Overview

overview

8

Static

static

3

2026-06-05...ry.exe

windows10-2004-x64

8

2026-06-05...ry.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    97s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/06/2026, 12:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-05_1336f9eee32299e18d7d3dd0c3ebd54f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 9.6MB
  • Sample260605-pqrltsft7w
  • SHA256 96e65b240a5ce0d5e7fd4390dcf0ac9ffeb39b7e0d3f1517d704cecf97081cf8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-05_1336f9eee32299e18d7d3dd0c3ebd54f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-05_1336f9eee32299e18d7d3dd0c3ebd54f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3468
  • C:\Users\Admin\AppData\Local\Temp\2026-06-05_1336f9eee32299e18d7d3dd0c3ebd54f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-05_1336f9eee32299e18d7d3dd0c3ebd54f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2120

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.1MB
        • SHA256 14151d313422f306172511ddeae4cf973b7e8bb54472ee51eaa4f4b6564a1655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.5MB
        • SHA256 9f8db68faebc398a79861ba41322c9c31c22b7288dd7f128b8a7158aa65b0917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.3MB
        • SHA256 62cd2b947fcfbd003ef121c9b304496bf40663e51bf4cbabf0c5afa95ea49d2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.3MB
        • SHA256 50946a2c3b7591b7d371b8c90bcb5d8bd1b7656f9d780a83f614f061c1948050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.6MB
        • SHA256 83ab0843000c5734d16750b68a4f8b3938e8efdfdf58f5f0b1766a9577fbd6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.7MB
        • SHA256 496fbb9ac765bf9c9ccf9d51b3e0d205f80d02e60dcefc64e3dd2a863c714e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.3MB
        • SHA256 4d96c9e3944716c14169f0279f46d3750b6e11ad7c91867a7a18af94cab3019f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.3MB
        • SHA256 2ff0d55fef4039e4aee6e68c33f3f0de4a6dbfa193485d0d71a73d38742b9daf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.9MB
        • SHA256 ea80e17de7ed1dd41d1e96dc087a8036447add16e2f6f6404a3325ac1611af9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.7MB
        • SHA256 06984a3f9bb1178b3f37fef49c57a263b19a6894f10a273b7e80f762ea34a855
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.5MB
        • SHA256 b6ba5922489fdb6be38e05f83875957163d42d5c58ca064fb0906015f301d53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.8MB
        • SHA256 488e4c6dad39319036d0b98e1bcf1a7f15080bbf556a5d4a18a8a4c714054a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.1MB
        • SHA256 fd77fbd6387ca7c05b2e49fc61a99992de938d31c07098dfb6bd4e26f147f726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.3MB
        • SHA256 92ee97ea3edff123e5f3c46cbac9cd4c0dda4a866cadf6ff93e422faefc654e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.6MB
        • SHA256 78e6cf4c2508c1a0c17de0f39d6d7733dd5422972c3355cd95e36a7f9f7edd25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.2MB
        • SHA256 fc955232d84285c508a37ffec34b9ed05630a3a0ddbe6d05459141a27d14ced1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.2MB
        • SHA256 46510017552096ba59f6bb6d8fb21d4373fe57f144469f40727ee60dacb2fcc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.2MB
        • SHA256 a50c268a3b5c5a73b0b8c2fb2ac1ef238e839654c4784f957279f401ffdc0a81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.2MB
        • SHA256 230679050b078ca4d5ac4a62c94486a9f97a427bdfb297e76fdd172858dd10f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.2MB
        • SHA256 d60026ab9cc3c7144b7c039d31a01f1160b9227ef05ff11c591d4828a3699ac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.2MB
        • SHA256 599ae71a89ca96473f4e555c41b22e821495b443cea0540143450062a7a174a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.5MB
        • SHA256 780179b4ba23b6f6d24674fad5c455ae72524b223622789934eed05c862ff0ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.2MB
        • SHA256 c0fcccd15f683072af23965d2e828458e25b4c443e92989031a96ef85076f9ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.2MB
        • SHA256 45526f006ed11a73731e5572f4f99cceb70498d7a2a97189e2d0de891462903d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.4MB
        • SHA256 ced0abdef1d47590e4e2530562b2e3efd914280c2a82cbdb2b1e0fcf7bf3c6e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 19.2MB
        • SHA256 392ce80e6a1ed74b329bfa11396182307c27fe2973706e68fe35da99d0bcbbf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.2MB
        • SHA256 be588222f4360dea9329abfb8e4b29d401295a2286cc91520f2c23893470d026
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.4MB
        • SHA256 c0b25377c2e604df4d0ab9e66e0c9f5a86abe2ef291a72df18fd8e86af9ebda7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.5MB
        • SHA256 1a653c0958c3bb1d1c27118ee78a12fc78b541ed158d08cdb5ea86221198caf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.7MB
        • SHA256 cafcaa2e7159230a24a221f1e99fdbfe1e6806ad555f8f5a9bb3351a7412a1ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.2MB
        • SHA256 cbe58cb34236adbe067b1cb6359ffb09289036fcd6dffc86907e259d169c86e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.2MB
        • SHA256 8c8a6798e9a3b05ade8fd55b9e34f163bba9f63788c7a422e2fa4db3a0141dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.2MB
        • SHA256 b22aec1db3ab1cd9207806ada95df73aad89e4db13b665c1dbdacc9f4cfca0dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.2MB
        • SHA256 9c9bb745b767731d1cee6aded72ada4ed12f18640394b0855fef04156df87f21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.2MB
        • SHA256 6c31a5da8a4f073a409ac8f9d343284ff6f5c9a27b913963067d3b81ed0e2bf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.2MB
        • SHA256 b482e281b04622fce104f7be5f57c1eae986176d1d20234e97f0ca0378edfb01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.2MB
        • SHA256 76f25af04cfe3d31e35bbb54f639c84d0d2c0239e8aa698fb3a88f66cd5ca0bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.2MB
        • SHA256 ae81d2d3a92015e6d796a33568b2258ca0717077e85cd6f3d47ee4be5822d95f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.2MB
        • SHA256 8b3c77eaddb3a0e51b97bdbb126efa98aa730a5a6665810ae39b022f755ff776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.2MB
        • SHA256 635e0d2496f3b304413b8f9a20d3be6d74218e98c9881e695d8b502cd3186d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.2MB
        • SHA256 67eb8720fad5d978bd628e46a596ecdb83ee43440be04d4c91f5a0e1c3bf9d13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.2MB
        • SHA256 def0926fed5e8b96ecdeb460023d616fbff30e8f505809bb0e96243b57afcd20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.2MB
        • SHA256 da93bfc8a8e867a1ad391e3c67f967133834659a23b8ca0069ea33a40099ee4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.2MB
        • SHA256 4a1a8bd0290dc5e06196b56030907e14905901440bcd63c4b7273074bab59982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.2MB
        • SHA256 0f9f5d609824338a78f13001c7ae8d32cf81a34099c04f186367acc4230dcb0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.2MB
        • SHA256 92239b7f2b8aa0bf84e244f2f12a07eb93139af08e9b3838da5cf9244d0086db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.2MB
        • SHA256 8b9c707a6ba3db404a0f73dff2d14b8e6b5d78d4da816662db75af76bac2aec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.2MB
        • SHA256 56ff0a2c4a938e56793a7fb9174f0a86a35ba420154bcbfc042593cb925d6b38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.2MB
        • SHA256 a0f7bf75a283912439fb569998f885c6e5d96ddc91897dec65a5e63f13f3bba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.2MB
        • SHA256 f50085c84975b20fd44ad93f176cc67d2895dff08ceb2ebd5d1a18980431e982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.2MB
        • SHA256 e1cf5a6684a355c017d7723fc537ec1f35e4ef2747fdb47104d9fa82de49dcb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 19.2MB
        • SHA256 889eab670c0b997d2621fd87dac166b75e6cf787bf662c3cea97fc358f656634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.2MB
        • SHA256 6139a9916dd56069a567b0b75e9c23f5b3d4e9525a2053b0bba5da8db2dde804
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.3MB
        • SHA256 f8fa7119742c450023b1212e80d3a9c642e6dcf3a5092d443575b3814b32d125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.3MB
        • SHA256 b23a09daa3a32713871ac82b3f1777fb3d9f312f55e3c0e248551aea25e46fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.3MB
        • SHA256 0850dedda303f9103491c18272101379d37967bf939ff09ee5a6fc81e6a89823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.3MB
        • SHA256 619d0866ae84008f6512680d83928341e4da94b2f8e3969f6129206a0093f1e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 9.6MB
        • SHA256 96e65b240a5ce0d5e7fd4390dcf0ac9ffeb39b7e0d3f1517d704cecf97081cf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2120-175-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3468-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3468-101-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download