Overview

overview

8

Static

static

3

2026-04-20...ry.exe

windows10-2004-x64

8

2026-04-20...ry.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    20/04/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-20_a67e9e52f8296fa9aba59a1a28c9ca13_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
  • Size 7.5MB
  • Sample260420-sdxh4ady3m
  • SHA256 f3a625c971217116f0e86a6682a33b3b7b9fd329e2a624f8c0f9007a094c0126
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-20_a67e9e52f8296fa9aba59a1a28c9ca13_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-20_a67e9e52f8296fa9aba59a1a28c9ca13_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4836
  • C:\Users\Admin\AppData\Local\Temp\2026-04-20_a67e9e52f8296fa9aba59a1a28c9ca13_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-20_a67e9e52f8296fa9aba59a1a28c9ca13_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:716

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.5MB
        • SHA256 e18a36cf6420bb3733ba5b0cd9469ed27f25dd760baecf4278c00680797affe4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 15.9MB
        • SHA256 0a04de2f3ae1202a20f6b84b2ee39763db7b1873c7f03b01d7b55bf92e65a297
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.6MB
        • SHA256 9f8aa8bbc73dc0445f63b46a3b1d2f60db7a8c29e2ec3f455dd008db6cde97c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.0MB
        • SHA256 59d962ed98ee252103fbb02b9baf2020efd3025547c42b08899901e4833a4821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.2MB
        • SHA256 d2a48926c755ec41c7ea647ff5174adf0a2ea8202c512352c2e795786f9c0ff2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.0MB
        • SHA256 b1aba4962cb471baa94de6204aa3fbb21ff86fccf6c5e842f2c2579ccf20edba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.0MB
        • SHA256 5e5863b16deb648bc2974b2c2641cb273b6581232e112feefc8aea762aa24cc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.3MB
        • SHA256 2fe079b6c53eae5cb5614f45fe222356b5044cea602c5b6b3a59e6e7d08dea3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.1MB
        • SHA256 b3263069596ca2c73eb5fbff922e0d06dd23b9b226e12b25a3fc6369dcdbd7e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.0MB
        • SHA256 16547a62d47b39a8e406908a36f6960770ef600fbc11ae5ebd1b6363866b7315
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.0MB
        • SHA256 2ea46df721278532ed0690b30fac8796a6735472201c6735e5b7bdbd97e8d888
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.7MB
        • SHA256 55cf4c5a78b752594c2fd5930c8eb7f9ec949b9912488dd47ff294e762b0a924
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.4MB
        • SHA256 85848207f36652a4f1c2e581e16cf598e59deaeb02f2ef9985fdb694961dfc59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.6MB
        • SHA256 c95afc066b1c27e7673ae01f9a309190c6eb693cef3de9c9da11a85632d9d677
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.8MB
        • SHA256 b38b4761a5ab4232111f17693beccaa787d19422aafd787333b05fd64c5ea7d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.0MB
        • SHA256 c82590a71db88efcb150549b9292e1a3983fba4f557594132a2dcc5cb82c56bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.4MB
        • SHA256 eb6675a64d828850b109f3312f7104f6227e9a34a9c2aa49f3ecbea9c7a3583c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.0MB
        • SHA256 54ad4c545c37e4170ba2e0220fc28ad96dc0983815c5fe6d3daf85b56eaa73a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.0MB
        • SHA256 1eeec9c777c3ca13c4200ba2401d3f20484a99e9ac3c0cf7dfa946232f8ef5fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.0MB
        • SHA256 5c85f1d7982a2a536aa5d53df84f4aeb11984ef4a87f5d158291b378a10e37e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.0MB
        • SHA256 834dfe874fa6b71e1d5487f9727e7ae6114641b1368d780ba2c457e468ab86dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.0MB
        • SHA256 1c86f3207d37b8d4683d84594d2f1191d08b9aa764b645b4e36476480dc2d324
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.0MB
        • SHA256 0116b22d664f5a761a6787b89ede2fefbeb331555a912d6e7d8734b20b848587
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.0MB
        • SHA256 df671f69b83f1098bf5f89e612fda1b404984b642b764b296c980ae954e1b443
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.2MB
        • SHA256 3c71e214b6de5eeb839f6860864e039872066c7fdfe465bde8f75e3174594533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.0MB
        • SHA256 db91e347399849bae17b983b17c825b44f583ed4bae985f4cb0d9640707a65df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.0MB
        • SHA256 d7fa19dff103d3f4b9db9c400428f9db6e5bedddb68332525cf557971e28371c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.1MB
        • SHA256 0c6d31bdc7192b34796e7e3c3565663571a8f91653cbee7c727f2e74d1654a3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.0MB
        • SHA256 881a8117b601406032bb3f06215f7b54461cb9b9dd6c2778c22d6c1b2b757575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.0MB
        • SHA256 e6c56e777a14524c97c2f0f688b61c2fae648a8ae636a57f4c261c9001d3d1cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.1MB
        • SHA256 07b7fd1fd1b76f87d3c0f358dcb778250f23c0f7cfc7b3947b4983fb54db142b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.2MB
        • SHA256 0872352587dc3d1fe429fe2099bde93688b8585601fa4d6e7641b3b01239bf5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.4MB
        • SHA256 2a2504c26a99014a41558e5cdc12917b82dd5f0ec1a5314d815111db93dfc22e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.0MB
        • SHA256 7048097ff5aad0a5b848cd8c143912710ff16a5e986df534e6c6ba182bff3b1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.0MB
        • SHA256 e31e0681bf7682304e94633025311502a85a78e1f25f6adea19f5ada5633ed9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.0MB
        • SHA256 a84695af09c25e3374e81396399ef22a6822b790277d9184f7fe2e15e7b88667
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.0MB
        • SHA256 ff6167247195a2548d9e62932b983d6d1c4f8bca25971435401184204d454e07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.0MB
        • SHA256 5b4ea93c28d9ddea1b7ff7ec8516ec8b035cef6e91bf6c4b08b86556fcc54032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.0MB
        • SHA256 50c41bbf4b8bbe68690db292c120a581137948581ab333a0a7b598832bdbee38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.0MB
        • SHA256 19192f843e4d4b8c3880ab9c60a9ead8dc084653d0eed69c95ee32e98079ba16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.0MB
        • SHA256 be69cc620631ea4c42ae84a93e4801a57cf3e37d8c0347150b4cf1b968037a29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.0MB
        • SHA256 911e0c8a47e4078648b20a25283a9ba513eeeea192c172287938fef65d90ed19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.0MB
        • SHA256 457cfce3a09773b715ae9769115c65745d901eb7a757ca590efabff63e019b89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.0MB
        • SHA256 58afaf8737852cc3a885137d7c789e7cf61a038c499130533c609fa8a3d0aee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.0MB
        • SHA256 3f4b5054d272ffd4b791571ccab4a6671c65777c085a93ea110c5ba75f42f921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.0MB
        • SHA256 0633ba0c9f5d37707bb8ee66def39777dbd8a18c4292faae74057386d471e5b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.0MB
        • SHA256 b931e4a1b1538ab8d265805a02d97c3b7af59bf0e1a499505d9f2fa1abcd5193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.0MB
        • SHA256 d6825467e966e26d841d67f2ce5244074546f6d079f850ec7cd3d2ed3c2521d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.0MB
        • SHA256 40ad3ae447e7839768c0c7dedbc80de2cbbb767a25d3f323326b9f2a66043bca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.0MB
        • SHA256 cfa332bfd23a9d99b4183f0f8c109c5bdf345643cc45a85bda1a4d92141f21f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.0MB
        • SHA256 e7737cc3bcb00e185e5439c38855302a61cb69a6c5c2f80cf4855e9f62827815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.0MB
        • SHA256 6974e5960dcb8c0df6de20824013cd3ce5eca31ab456c733602301fc1e11faad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.0MB
        • SHA256 87e5c2b43302a01eba67c982e3dac40d9fa1e67085114d27a7b39cbf93ab45ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.0MB
        • SHA256 556498a1a2392cd63592f11857258df5e89b431ed2d624cf63dc6e2f569df7b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.0MB
        • SHA256 51dad377a0bbc6aae9085dc0ba843616e0dcf0a4b16c53f36f4884435f917414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.0MB
        • SHA256 16d775a0ada7b1b98c6d6aa72e7809df4e625d2d89fdca90cac606aec61e1ff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.1MB
        • SHA256 b0eab6578178005724dcd235e3b031631105c3e8f136b6a6a75a442515eefb8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.0MB
        • SHA256 fd84cefc1f1eb1b1d3998cab5b54d5ac4d58dcb476aed83f49dc0cb9a1c7ac51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.0MB
        • SHA256 3d8301223a92010bb2b26c9146979cb52b2557423a5556bfe6faa668d2180948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.0MB
        • SHA256 d599baba557ce2a799c0a02dbc2c7ff91ae1a05711612113dcc7c77b008484d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 7.5MB
        • SHA256 f3a625c971217116f0e86a6682a33b3b7b9fd329e2a624f8c0f9007a094c0126
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download