Overview

overview

8

Static

static

3

2026-05-25..._i.exe

windows10-2004-x64

8

2026-05-25..._i.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    25/05/2026, 14:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-25_50028c4768cc49dd0e477e6628b7cb25_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
  • Size 7.6MB
  • Sample260525-rykvcset9y
  • SHA256 299bd5ecc761b19acf35eb1397451c0cc9f56f17cb07310ca1966e8651d176a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-25_50028c4768cc49dd0e477e6628b7cb25_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-25_50028c4768cc49dd0e477e6628b7cb25_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3832
  • C:\Users\Admin\AppData\Local\Temp\2026-05-25_50028c4768cc49dd0e477e6628b7cb25_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-25_50028c4768cc49dd0e477e6628b7cb25_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3460

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.2MB
        • SHA256 143cbf2d32a9d8c9a3887390bb2b4d181611c798118da7beb2c8617b3129f6f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 11.7MB
        • SHA256 ff09e7f1735cee3c7a46e9ac3f3af5f14447321a55d291eaa14511af659c066b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 7.9MB
        • SHA256 b63ebf29984975da7eca955fcd941afac4cbba9aeca7608a1b5c9d595829944a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.2MB
        • SHA256 56ab4178af6fcdc2c4de1439702101fe952a70a602fe014dd5621e875509d0b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.2MB
        • SHA256 51f37b0b185a636a97cfa1f979c125d23bb214c69daab75bfae51d607950b893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.8MB
        • SHA256 223163395f004a6c39c711346ed8ad755f1867821b034bb4c9192dbe7acb8d46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.6MB
        • SHA256 9717c42b01d58d563588dd624e1875025da9b94d8cea94a761fd9f78bf6c9053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.4MB
        • SHA256 b5160885ddc063703a7d3a46585f02929e0e6b4add2692ab5f2cb8c16e0b0c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.0MB
        • SHA256 2ff925fed68fdcf7850cee70b02ec2e1bda9d6b2886b7ac4f77350095de25902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.2MB
        • SHA256 b03eba3be85db3b9a155d7f8c519174b20f104169462735a2160646beac040ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.5MB
        • SHA256 7b6b31d715d66ed12b6a872555048185fee494c8dfd40e3f38c5c8059d16fe0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.2MB
        • SHA256 173b3f33ef7c5edc58915472130cd7d69c946bb67f8518ad50a0460b7e8a755f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.2MB
        • SHA256 525f46c63a5131fdea211f6f44a373592dafd13b9283c5f9e9debd929ff48261
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.2MB
        • SHA256 2722a39a6a825d3b34661684cb6993f67eee916b5e784bec50d3e952641a5d02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.2MB
        • SHA256 3c98c59b4f27f3df249eb30989bf24b303a4a06031bf661e3a433076a266cf08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.2MB
        • SHA256 3ddfbcfd410500484dfbdcf28dd5d173bf8513c764b55ceb720a577d0290bff4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.2MB
        • SHA256 cd924d18a1040bf268c6b0db351b2f9f6268e7042cedf0c25ce4217e846d11d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.2MB
        • SHA256 62ea0c2167a2cfcdbdd82778d56d95eacf085c4afeac9754aaf2d04aff12178d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.4MB
        • SHA256 add038d768b2ddd552f02a8560d1a4cb33ef9f6f3b4135ed96382c5a6d95ff66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.2MB
        • SHA256 93d9d110b78e3b152f8f90813b7b23c3d8082b8e417718501aa273a38980a9d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.2MB
        • SHA256 af1e70939a2a1cd65a7069ce49f84ab710fe2a593f8a02e337608d3da294dd02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.3MB
        • SHA256 7f4e2dab198b195dfcda2943e6a0bc11020e67d058075bbc14e91818f742e0ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.2MB
        • SHA256 aaf1926037f29d874b64389475cdc841e60b101ec317ee7ddf57491b4252837b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.2MB
        • SHA256 1007afd198c1ead060a7b9ce7b370c3c926f3775acb224225c7a9eb3bfccf413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.3MB
        • SHA256 c6984ab914fb1be6da2ad8b1608c7544abc444973fc4d2eab2ec7286a411ae18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.4MB
        • SHA256 3be265ad9caecc38e6225a26494294524ebfcd47132729ee2f9e553021f037e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.6MB
        • SHA256 115ffb6736c8b5f26b57ccba3bc6f398481c4e7480f733c8954d336598e2df5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.2MB
        • SHA256 4b719c2b78d31c86749950b3cdc3010b7d44d6c2f13ddf6004932a2ac6680731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.2MB
        • SHA256 cd25470a2202db095bac148a1ea05329fbefb28fbd6b5399382f46e68eedd363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.2MB
        • SHA256 bac44140978e9d9ee6c4ff6a1232230685450c9627509e32cf2102b0dbbc43ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.2MB
        • SHA256 7b81a6b3f723da4822ba0c694cfd3d4b0a24dc76fbf1f97681303c769deee7d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.2MB
        • SHA256 bc1b3f7c1d9e85441664dc61d5e32857e443ad9d5f94133a4cb08958a5ed3c26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.2MB
        • SHA256 f744912a9aebce55ea63b51916a35afda4911642932467eeb138ee88d0aeab7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.2MB
        • SHA256 18b114f2acfadafd505dee1eaad3b2976b784c6d2ac4b5d184129902a9fc6842
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.2MB
        • SHA256 9d6642232b0f99f429a209965b7624aee8f7d49b1c91b58435af895066dbcedd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.2MB
        • SHA256 ec5eb59a60e700664b36ba4ebcee175d6ea4fa174ef568d54a316184a80c0d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.2MB
        • SHA256 44d059c3815c8bb884cecc893eab0226d60f3cabb6723edac8267c1220f498ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.2MB
        • SHA256 a868676e261b563ea5abb42ee0841a5503b2eb1e03fd3b6c34eabb0b3e754539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.2MB
        • SHA256 32f8783f230958515e1900158f62188588d960f4e5b6a4c46cb838de47ad78c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.2MB
        • SHA256 7e35e800e96804d6e8c5d62bb67ddf3ae96bbe3dfae8e6af0549cd7ea1c86bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.2MB
        • SHA256 27a42cfb5fa9baee01759333b96e9be794ab99411ed5c0070853755426137bcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.2MB
        • SHA256 172d8bbf167f5095ee59f076682f87f044cfd765aa7e71798a88eafbd46794c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.2MB
        • SHA256 6a679ffb96965fe370e1327dc16cbdb25639a3d4542bf48beea5d5eae6316642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.2MB
        • SHA256 3b4c813446a62b01069da2b41c91d7aa59e6e6f63515980979e38eb1cfc25fbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.2MB
        • SHA256 04aadd031c4a1ff72c59600a2f5a9d4b6dfa44ce04c649924450185003af059f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.2MB
        • SHA256 f54b205693f938c632dff77f84c188cabf0f2c2eff733316aaf543e33d9b807f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.2MB
        • SHA256 8cd740b3f24c6d53c034ae48501225a901a5f0598b3234fde3ee3b5155c9a174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.2MB
        • SHA256 646752e25daea7b6394e25fa95656897e4da4e255ed517d411ea2f90d971baea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.2MB
        • SHA256 1014f9581ad519c9b8b1efc9a2303beedecd45e93c59cb3d15fda235b03679a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.2MB
        • SHA256 36d9cb965095784cfb88ad3a62ab7ca23d50d3c539795deaf92dc46425386e9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.2MB
        • SHA256 ea847a79c301f1b3549de4a0326751bdcbfe4d3dd661febf41abc69fd3687d63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.2MB
        • SHA256 1c3afc1c81be34df6197c9ade3233252aed8517d446f905d1ef72b524129d4d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 15.2MB
        • SHA256 727e8f0ee5db8e81af99aa0179513cc649149329f73940a7619459a0fae5e81a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 15.2MB
        • SHA256 5f27e9764409923cf15cbed46faac411ad79dbe831ecb7dc056600a27005a712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 15.2MB
        • SHA256 be77ac0d2a6f3f8f1b298518987524f40ca1e2b6f771d0e24768b17e74a77d39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 15.2MB
        • SHA256 42307e4fd247a20b5d1160c6fc7b13e3d52e1a2eef696e9038710594888184db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 15.3MB
        • SHA256 a322469ade43050236dea3109b73427f115218b2e1a43021f34e50dd4239be32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 15.2MB
        • SHA256 21f6a881ad8e5e0ab7089602c12c7d23ecf2c48689b453f171057b2bda23e2d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.3MB
        • SHA256 92ca44850d12d8ea6a257fc2b3849e03ade199d78b11d2f5a48106c2f397847d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.2MB
        • SHA256 5abd8405f96ded5560fed8cbef91f87bd961eb4fbdd373d60bc4674db86f55d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.2MB
        • SHA256 d478d47a31632ab2154985df8c9c2c6266c2e707db82f439d01ab5394500d39c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.2MB
        • SHA256 5f2523d5d61f8626b50bde900a8f338d9e30ce3ca03757241252bee297dd1c94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 7.6MB
        • SHA256 299bd5ecc761b19acf35eb1397451c0cc9f56f17cb07310ca1966e8651d176a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download