Overview

overview

8

Static

static

3

2026-05-05...ry.exe

windows10-2004-x64

8

2026-05-05...ry.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/05/2026, 11:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-05_b9f1b5e7e672c8b3234fc58e8b5cfea0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 15.1MB
  • Sample260505-npbcsaes4x
  • SHA256 42770da0cd403c88d3b7961dbb51838e18e5a5446891d1f250dac26b72d210f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_b9f1b5e7e672c8b3234fc58e8b5cfea0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-05_b9f1b5e7e672c8b3234fc58e8b5cfea0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4420
  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_b9f1b5e7e672c8b3234fc58e8b5cfea0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-05_b9f1b5e7e672c8b3234fc58e8b5cfea0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4304

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.8MB
        • SHA256 5883369e11261bc93c479a190b608bd31a970100d019f25eed888ec5bb1dd161
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.2MB
        • SHA256 f69f8f39015188c8226078b2a4c7b362ae89f311bd9aacd0f6defbd42295745a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.2MB
        • SHA256 379680b00497c2d8e8e29e45e82db66117aca61762c76858f218e16b9192c329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.4MB
        • SHA256 10b3d35bdad7904e2b2d9a78b065c73c78f64b39e155e75b935d240875114b28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.2MB
        • SHA256 3e14bc26b25f7d8fb627e9511dbd93dcbbdbc339afc9a3c556623ff9553693b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.2MB
        • SHA256 818557005e87de1e3235f53be3448e221a8e226c66b501b25702f238e178b8d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.4MB
        • SHA256 552bb77186727f5444b52840ded93ffb6a46922d3edd775c57bc7d8110c84946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.3MB
        • SHA256 8ab6e0081c111387a488a770da9486e936bae288f242101891cb7475f6f4efa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.3MB
        • SHA256 3c4222e5ded6d67d1e70cf6dbd49770ec42cb9fbfff3b730e8507d39f28d77f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.4MB
        • SHA256 dfea614376b8dcbc6cf199875983cff68a94b54f1022889d9a2f662d565a4d27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.3MB
        • SHA256 71d7562f9c5a7885bbb58ee3391818f0aadfd2c5050e09bf8e449f97da87e5fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.3MB
        • SHA256 0d4dc462e63611bc63ca570192818f5085856fbcfc15cbbd4d34f43ef8bc0507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.4MB
        • SHA256 bbc3a71ce26fae8c449e8cbc3bcf410ac5b0991dfdf68dad272e359011d49fc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.7MB
        • SHA256 9f03ad359cd90472ef8a7e834bbad0a0164ab81ea7e38ef8749a1fdacf057c48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.3MB
        • SHA256 cb5845083c623c5be09e35e2937deb7453d67621198e30e4a5f1baf51cd3c84f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.3MB
        • SHA256 2eb0c83ccd82247bf9d280656d9467c667dd0bbfcedab30c10affdd079b7ac5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.3MB
        • SHA256 7ed10287921f974acedde5c24b13db9e487a730c51c3bc0ad4563661ea75e0d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.3MB
        • SHA256 e909fd78551317060a2f1dc19b9336ea8ea407d7be126efeacc9925e278c5143
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.3MB
        • SHA256 46f3a9db2059edc1a7da0a6fc48ccf8edc3a57ef126e7da8ebf18584b97cec9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.3MB
        • SHA256 c279e8d17907b0b274c73f8fc2c8e377df6faf1edbc5be825620fd75f51bd566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.3MB
        • SHA256 7e0af1e61d452d4df15aa20014eb275b9fed3c7443b3cd9e22221144cdf38570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.3MB
        • SHA256 6379a984c4af5a6c600211b2405ad96ec325b6ab6d796f519f375636f5ce493d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.3MB
        • SHA256 db196e6f1a4e95a1b0ee00f3808a7ff54f8e11725478b475fb614ff476ef529e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.3MB
        • SHA256 ed0eaf387adadaebeffd73f55d5c974f4252dcaa73ae6bc31e5bc71b28d6a06d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.3MB
        • SHA256 19218d5df93cdc67e376a94bf7140046bfb0ee8fe62759cad6c0b724db1d4c9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.3MB
        • SHA256 06ea509c1cfbacdfeb2997edbcac8fd6c97970584e5afe1e43235629ca7f5bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.3MB
        • SHA256 4ad02497d2f123defbc0968d55e9daced53c70d93cee8f693f2509e50c61a41c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.3MB
        • SHA256 a6f49731269d60c515e8aa6d312791485f14fd91db1968537c7583ebd6b3cf68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.3MB
        • SHA256 85abb2d53a06a2a8c4d57bc85a18b76375edd1aef1febe0e65d6eaa46939636b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.3MB
        • SHA256 e82adee556c6a6a45fd6b082a1786f579fcd0e4f168885200caab75d8256adfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.3MB
        • SHA256 01474ae7c10fc60b69c14d4fca5a3423a665b2c4ab403d4fe0a60fb3ff7ecf36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.3MB
        • SHA256 2d9f3790887cab89ecb36cdcf35cbfc7597f610603bbd080e4682d3d9b167be3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.3MB
        • SHA256 6414228c7f7568d121a275e60a02d4459de9307b006f8d5afe83404178773c69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.3MB
        • SHA256 b13b0270b663ce55d32dd706b2dcee4e3eef011aa8339d562e73407faae53651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.3MB
        • SHA256 2cfbb2a7ce6dfa2671d350589e9208233a22b1c1d343dbcaaaf683d0fdbed5a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.3MB
        • SHA256 809094af00328ff0a0802386ecf9740942ae9e70aa0621536671ca1740f53786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.3MB
        • SHA256 aee859f3aa23858f9c55a742d69a3e26db9185227965a4f2e456a2b5891b2cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.3MB
        • SHA256 fa56d72e806888dc20127ec706d4399a709355ef0781110f72ee6ae3d82272cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 30.5MB
        • SHA256 9312a9301440e24da8a25ce29e683c7761dd839d01007bd63ef3bc4f551de3e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 30.3MB
        • SHA256 1a391979a4115d4f45f6a733b15f452a39a8ca9fea0e7482c116cc54a08d1b77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 30.3MB
        • SHA256 320b56463967128407b5a0334e66af99673858bc69b06bed1e558bfffdfe6edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 30.3MB
        • SHA256 5bd7fd4485efe521c885b300a9bd329c3a9e95e3a43694784bd1c8db510f8c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 30.3MB
        • SHA256 e525a05c56735ec23e44f038f62b000c515712abc2c6ebde8f1926f391221427
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 30.5MB
        • SHA256 8313d687c23c23813f78b45bab435b5470ab6d8937a25ef855cc9332b3d9134f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 30.4MB
        • SHA256 c0e83619e0b9c90340d3f1363ceb73af72a19e8b75a7bad7ee8b8382d9e8ae19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 30.7MB
        • SHA256 750a8e05baabe7da0b36c46a7c1bdb4abf2313295e11fceec62b114fd75be9fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 30.4MB
        • SHA256 b1e61f7b6d2a289539ea0c98f83c097acd57239177fb67b02e2f9232d26baf76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 30.3MB
        • SHA256 6ad329cae3fb9983d65d5e445a8477d1941b2296e6be078295f636f10b56169f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 30.3MB
        • SHA256 2bff7250c6629195e7e8d29bdb7b177e72ab9885d2cbe734060ddb1503f89371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 30.3MB
        • SHA256 b67ba483fe5e1b6c88602d2d129c881c692a3d1154dfe4bedcd3fc451c9f5ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 30.3MB
        • SHA256 1024ded636e5d7756d1a444e516397591d527ecf87e8472ca46b8f592ecd7e72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 30.3MB
        • SHA256 8c617643e728c1483e41bad8d3bb4e8376951e4d54c9db700c3ed74c8e99bbf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 30.3MB
        • SHA256 f3c674428cab5798817ea44a60c099251940b306710376c73b4bcf3db9f174ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.3MB
        • SHA256 87353015e871456f2d302e534f538e8606703fcbc3efeff451a8c8020e5792b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.2MB
        • SHA256 dea9f5b16d4aa50d29c8bb2c71e2e2f272233073516dc3bf3021685182e2a116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.1MB
        • SHA256 42770da0cd403c88d3b7961dbb51838e18e5a5446891d1f250dac26b72d210f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4304-4-0x0000000000840000-0x0000000000960000-memory.dmp
        Download

        memory/4304-445-0x0000000000840000-0x0000000000960000-memory.dmp
        Download

        memory/4420-3-0x0000000000B00000-0x0000000000C20000-memory.dmp
        Download

        memory/4420-446-0x0000000000B00000-0x0000000000C20000-memory.dmp
        Download