Overview

overview

8

Static

static

3

2026-05-27..._i.exe

windows10-2004-x64

8

2026-05-27..._i.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/05/2026, 15:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-27_6689e1f98d5d85bf3d6d5c3609bc5d49_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
  • Size 15.0MB
  • Sample260527-s1lp4scs21
  • SHA256 143dac099f7e4be584e96e0daa73aecf8f54b03004ed27950c270d8dadb7cbe6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-27_6689e1f98d5d85bf3d6d5c3609bc5d49_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-27_6689e1f98d5d85bf3d6d5c3609bc5d49_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1132
  • C:\Users\Admin\AppData\Local\Temp\2026-05-27_6689e1f98d5d85bf3d6d5c3609bc5d49_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-27_6689e1f98d5d85bf3d6d5c3609bc5d49_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2124

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.7MB
        • SHA256 e89a34afb94414421e19cc82eaa3a21b4d62d9233b619efe5b67f2680d97c72f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.1MB
        • SHA256 8b0b9c61af783fe1f1ca54f7dcf60dbcd40b1fb0590f3d73182dbe806495acfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.4MB
        • SHA256 3c34e8da5aad6b6aef2546a4946611e79dabc39cf203941b071545fc86d3c787
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.5MB
        • SHA256 710425f9019a9e4c1191519467a3853c3a30ac9c06d83afaba209786858f6589
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.2MB
        • SHA256 912884e15fee744251aa509d1fb189316c4514923bfc448b80b10804b8531779
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.1MB
        • SHA256 5b137525e2315a23f689b53dc6170a103e441583cf104784c8070dea250765b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 31.8MB
        • SHA256 413a1798255db2ffb504b110819a36cff0a9072322b3cad176283adc9778246e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.6MB
        • SHA256 45974bfc79a74a9793454855688eaa524cc10a05765a6a71f6a02dfe382197dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.4MB
        • SHA256 1ac816da656b8b2a086ad43d8f01e3adf18afe8736566ccf316cf5e0990c6e4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.7MB
        • SHA256 92542e0e767110fe1ce042f365cece765d6330222af1b314a5654e25de93025a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.9MB
        • SHA256 f645ca8afaef867ca5a560a82d7d599dcd20856136f732e89c6fa9e23d1f91ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.1MB
        • SHA256 36a6a3711438b4700e9a7399dd0dd9fab087d55c8a4058a38e360cf4a1abdb6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.1MB
        • SHA256 855ee5595d7b0d792b1ca63f66f39b94e5abced580c191ecbf7073c1283e5c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.1MB
        • SHA256 9714a5a1e40cfa832c840bbb97fb862973ce12e61896aac05668389a9e18ba1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.1MB
        • SHA256 71e9d71bf93a553763fcec244110e4a000b7ec66807277c5034872e19e54f84b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.1MB
        • SHA256 d2655ead6e1088cd13f82db29f158227ce304e376f6272e31533e8758337a6e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.1MB
        • SHA256 ae0b63af6448bcb673844ad57f0c6064a09266cd8098657e61f26c8a5fb5c954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.1MB
        • SHA256 600a1262d00ad8a390880b1308d19b45c6e72d7c2ca72a400307c178b43f71d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.4MB
        • SHA256 d703b1428e9008f155043f62830ee02677d9072c7b98cd0250ee15ef6b0bbb69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.1MB
        • SHA256 ad480aa5da597434336af01fcb76b7db0bbe78bb1798e86a4f986bba5455c5ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.1MB
        • SHA256 6c6eadadf8135c5476d4732ad8cba2800c0f25a1ae0fb16e4f67f385e20411c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.2MB
        • SHA256 bde30f8240f02d968f9f4f1d798e605ce8158371d347704a6328216474645530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.1MB
        • SHA256 36f2f4978004da1ff0881b212758222ccfeb941156867bd5ab209248c3983cbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.1MB
        • SHA256 a4a69fb4cbf6bf311aa82b52dd72168dd0ad63a652411590f1aa164db1e98db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.2MB
        • SHA256 fe6b86b72fe9b0c4459a80ce089f8ffb78fab8252de1f4b3a228876e5531e349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.4MB
        • SHA256 7b9efb92c087d897697a127d402c5f0497b1b9e00817a8953ca2323e03db1702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.5MB
        • SHA256 5437a0f585aa3eaeabc47815db92fd8a255271880e12279d64da38e5aeed2331
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.1MB
        • SHA256 d4c7fdd598296dc6eb3a75df1aeb184fb0f0aa26730b9c010f3aecfab6bc346f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.1MB
        • SHA256 e733fe8c8099f2bfc4c16aa58d56caa63119c190f51a805cc334a42e63bc60a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.1MB
        • SHA256 e5802642e4ea8efd0ed568bc581686fd33627d50934394c5f8a8402f5d67d10f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.1MB
        • SHA256 9ed0bcd2670c1259a42e23ea04d16918044a043d37982abbf1b6f1eaf2ef9f67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.1MB
        • SHA256 1720950234163b9d2a2b9cbaeff8e874a021198a12c897ac9694a5563e72bc18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.1MB
        • SHA256 c450aa7bafb633a45cc81500073bbe2cebc6249fd8c444ddf5a3d107a1a26bb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.1MB
        • SHA256 8821da2ff2e7ea0841b524337b115e60cb3e1d36312304ebbf2a3457533d8565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.1MB
        • SHA256 23d84254f03e7049f435b86bc8e1c766579be26659e884b4efc00f7e0273784f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.1MB
        • SHA256 eec8913460f16f9e56ffa24d93081b332f9ff5fd4cddae1ea785812965c342d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.1MB
        • SHA256 9b32b974d9f36d6df224d35506be9653b5de09ba7a6aa396f45bef9bfddfe77b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.1MB
        • SHA256 b2ac0e0b48b76ad7733221879223f5dcc932bedd3cbeb8be39f640e8ce65f90c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.1MB
        • SHA256 ccaca9a85b25ae8c4803234eba80a45e4b2bbfb13fb1d3a0ef086650e54d86dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.1MB
        • SHA256 097d751c8bf3fc091033dc38833935d5e1a987f27e6d098bb8600f4631b3866c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.1MB
        • SHA256 a4c6e892be3be3a20abb41ffbb4eb8bc977eab5fa1d60f86447ef7e3aa9ed151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.1MB
        • SHA256 1b8a24f845ed7e131f43174923d897a534285a610db458c6ff043519e618248c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.1MB
        • SHA256 c4bc6fe170a77b302558d4f2597806ecca0c760a6525963b2bfe9537ed4017e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.1MB
        • SHA256 e724eb73ff750248b157d689b6b6d3495ce38b354a68f53fdadffe976e62583f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.1MB
        • SHA256 af53cbf8a91cf24ec337aac5a2f4d9aa0ed280682586dac9afbb4387073ba3c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.1MB
        • SHA256 4a1546feb7a973d181c55611c7f07cff1c1266dd8267092af983afd8602108de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.1MB
        • SHA256 527e08df98523cb8508ea5898c4265e5a5da51c601e4d1c61d4d2296b37f9aa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.1MB
        • SHA256 3bd93ce45556c6b4e1d240abb4f17bec0b5d5551de044fbd242a5538c0727028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.1MB
        • SHA256 dbf084ee67591f91c2dd97be48cbe29dfb87a89cfdb2c22f554352307f871732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.1MB
        • SHA256 2cc408d27c5cee0af5c9684c91e2fedc04cad693b922090b0e1b99d87e8a864a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.1MB
        • SHA256 3265319432edb00c40abd166ef16facdc4950789fc5511b58efac96d58775278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.1MB
        • SHA256 5f274bf576d46a1d38b74dfac86494160efed6eb6c99ed38613d84efbff6f242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.1MB
        • SHA256 a51b4cbb3d6f45ddd2b0fca6936c6af8862356281c7462ae66e4d9517bb05f71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.1MB
        • SHA256 462d128826613882036e3a1e72084d5e315d4e2f44d706d3a928d3598b2686af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 30.3MB
        • SHA256 e2d6093de912072737bf721c262acdcc864a418676a7b1cfea6d97d3b4b1ab3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 30.2MB
        • SHA256 cfe3eb82ae9f7e1750b010e1be99faa989714b7b09fb137aaa61b8d00dfd64f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.1MB
        • SHA256 5bd162b407ff7698f839bf7cb9dc100be89305fb6d369d331d0259bd1f6002d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.2MB
        • SHA256 990baddfaf1ffce38ed925b2497927c265033a1c2e0f6624e0ea5222f9322fe8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.0MB
        • SHA256 143dac099f7e4be584e96e0daa73aecf8f54b03004ed27950c270d8dadb7cbe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download