Overview

overview

8

Static

static

3

2026-06-02...jr.exe

windows10-2004-x64

8

2026-06-02...jr.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_a81a6c27c38911a1e6f988c80cc3dcb2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
  • Size 18.0MB
  • Sample260602-weyz4aby5x
  • SHA256 5fe071caf5ae7e45064c050f7e7b39dd73a6dfd3d0fc719540349b86dfef9b2e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_a81a6c27c38911a1e6f988c80cc3dcb2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_a81a6c27c38911a1e6f988c80cc3dcb2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5212
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_a81a6c27c38911a1e6f988c80cc3dcb2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_a81a6c27c38911a1e6f988c80cc3dcb2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5000

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 36.7MB
        • SHA256 77c2ebdfb0e77f30872cb5aaf795b9d3e8878c469eeb9888ae6648e60f664287
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 36.0MB
        • SHA256 081758f1a23658ed31a77579102a9e9926823dfe9e53ecb9c7a47a69513448f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.3MB
        • SHA256 32e9182be9a06a0c7af18cea44d53d048572601ba333fd510126c72a2c4a7e3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 36.1MB
        • SHA256 f375d7ba538795a07d71c6db00d24e7f51b59959a5df926eb97b81ed438bcec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 40.1MB
        • SHA256 2b62a09d03f665b192e6b6908d0c2fac5a875b6be8ee3b795abb48b480d366b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 36.4MB
        • SHA256 fbc63b28cefe3dc43cfe25ebcf08e1d4c230aea153bff2abc98fe82fc5b5c3d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 59.5MB
        • SHA256 1162d54c09e7fdbfe932ba54bb63fa453ebcec1f66ea67eecc43e099d603d5e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.1MB
        • SHA256 7447ccdcfe46ece353ea74298052f743bc9dbb96e13d67fb7dde8c2f7dbb89b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 36.1MB
        • SHA256 628bebf5c1f59ed4717b1736eedf0b66ed63ecb92cc46aff070212522a087f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CompareApprove.exe
        • Path C:\Program Files\CompareApprove.exe
        • Size 36.5MB
        • SHA256 451c33c65ba1b33be8211c947f12df9b1b58f723966cb5dec77d325335cd9249
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 42.1MB
        • SHA256 878831a8f7988587e0d1f85da3d3689e5a915aa0c1bdfc881bd1920c17ccf7ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 37.7MB
        • SHA256 7c41b115a3a3250b52f847c6bd043f1bf75910138903848ab804e846d0904c27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 39.5MB
        • SHA256 e06a571b5ef3eca169acaaedb53f9bfd560215f27cc9800af3c2f80b8783fdb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 38.3MB
        • SHA256 a5361d50d39d6ee51e4a135856ab5664dc47213b865454864159cb1f861ce6d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 256KB
        • SHA256 a88ab2eab13680012502e10692ec5c6fb70e333b6df630e671ad53aaa93b2f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 37.9MB
        • SHA256 fcff0b928c440c9a1b0825c17082ef4309ebb3d0d2f837027da4f0d3260f1705
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 39.1MB
        • SHA256 0d959b6b0406188dd40044bbce1a172e1d84e06b0049ae7f0b27335ebe767c7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 37.4MB
        • SHA256 215482ee9bb23fa7c2c070f4e7f6becf5536010037fb8d56dc68ac80071334df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.0MB
        • SHA256 b042f37cbc74fb9f1a1d9cfc3068fabed91c8c84d8761edf916362e9326a0a4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 36.0MB
        • SHA256 7e210281c53247a3f88da871e5b2bd333da9af5a4cacbc717ec3fa1115adba79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.0MB
        • SHA256 b3dbe694d6b31144c6e30917d6aa63d174eb467e9a08e992ac06b8f2af711317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 36.0MB
        • SHA256 0235216f9e4a5631a8f7d041e04e520d35bd7e12bc9060840d526d39b185ea74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.0MB
        • SHA256 b2806f7836d73a30e219e30dbea2b278c61e64fa804a806c1fbfc21c9509ac09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 36.0MB
        • SHA256 a9ad598dfdea92baa9843fa6c5d46c2d36598a16350c04737cea8face0d0dff7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.0MB
        • SHA256 829f92cfeaf3cab72e794c3aee30690d61b5207e4ac30f70d9c98ce2bc0440e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.3MB
        • SHA256 3ac33226a5490360932d4c3eb18b29425080c3bf2eb737a5ce7166ceb805d352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.0MB
        • SHA256 441f7dd1325e14a2bb5e0264dde8c026ba8b357657edc6b13dbc4f3dc3e71a20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.0MB
        • SHA256 0ab08658f63d5c5011be7b1934be6ae797edc6025ef80f6cf0a15ccb6e3dc127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.2MB
        • SHA256 5048a7333faf22f897600743d80eae813dd9ceea38667fd0cc56b898e43c1676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.0MB
        • SHA256 4d2dc778548be2bb0cc7399fb7418f2dcf58f6eec2dd70850b230d39ad08e3d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.0MB
        • SHA256 a4cf449b336f2d246e42cb745a8fe22913d1a79be57af102cce6b5cc9b5f0f5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.2MB
        • SHA256 44a48858ec1a0214e5d02e9cb718bf673ff4ce1e6ce34e342a821c5bccd047b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.3MB
        • SHA256 a7bcfe2eddd0e98f22998306fa88c6f5e014bc0116ec24ff46759df13dce3b59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.5MB
        • SHA256 62aad4a7b81d5b22fd16ccab647eed22444d1db2c76ff1a1d0526260d0fb4f21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.0MB
        • SHA256 fc3a12305af2d5638b7fb701795684599678a0fcfbfc6994d4952efdd9e20602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.0MB
        • SHA256 7ad430d51856e199d9e19a6baa814bc60f2922b2305e0c09826331c6a9c74f35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.0MB
        • SHA256 fe82eb002c470b354b42d4ba862fe89818d3424e501396acb746da111f050e58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.0MB
        • SHA256 e83b16203f2531b794666b217891b96638a97e28e7b3d51607ade35b9760c209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.0MB
        • SHA256 c4c0f4f3ef93c506f1cda7d481a8df3ca43b30db3bc3538b46ad4958e34fb499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.0MB
        • SHA256 592e40a268be60d8eadd9b31c5dceeccc4c8fd9698ad0d61567065f33cc387fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.0MB
        • SHA256 705075b9f5918f9366d7fd0dae83a6a2c0faddf8c5566050baed65177490c030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.0MB
        • SHA256 622a7a35aaa7a127d2f7e94b9256f9248b91f7545dfdf1967204df55d4e42f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.0MB
        • SHA256 33825db8c680035253fe528a8f94e0fbe7de3152fd514af24eb3d8e9975a7c44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 36.0MB
        • SHA256 11fc24ecaf9320d599167e076f03e7fa6624f2d3f6162eb8b1a00bdfe068d078
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.0MB
        • SHA256 4308d83c0c7cb778996545fd4e62b32ea4488552e99506909cc35a74e854c640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.0MB
        • SHA256 cb7662ad65df136a11d66de0b136b532a8e4106a5efb2cf50729786908745819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.0MB
        • SHA256 c58415f3d19c71ac95793960207f071a00808abcdbdffa9246b3c90dec03fdb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.0MB
        • SHA256 cc9f5a973f98cdee39c11a669c780fe31679430f38bb4f99bdffff76b7966a04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 36.0MB
        • SHA256 246d74a5d87dd6ae9a86df7130fd3b528ffb5551fc6f19b2de7f66171c0770af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.0MB
        • SHA256 481924081a0aa0be59e9204a361ef4c1e37bdf09fb39d6bd8b1edff36dd41919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.0MB
        • SHA256 78e145a861da96f836c60d3f4fcdada04c64eb3c4a4410068afdb8b8ba85fe97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.0MB
        • SHA256 0de6310dfb336e9f066055dfe95b8180539a5771f164dc0efe4758f2b74c3e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.0MB
        • SHA256 6a5d40e23d000fe3fd612fb3ef2ecd98d6a6761c5cc47336e1ead330778d2597
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 36.0MB
        • SHA256 dfc56b9212f55f46274acecad53522964d3858e466a4fcc83ef82310470df0c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 36.0MB
        • SHA256 9c41501eeaa034827832483fb45b356d1d1470e5ff7618d3825f65c7b09d41b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 36.1MB
        • SHA256 da8fc9da942af728f78d435ea47d1b98506acc83e6b7637db26806bd6356bef4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 36.1MB
        • SHA256 8081642359f69829a0364ba5dc3915d41938b9d2e5c2af36da265162cd0ed3da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 36.1MB
        • SHA256 4648be4525d934a9eeea76ea91eea342afd39e2aec3fb4b822c0871173cf9668
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 36.1MB
        • SHA256 378c640f2fd0b7636a3cd56f8ae6c7470e4baf4104e6ea8fe5d6f1f95898ac7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.0MB
        • SHA256 5fe071caf5ae7e45064c050f7e7b39dd73a6dfd3d0fc719540349b86dfef9b2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5000-137-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5212-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5212-98-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download