Overview

overview

8

Static

static

3

2026-05-30...ry.exe

windows10-2004-x64

8

2026-05-30...ry.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    30/05/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-30_c5cb3f115c8c453bfbbd26ea2130a64d_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
  • Size 8.3MB
  • Sample260530-sdtr7sf17v
  • SHA256 0bdd06bd20016f0fc2eb58c03c384288869074f43fe15f6c8dec558f4d79af3e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-30_c5cb3f115c8c453bfbbd26ea2130a64d_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-30_c5cb3f115c8c453bfbbd26ea2130a64d_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4048
  • C:\Users\Admin\AppData\Local\Temp\2026-05-30_c5cb3f115c8c453bfbbd26ea2130a64d_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-30_c5cb3f115c8c453bfbbd26ea2130a64d_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1316

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 17.2MB
        • SHA256 671cc173d4720de69ab26cf12ef4fa639c972760523a80034d06bcec2491204f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 17.6MB
        • SHA256 61e28d6e640c64f3ca176c3cd986ddbea0d1763c4f18342c89ffd4d94f114520
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.4MB
        • SHA256 72bed41aa17ade716f58380af19e028d472f1c7b4c967dc5902d3bb660d074fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.7MB
        • SHA256 95a9efdad93afe659aaeba1f88ed068a0cbe3091c6185dac5f87623e1f0810f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BackupRead.asp
        • Path C:\Program Files\BackupRead.asp
        • Size 17.2MB
        • SHA256 22cd4977b219f7644bab7d290fcd31737315d7af87ca434ff8045171ef5bff82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.9MB
        • SHA256 cc9ca1668f6e61b474b0147cd79bec24666458752d6e7ee1338188f384d611da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.7MB
        • SHA256 bf996469814921e02cf2de98964b8ba973c59937fe44b1c63f589715fe11dabb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.8MB
        • SHA256 373961a449310ac046876c7cbbf2f0baadb9fa74c2eb6642a1514b91518df39c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 17.0MB
        • SHA256 393fa8be30743421099a7c02f93b8275b0fb474fe766d606d345785b9fab79da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.8MB
        • SHA256 ce8056704d4a88c98c6189630bb7c1f24b0341482e01b979d7eef01ca290eed3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.8MB
        • SHA256 ba2b8e970962d1084146118aca943ce43edf2b057c79d5f594bcfd88ade1a392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.7MB
        • SHA256 b4f45f920233035638538da35576ce546b054734fd00aca15e1ed018665e9039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 18.4MB
        • SHA256 97b20adc411b01ccf04d3365fcd12cc531d5bb477440df30e36c1c1447f86900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 20.1MB
        • SHA256 e74e308ee074ef6452a1155c9fe40241b34befe2e54928b8e75d53132034464d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.9MB
        • SHA256 6e0d58d672f4831f4e9b00467dab516fc0966f8d1ea86646fe65fe17e511b136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 18.3MB
        • SHA256 7feb826fd782f9a5808ddbf7c937da6ad5bd0bf833b83476d399b409530f5fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.5MB
        • SHA256 d657dbda73ced066e7e29223c19948c460e033eac68c258a3b6040de26d3d813
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.7MB
        • SHA256 5a9a09afd5367e0dd599c144d30cc931dfdf193d062d6e43f39b3bc880b4d0d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 18.1MB
        • SHA256 e367ae663f061d4114e8715e9d2d995fd2a62621b6b8afa2f511e3596a5f1985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 16.7MB
        • SHA256 304ce49fab31c3c547d3f9e31bb74eb9996aad085f844735f969b30c87d993fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.7MB
        • SHA256 6f239544cb4e913e3a4c88091581502f186406d6ca79f64f1154d3d1a8d1abac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.7MB
        • SHA256 be71e5ebf4f5458ae4e403732ac9a57868d5d4ea114db90ad39f60ab56a3886a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.7MB
        • SHA256 92a35952a3aaa357f8c09f5b7e431e0feddfdff92e6beef6e6c236781b5de1e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.7MB
        • SHA256 9826683679b4741fba9d7481d67d1c97d9e99b1678ef5cc9f6ffd6144136aa3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.7MB
        • SHA256 98f1b176fcf13a20ea1f7f254718ae30e08f6fe1a0b43f8fe36f6913776efb9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 16.7MB
        • SHA256 3e05bec5c74a1bfefc2d1ca9e25d6226f22bee7800ef9bbb695f1c942317a2dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 17.0MB
        • SHA256 3606f05f3a9e3122dbbb38fef6c41624453454923f1f7e5f128f009aaa626ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.7MB
        • SHA256 61c33d3ebca311890de08d58ab1795571cc3ed40039ac9f2c8d2645bde51e6e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.7MB
        • SHA256 b6e95e4a6ff9591d9fe2ee92d0211dacf9c526fce581dff8458b08dd810586ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.8MB
        • SHA256 ffb5ccd7a957b10cd0273384d8737c4c0cb37e86321e585c385e9901a773d398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.7MB
        • SHA256 e2320d3f1bdca4ff71f57c1fb3f7dff8df984eec4211b3d89d42a0e1579a9257
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.7MB
        • SHA256 ca4bff68c8a03333766980e08f2305dabddbeb0d7b79e849ca131c6e4092603f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.8MB
        • SHA256 8aaa6209acf8b509a7d574ae16c7f77fce71316b19d6cedbc5948bf28d047c77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 17.0MB
        • SHA256 5c13c20be193650147fa02550b06a52b97a5b4662bf3fc7fa1e5df28e58b182e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.1MB
        • SHA256 bf336609862232ab02a5a14ba66dceb5299310a301a348234173605e6f5fcce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.7MB
        • SHA256 61414bd6b7aa383754247825faea80eaf5fe71254239d4652ade408bfffd84ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.7MB
        • SHA256 ab914e373c2561d2c18dd972c1522b2f06540aef4fd953604b5db062de429f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.7MB
        • SHA256 f2dab29a92dc1c14da38c422fafb7586ef1278d67be1538479cb8860e8b2faff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.7MB
        • SHA256 b19ec723f08e5a9b2e6271d75cdce06aef2b5cb870cb0c4feeaec9d72bc0d07a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.7MB
        • SHA256 5bdc3ea8526f88ff1e20ccc0bfe796fca63f6cb64cb5d1306024c9ececd78fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.7MB
        • SHA256 02ab561047f6816f441ba26733d735f75fe458bda84c9f0331fb90d251d74a09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.7MB
        • SHA256 4c388deaf73ec98d876aa1831a99d15369a4be48d031d8f51dad81f0a5045301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.7MB
        • SHA256 73287d4f9c073dabf88820290633bb5d8883ca452ad060031ff54b79d8e4756b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.7MB
        • SHA256 1ae609659c40e3852d4cccfff632633aaee4e3df436a3004ed22a31209047273
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.7MB
        • SHA256 0eabcbd43258c56b0877029c3162cb155eb13708a38126d4fd8673b59f4bc1c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.7MB
        • SHA256 3b4314b6540d3dc90bcef7785d3f413a3c70292d79806cc86aadcfce78dccb11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.7MB
        • SHA256 e1a145e3cb6ccac40942d1421fa072f5016473e24a07a484b6afab2860fcb965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.7MB
        • SHA256 ead186ed59609f8fb0d01cde80aa85e6951ecd96338d29f159eae6e8d505e563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.7MB
        • SHA256 296dd04ce6461e1a330fc2072d6dd655963620c90ffb8dc6fec07321f7287204
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.7MB
        • SHA256 be60337686bebf502471d97994b2541f25c71dcdc245cb490abe9605c94da278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.7MB
        • SHA256 bac8eea8b2dc5387a6edd78ce4e9bdcf7c3d387c4205c5415117df442c43672b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.7MB
        • SHA256 3f4f0830be2d864d51b44db926befaeeb1a934ac93c1f90f6dd5b5c8ee175554
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.7MB
        • SHA256 5be3080ed737f96146db5621badede53cf79f9da4cf07bca4ee2b48562d32928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.7MB
        • SHA256 ac80cbe8c089d9aadc778ec458835a615bb27ea6f17d3e4a690f80ed92f90c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.7MB
        • SHA256 3b499a9bbf40ff8183666bd27b708f64f1d0abaa868338ceef7f42179dbbc12b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.7MB
        • SHA256 a1c0439918735a8e157e55bf439f577120131148e17eea23157f5284be347b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.7MB
        • SHA256 a9c794f3069cad7d655ef97e039d385f95de209b12e7944b1fa9d4d27ea8d617
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.8MB
        • SHA256 698abe067e3fd317b944dae380d580623aef6f5ccd82a93ab4992a8e04a57fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.7MB
        • SHA256 0632393ee1dac77a762e85605cbd5f5df0bdb4f248bcfd62b8e3c75fa5c65eba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 16.7MB
        • SHA256 dbd70b577904e0e76ad05f310b9ee0702f466d141c1ba911340c64c5946b37b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.7MB
        • SHA256 695ef185a8243351068d464685865e96ea83622074d71e28ec753d0f0f8a0688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 8.3MB
        • SHA256 0bdd06bd20016f0fc2eb58c03c384288869074f43fe15f6c8dec558f4d79af3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1316-265-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4048-193-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4048-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download