Analysis
- max time kernel
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 12:26
Behavioral task
behavioral1
Sample
2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260820-pmhjrazxe1
- SHA256 1368779966770a6a9466f2a0575e38e8e0408e3adbc7e5dd03dacf59ed69dcba
- MD5 77a60441321d62030420d6ddbab90c29
- SHA1 b4d9607d5abe56565cb305d0c07b768807c8c3f1
- SHA512 07bf4ba2e278fa865b0d738685fe2bb25b48a4ac82816ea5bf6b0297f0398ccb57b830d7cccd0adefe1e4a35ed1b7bc30a4b1533e044b85cc3ea6ac5a8a19592
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/W0yGh5jcAkSYqyE:A3k03kHRJARJLpYq
- TLSH T1D7657C17F6A441B5D067C1B9CAD2AA56FB713846173097CF1388C7292F23BE19E3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/5312-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b6f1-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000016b4e-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5312-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4788-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-424.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d38-1254.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000400000001b6f1-5.dat aspack_v212_v242 behavioral2/files/0x0004000000016b4e-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-424.dat aspack_v212_v242 behavioral2/files/0x0003000000019d38-1254.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4788 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5312 2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4788 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_77a60441321d62030420d6ddbab90c29_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5312
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4788
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 1368779966770a6a9466f2a0575e38e8e0408e3adbc7e5dd03dacf59ed69dcba
- MD5 77a60441321d62030420d6ddbab90c29
- SHA1 b4d9607d5abe56565cb305d0c07b768807c8c3f1
- SHA512 07bf4ba2e278fa865b0d738685fe2bb25b48a4ac82816ea5bf6b0297f0398ccb57b830d7cccd0adefe1e4a35ed1b7bc30a4b1533e044b85cc3ea6ac5a8a19592
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/W0yGh5jcAkSYqyE:A3k03kHRJARJLpYq
- TLSH T1D7657C17F6A441B5D067C1B9CAD2AA56FB713846173097CF1388C7292F23BE19E3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 ca87f33e557ae32b2f3f7a2f09efabdf116f89e58c644ea31bcb930109336c96
- MD5 1a8ce1b1fef20288d09e78b94f5caccc
- SHA1 3d40c78333fbd250869e716cf4811cdc79c222f0
- SHA512 8fede86e6f6a7f8f28ad47e0d6b5c9cde28ac0ece3c5c64fff68fad3d75ff058a80950ffed975b5cad6d2150f6ef6a03a0ca0d2348d32ed67e91ad181ae95daa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/W0yGh5jcAkSYqyED0Le5ji0hmxNrM:A3k03kHRJARJLpYqjPji0Aj
- TLSH T103956C16F67442B5D073C0B9C5D2AA9AFE71348617308BCB1385C7282F67BE59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 1.4MB
- SHA256 3abaff0e9b43bd3b1ef3653214330a3f74b182fa69efdebfb3ac93ae219f16fa
- MD5 a6e6d60807a923d11a79be2eb4a48851
- SHA1 0b3c4bdcd2a2867697f11cf4eeab79f0489af302
- SHA512 8a3fd5b574bab7066cbff7b0419193ab0bcc4bab073a82d176cf038cc9cc34b77c7de48e826faf9ffc7c825778dcdc50dcac2616875f895490cf48067f25b642
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/W0yGh5jcAkSYqyEj+:A3k03kHRJARJLpYqi
- TLSH T1DE658C17F6A441B5D067C1B9CAD2AA56FB713846173097CF1388C7292F23BE19E3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.4MB
- SHA256 31e31eee7b2352e75249971a148c7bdcbcd2f386463e01b7b23f14255c930f98
- MD5 c1bc836bfc7b68cf0c855802d4b002dd
- SHA1 d91d918033292b0773f3c0638a76769ae394c90b
- SHA512 4c92258667b1a194f09e8f97cf962bb75eb25fbd4a443deb5c81fe54afa7e67e3ef60c296afa8bff30d89247bf698aeee976834039a578841ef22766e792a043
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/W0yGh5jcAkSYqyEPF:A3k03kHRJARJLpYqt
- TLSH T1AC656B16F6A441B5D063C178CAD69A56EA313C860B309BDF1358F7292F337D1AE3A760
- MD5 SHA1 SHA512 SSDEEP TLSH