Overview

overview

8

Static

static

3

2026-05-05...ry.exe

windows10-2004-x64

8

2026-05-05...ry.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/05/2026, 11:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-05_b9f1b5e7e672c8b3234fc58e8b5cfea0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 15.1MB
  • Sample260505-npbcsaes4x
  • SHA256 42770da0cd403c88d3b7961dbb51838e18e5a5446891d1f250dac26b72d210f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_b9f1b5e7e672c8b3234fc58e8b5cfea0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-05_b9f1b5e7e672c8b3234fc58e8b5cfea0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1456
  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_b9f1b5e7e672c8b3234fc58e8b5cfea0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-05_b9f1b5e7e672c8b3234fc58e8b5cfea0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3092

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 768KB
        • SHA256 15dfb26dc1572ea34f3097183e6b7658b9b16de65942825e2d5b8d7665d8ab92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 31.2MB
        • SHA256 96f6d790d226433b0a575032822e75b95ea83a028c1693ffacf533bcdecc56f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 30.9MB
        • SHA256 82817bfc46f0830992b83840ea0dfc9e6dbc9a9b28156992feb57515864fed8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 30.3MB
        • SHA256 4a2914b817727712218c16e2f53713064e0290a875f845ad995dfada2d9ce2f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.5MB
        • SHA256 9be43e960fe92bee38e26aba0a12db3b56ad75b551ecaf1f29ed41e012eec457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.3MB
        • SHA256 fc40b1c5a06e9636bfc70f0b367f1aa9faf240f482841707abdeda34b6c9b7ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.4MB
        • SHA256 959a978c453f8d27684a6127018ccafb2c12328f111b96724529992984fe1166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.7MB
        • SHA256 7931c7cde31ade928aa5a303dbf0df5d70a1b1a15b195c69b6786458f3bb72a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.4MB
        • SHA256 7d764182aaecc3a5616b7f53aa2023483349ab7b6863e504e30876c86f49a031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.4MB
        • SHA256 ffe473cd990ecaac3186732bf5b254ce19588628d424ccac19b24b49e1f5d9e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 36.3MB
        • SHA256 26144ce681045560e00cae1fa1384a00ee2cac53800eca289e4b8dcb671ce672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.0MB
        • SHA256 525f43db775c90d02ca293a7fa2bc7ba84e2c173665ccc42d71950fb5f88833c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.5MB
        • SHA256 ba46a685f2f93338b349375fef047cb3fe5d5cd258f52bd8e328b7640a2de5f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.1MB
        • SHA256 b66fae42ff08c595dbcccc4264ba055c30760c35b39375110a56a508e54ae702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.3MB
        • SHA256 4050c6673cf896f528fc6de2794f0d70f52abf5f96232358707b6b1b88a5beb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.7MB
        • SHA256 2d4050fd6addc2be6e8509b5c349d4ddcd779283a9825acb759f6650e39db6df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.3MB
        • SHA256 d414227d9675a1e21e97ac646011e194d96a5aaf82e9423411568df8eb9528d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.3MB
        • SHA256 5b900c8e176bf684d8525eaafc432d79c5fd24cce753bc56dbd84d9dc6ed8c60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.3MB
        • SHA256 cca04fedaa7ab920251c8f4e6fd0ffd8645236e5e97d95a167ac9e828227832b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.3MB
        • SHA256 3552a3a6e4b72dbfcbf6b7cdfc8fce5be197ae6457dc8348880f6adc74835249
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.3MB
        • SHA256 e2f7b94ee1c8fe91c0fe0ecf3dc88927ca55dc77acabed42d959ac1025a8fa0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.3MB
        • SHA256 6763b581018e3628f48601869a0c50d21f7dda41039c313aca696e3e294a3fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.5MB
        • SHA256 2b5c08a7e61e66a1d4f6340787a7e02fbfce0b8343228c4b005a7f33ae6ff9ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.3MB
        • SHA256 8ab6e0081c111387a488a770da9486e936bae288f242101891cb7475f6f4efa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.3MB
        • SHA256 3c4222e5ded6d67d1e70cf6dbd49770ec42cb9fbfff3b730e8507d39f28d77f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.4MB
        • SHA256 dfea614376b8dcbc6cf199875983cff68a94b54f1022889d9a2f662d565a4d27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.3MB
        • SHA256 71d7562f9c5a7885bbb58ee3391818f0aadfd2c5050e09bf8e449f97da87e5fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.3MB
        • SHA256 0d4dc462e63611bc63ca570192818f5085856fbcfc15cbbd4d34f43ef8bc0507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.4MB
        • SHA256 bbc3a71ce26fae8c449e8cbc3bcf410ac5b0991dfdf68dad272e359011d49fc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.5MB
        • SHA256 6b02def9dc40f11f6f5331d996a80deda4462c94e52db1982626faa6677d4a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.7MB
        • SHA256 9f03ad359cd90472ef8a7e834bbad0a0164ab81ea7e38ef8749a1fdacf057c48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.3MB
        • SHA256 cb5845083c623c5be09e35e2937deb7453d67621198e30e4a5f1baf51cd3c84f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.3MB
        • SHA256 409e6a786cc2fb9e4b5e19176b03588432675609dfa3996e0027c6ffed012f0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.3MB
        • SHA256 2eb0c83ccd82247bf9d280656d9467c667dd0bbfcedab30c10affdd079b7ac5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.3MB
        • SHA256 7ed10287921f974acedde5c24b13db9e487a730c51c3bc0ad4563661ea75e0d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.3MB
        • SHA256 e909fd78551317060a2f1dc19b9336ea8ea407d7be126efeacc9925e278c5143
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.3MB
        • SHA256 b01ac5d9694f9284ff9b66a5e4647990bd041985a821a75f0f648255977ab9a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.3MB
        • SHA256 46f3a9db2059edc1a7da0a6fc48ccf8edc3a57ef126e7da8ebf18584b97cec9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.3MB
        • SHA256 c279e8d17907b0b274c73f8fc2c8e377df6faf1edbc5be825620fd75f51bd566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.3MB
        • SHA256 7e0af1e61d452d4df15aa20014eb275b9fed3c7443b3cd9e22221144cdf38570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.2MB
        • SHA256 18696f07626212460ef72e8cde135c39eb976e0206d878e1e82245612516ba42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.3MB
        • SHA256 db196e6f1a4e95a1b0ee00f3808a7ff54f8e11725478b475fb614ff476ef529e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.3MB
        • SHA256 ed0eaf387adadaebeffd73f55d5c974f4252dcaa73ae6bc31e5bc71b28d6a06d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.3MB
        • SHA256 19218d5df93cdc67e376a94bf7140046bfb0ee8fe62759cad6c0b724db1d4c9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.2MB
        • SHA256 b235c0d78b3588e0459fea8d3b0a9255b3516a691544b7be850eed7228c73266
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.3MB
        • SHA256 4ad02497d2f123defbc0968d55e9daced53c70d93cee8f693f2509e50c61a41c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.3MB
        • SHA256 bf26646c9df60c21a644f8ba4f9f2a90856606b4c79c010f0fb773ee5d1e6d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.3MB
        • SHA256 a6f49731269d60c515e8aa6d312791485f14fd91db1968537c7583ebd6b3cf68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.3MB
        • SHA256 85abb2d53a06a2a8c4d57bc85a18b76375edd1aef1febe0e65d6eaa46939636b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.3MB
        • SHA256 f1a05a1aaceee4d868b146fe06648de59184666c9de14601c196d57991d13181
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.3MB
        • SHA256 e82adee556c6a6a45fd6b082a1786f579fcd0e4f168885200caab75d8256adfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.3MB
        • SHA256 01474ae7c10fc60b69c14d4fca5a3423a665b2c4ab403d4fe0a60fb3ff7ecf36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.3MB
        • SHA256 2d9f3790887cab89ecb36cdcf35cbfc7597f610603bbd080e4682d3d9b167be3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.3MB
        • SHA256 6414228c7f7568d121a275e60a02d4459de9307b006f8d5afe83404178773c69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 30.4MB
        • SHA256 ef23da9c3e02d81052e3865485a735d56cc4299d87bd5410caea96706ab50ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.3MB
        • SHA256 428613f4845761c8d84d2bee2d13bc2a1cb6f43c407a04547a37c03dd3815216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.3MB
        • SHA256 19b7d060b3b7351b8927f61f9828f6e9905dd78ea1f2d7168ea1d2bf3f73e44c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.3MB
        • SHA256 1dd8dcc4e048f3d2a3e929a74946a0cb89473d00c73cf4c4d8001c5c7bcd9665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.1MB
        • SHA256 42770da0cd403c88d3b7961dbb51838e18e5a5446891d1f250dac26b72d210f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download