Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 708KB
- Sample260821-a2w85azapd
- SHA256 e61587ac7578255e218a605dd6d06b4a507cf49cbef9330201c46964e0ed5307
- MD5 29937a34d24f1d52064ea8fe3a3d8708
- SHA1 38f459ad112a4938bf7ee565183b3afe4df0b7d2
- SHA512 e3843549cfd027c61bd11fdff91e7c14d12871753577dcf1253a1830e300ea74b33214a76a65d370d0bde2657830c90d5634cf3af832344f71b1747e74d53e9e
- SSDEEP 12288:kbdfsezXZNYVLeyUji0h90ZD0wxpGZIVuKrHs0:kpvl0Le5ji0hmxNrM0
- TLSH T178F41B26F5B48731D073C0B9C5D2A79AEA7131811B308ACB4385D77C6E67BD68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\tar.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\mmc.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\systray.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\format.com 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\attrib.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\winver.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\takeown.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\more.com 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\newdev.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthHost.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.26100.1_none_67309bf6fa5abf27\runas.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..microsoftedgebchost_31bf3856ad364e35_10.0.26100.1150_none_faa81bed523ab303\r\MicrosoftEdgeBCHost.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\sethc.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\r\pcaui.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\r\WerFault.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.26100.1_none_e9f03efdb03c43d2\dsacls.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1150_none_8be227bace421d8d\r\cttunesvr.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_a94df8cb819b49c2\more.com- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_31216c35fec422ae\cmd.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.26100.1150_none_84c881fffaa85756\DeviceEject.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.26100.1_none_2ce74853de1f47d4\raserver.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\XblGameSaveTask.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\mspaint.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\bfsvc.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\fclip.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.26100.1150_none_74a667b087b1ac17\r\PerceptionSimulationService.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_5e793e3cf7e6453d\netiougc.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_823d5f8eb617914a\userinit.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.26100.1150_none_2bd28325d6e61084\dsamain.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\nfsadmin.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\r\LicenseManagerShellext.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.26100.1591_none_10d0d236e479806f\r\WinBioDataModelOOBE.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\AppResolverUX.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandbox.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\r\msinfo32.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.26100.1591_none_e6af58ceedab4a7b\r\WpcMon.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\mavinject.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.26100.1_none_705e51669f200004\powershell.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\r\services.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1_none_b917a4fda287fde2\diskusage.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\r\msiexec.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFHost.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\r\Magnify.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\r\rdpinput.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\wuaucltcore.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_ae9fddaa60638ed8\PresentationFontCache.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1_none_6a9bcd9421c5bb20\ieUnatt.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\r\psr.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\r\nslookup.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.26100.1150_none_08d020c05bb7ff70\CameraSettingsUIHost.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_4b983a10daa468ad\odbcad32.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.26100.1150_none_8e0a1d6fce8b1d12\adamsync.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_d15372b5cfadcb04\sfc.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\r\EoAExperiences.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\diskusage.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\typeperf.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\r\EaseOfAccessDialog.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.26100.1_none_543fb8ac1ab3e68b\appidpolicyconverter.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1150_none_db80809a7f5d5459\dsdbutil.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1_none_10c9402dd04d0788\PresentationHost.exe- 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_29937a34d24f1d52064ea8fe3a3d8708_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 1.6MB
- SHA256 3054e1c1fe3fc30d9f64b6587a2be79f02769039fd56c97547fe8052490914ce
- MD5 7c4929a4e4ac654ac5307ab34f2ac764
- SHA1 e6e043f75b6ccf964a82977580331de80b1bf7f9
- SHA512 fe0e92ffdb12986d6d97b5ca4f29bb137a1f3aa58a2d92b3befe96dd964b9623c5a62c137b2188dcbf1998bbe0e85223388abc61d753861000527f895c04b6b6
- SSDEEP 24576:kpvl0Le5ji0hmxNrMia7/ezSC6vUyD/aqgrvWx6q8wyue:kp9Pji0Ajy/ezSC6vUzPvMHjyh
- TLSH T16085F825F5788333D0B2D0B9C5D6AA9AFE7230425B3089CB4246D76C3E277E68636735
- MD5 SHA1 SHA512 SSDEEP TLSH