357a0207c76d81c7811832ec3831
- SHA512 6475298b129315e630a6172ae37894fba1b7b52c1f4c3231f75a8dc28a9364aaebf4fee55a535c7874f3f4bf961b8794fdc70dbd96cd944b79160cbe3898ebf2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjNascMJlANaRa:A3k03kB56r5RJ
- TLSH T151256A07A6880FE8D11F81749A968A62E7737C121F2097DF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 978KB
- SHA256 d5af8e2ad0c27cf6820d787ef6ef2668075d23de6feda44c7436cd73c72cb93c
- MD5 153b6de4948b22b5f82a7bec06c776b4
- SHA1 2cc9b89bf905adaf7649474916dfed919fc1ff0e
- SHA512 39f45139184ad02f6a1add0e8dae9df66a82f2dc435ae7b1ef9605a9760a4a3cb47cbc8b13e088df1242457f7464834c295a14503d1b81277c0bd374c0198b3c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjNascMJlANaUo:A3k03kB56r5RJH
- TLSH T10C256A07A6880FA8D11FC1749A968A62E7737C121F2097DF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
- Size 975KB
- SHA256 f15fd854af3e3fe799b35498fd4aa8249b4bcdd508e76926919284072d72b43b
- MD5 114da25c1697565322e0718ba13f3748
- SHA1 6cc6c2cef2f3cb242ac914d8c3bfba8e46d68458
- SHA512 149d8c8bc635c33609db73b8797d2a41a53c87027016c55219f3ba54983293bf27923f6e1296e1ead7458da2428196c67df1b4babee81aeee6de1f27cfff38c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjNascMJlANay:A3k03kB56r5RJ
- TLSH T185256A07A6880FA8D11FC1749A968A22E7777C121F2097DF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
- Size 975KB
- SHA256 3de847cc7862c275cd7b6f6e926d629933ad7266a12c25bde7a43e431a448f1e
- MD5 2b7cfeaf891f8196a636b958bc4d4df7
- SHA1 28e875898b442e35dd4fbc4d66395b2b7869b346
- SHA512 de0f2daf72b29d01eefe5b7ecf79f761fd1c413ed03dc343918883814ffa5cb65c63cc55798ce98daf1c24cc1be32f2c6258f79c23a5c1aee3e14e2434949649
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjNascMJlANaej:A3k03kB56r5RJ0
- TLSH T18B256A07A6980FA8D11FC1748A968A22E7777C121F2097DF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
- Size 1.2MB
- SHA256 8919659db630cd9e2a85ac333e93b64c047990fa7721dcbf2d06eb63b89f7007
- MD5 b0a58ee158a546ce64691827cab3b1fe
- SHA1 ebe4c4f29f049d3a25afe84ad69525fa799204c0
- SHA512 10cd6b97bd495f1d679842dc6785c75b2da3d55d736efed8240901e92937fe32329dd1cf0eb2c3ea508561ea3fd009324c7d184bab3fd3932e8f2bbbe927f61c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjNascMJlANagWolMk:A3k03kB56r5RJcN
- TLSH T1E0451602A6440AB4D01F81348695966EE7337C15DF235FCB1354AEDDBFE2AD0AE39272
- MD5 SHA1 SHA512 SSDEEP TLSH