Overview

overview

8

Static

static

3

2026-04-21...ry.exe

windows10-2004-x64

8

2026-04-21...ry.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/04/2026, 06:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-21_49f6630de4512d7553a9452a0a16a854_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
  • Size 7.5MB
  • Sample260421-gr7qfacv8v
  • SHA256 2ba317451df19bfc7e61db0d4df7c8f92c2552a213f98c7b09f45f249240e335
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_49f6630de4512d7553a9452a0a16a854_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-21_49f6630de4512d7553a9452a0a16a854_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3796
  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_49f6630de4512d7553a9452a0a16a854_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-21_49f6630de4512d7553a9452a0a16a854_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4004

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.6MB
        • SHA256 59852bb83af312901bb6120f6e699fcba653931168e1fb93ded4cce3c882a24c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 16.0MB
        • SHA256 fc4e59b37d6945bb940a1fc6013cb747f36a63f9e7f7bb399700a492b1dde117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.7MB
        • SHA256 5fa8d0dbeec4a83c2b3ef568691a30d401ab3ff44ec5ab265a5b78edaf5619ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.2MB
        • SHA256 da191a2ba14f1761c3bfd6076942b3425e6e9a8e6d9eeef64a9611f976cd4e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.1MB
        • SHA256 4ff5dd907874a01e77256f3cc485e53406a34da7a6203f18835fdf6bce59b04f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.3MB
        • SHA256 54f51cac91c74c4d0b36983b9b36a54327e3514f0d9eceeeea15113a47751430
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.1MB
        • SHA256 651c8b1d898d4c259a4bd8f9db791fc372a4a2c76a4f18957362466e28da813f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.1MB
        • SHA256 5e263900b6cbbc824441fc8ee83c17ca414bea4dbbb6c4a9c71a6704ab56f0d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.4MB
        • SHA256 03bbb13bdf5b0ad2d305631b2dcedc91ac32c3e6eb80b52d3f292292ebc1c08a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.5MB
        • SHA256 eb1cb22b2c3265c552a7acda1639ab5f795cb45f15aa3cb768234e0cbb349105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.2MB
        • SHA256 2c08d30a5de222235de93b8455434ece23c13cfb182d17150a7750f3549e1c4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.1MB
        • SHA256 aa1387f7d32baf55a3f6bbbee28e48afa2149af729419602a3e3c562651be0b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.1MB
        • SHA256 5c80f7b61e5729122e71c7c6b3062e187ee72ce76f7b145455363bc9d73355a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.8MB
        • SHA256 c244bbf1d8498295ffff4528bf5b03a5188cd65fbf0e2d1566ea1ce2639827f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.5MB
        • SHA256 5d44df528f86741a314419f548feab50c813511d3a90300bbd17a87ffac2da32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.3MB
        • SHA256 350e46cdac26fc31cb2a89a862703abd38779074fee40fae6ff9462f06b12984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.7MB
        • SHA256 a63302b60087999bd46c7c3a4657c6e1ad55e31977de2f36b092734eb2f2604f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.9MB
        • SHA256 f016bdbe325db6e6c989a798218ce27b16c9bca81762c2b547396ed12063ef45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.5MB
        • SHA256 5aa796dd4932fb2d7eecef342fb88d02706eac3b35d2b0d858e2a9c910afeaef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.1MB
        • SHA256 b9a7f588ecdaa4f9db396368bfab16fe295f60901095680a2145f51932812c83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.1MB
        • SHA256 183e4e1c1707ebd577072d3a4473ba86d9f61f2924ea78d79afae359ef331ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.1MB
        • SHA256 033745929cb414e1c42bf215c8b96b203c34e0af31b3b489449721aaa55bfa7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.1MB
        • SHA256 26d121f142de99eb695fe2eda997b4954a301f30df822f4be2b15549026deff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.1MB
        • SHA256 fa18d15546d98fac65b7cbfd028ec3d8ed6383d44a3ce285e189a70282d23c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.1MB
        • SHA256 cf4159f4d9422e69b6c0952095c31925b6442ede87383d184bed9807e4eeb028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.1MB
        • SHA256 eccc120194f848b5d7f39d0908df0cd5aa0aa2cb8e0d047ed42a98febf09446b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.3MB
        • SHA256 a9141710d928dce752c4ef3485f028c357b3d9a788e3aef96af79afe4de81147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.1MB
        • SHA256 000fbaf5a3238b1e86862b36d58509db732a8707790e0d5aa08dbdaa5f4496b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.1MB
        • SHA256 c16969ed88c07253ebf789dc112723451e8b25b8a62c7f79a9cec8756e57be4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.2MB
        • SHA256 ead7f6f1b3cfd658c487d4bc7d8be3f7f64d3349a619313b3e51d9f72089edb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.1MB
        • SHA256 923c20e6b8e98399e307ff9490d96a654b8894fdc582ffb5a9ed800a8c84057b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.1MB
        • SHA256 d09106eb2d02cd11d2cc7cdc3dd020ef41e8c3479ab96c437fc492523e2a8ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.2MB
        • SHA256 9c1c5bbda295a318d6e0a7bb526f9bb117aa8981ac4b71b29fdda1995c1aa32e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.5MB
        • SHA256 1d3c5345ff35300eb7557610a811f2feb9ac48a83228d6af5e6fe03480a536b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.1MB
        • SHA256 53671e153c0736782697a6961491ab7e192a6d74a05d6bf7e4fc43fdb8fa1ef9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.1MB
        • SHA256 e85ccb6b6d866ec54ae781c1c25f50e5646ca597c9cfa0e71daa36c526f7fcce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.1MB
        • SHA256 393e84169778484154a38ebe067e20972a7cea61c6991b57d8578f325e33259a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.1MB
        • SHA256 bf23014acba4ae8f14bfd097fdb5549ec9cbe00d0e41190aa89436137f3a5d88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.1MB
        • SHA256 10fa5f6bc5eddd1ac32905c96194ea09079262b41520c70c71bc780c3b09f191
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.1MB
        • SHA256 d9e6904ed284a66c1ae64adf8fca1638d56848b0a37ede07857d70a41a82dce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.1MB
        • SHA256 055764d6cd5ae4d30f7ef40b6767d6500e81d56a21576120d916a59d7edebec9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.1MB
        • SHA256 8ae37189dac880a339e6a0d75b0d2c9fec1f5416e9ec3a6ab031a084be7305ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.1MB
        • SHA256 a122fd5875d849c25a24831729f88cef13761d3aef59fd3cafb468cc6078f591
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.1MB
        • SHA256 0afa67c810d97a14234e2b0f667d0b79a65ebdec1e04de98c4587607cce83e45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.1MB
        • SHA256 aee1799aebdb793a52aaae0a93e447c82ae0124ddf241fcb1f8b3f3088063a86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.1MB
        • SHA256 f347bb522a7614910118c022d1d3f74d7ceb0e8ccde1dbfc45d5a1a703f7aa9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.1MB
        • SHA256 e261dfc5559ab91c9520860ef245f30d2d7b702babdc3ed4cd8c096b8026da4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.1MB
        • SHA256 e580898fe7292d6003bc10f5f83cd77e20bc0066d07086cc11b5da46504376fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.1MB
        • SHA256 a0270d180f5eb0d80901e25f5ac22826408569e9f516ddd23a74cc267b270ef4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.1MB
        • SHA256 151b5b53b720c8622fb0cd176f2abe62144345e35951eb2c29fdb2a49c507d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.1MB
        • SHA256 22b6f3b59d6e0aeded78487749811bd5dd244fc3261c13ab9c20bc97c7279340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.1MB
        • SHA256 52a739269fb5af546071aa6425b2de04a435b0056be5a37f8c6e755cdfdf9ca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.1MB
        • SHA256 c90913b9734124ce27af9af5a80ec500ac1a4a865098fd5653b62b238b4563dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.1MB
        • SHA256 ca845be5fbd3f14578bc1dd59fb62588321de282d36640a29b5005e1274d0e4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.1MB
        • SHA256 5fe020e8e97faca0205e18120326820ad6beb5c027c1e8dde654c414907ecc2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.1MB
        • SHA256 134783fbbb49ee3af0925257fd8764c646af79274cc8bf10d978879168741b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.2MB
        • SHA256 2d26c49d5ca0c80e3d9b92c8ad4af801715d02f8cb38db8b471adebce7ab933d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.1MB
        • SHA256 d3efde49568ddd06aa5c5a87845347e52ec2d782451312cf37029d42fc8aeedc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.1MB
        • SHA256 71c03e63d07383fdf8a2c544834ecec22962153c9c36174f669c3677381b8a5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.1MB
        • SHA256 339d0511ab2ecc3887891000ef68593f6d3df20c1a2a424a0d7558708fd7cba7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 7.5MB
        • SHA256 2ba317451df19bfc7e61db0d4df7c8f92c2552a213f98c7b09f45f249240e335
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download