Overview

overview

8

Static

static

3

2026-06-06...ry.exe

windows10-2004-x64

8

2026-06-06...ry.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    71s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/06/2026, 11:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-06_51b5eff5b44f3b94ec21be6efbfacb35_amadey_elex_emotet_glassworm_remcos_vidar_wannacry.exe
  • Size 5.1MB
  • Sample260606-m5a7aact6x
  • SHA256 e257ce9cca8cdfb24760b69a2871bed8b274b6812ea97fcd3f5bc4dec95bc1b2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-06_51b5eff5b44f3b94ec21be6efbfacb35_amadey_elex_emotet_glassworm_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-06_51b5eff5b44f3b94ec21be6efbfacb35_amadey_elex_emotet_glassworm_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:916
  • C:\Users\Admin\AppData\Local\Temp\2026-06-06_51b5eff5b44f3b94ec21be6efbfacb35_amadey_elex_emotet_glassworm_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-06_51b5eff5b44f3b94ec21be6efbfacb35_amadey_elex_emotet_glassworm_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4012

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.7MB
        • SHA256 5a2b9cb6dc74fa23bcf24d0db6e5ef0b21fce123afc2007af21d6ddc94abd349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 11.1MB
        • SHA256 8141948560b10f56a5110a7e7c0b43fff117fe528ddc1bb5f6af6ea3a2040729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.9MB
        • SHA256 01458db329f38322d967fdec1d092713964f71a37c3b43aa108b3b0252e8ec8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.8MB
        • SHA256 2a9cd0a2b128d4754fbd2de0747bdb05c81d79b0ee13220b5b914ec3865623c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.2MB
        • SHA256 13fcaef770f044ef84ee92526d4210747441550be054c5a7aa56098bd476838a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.5MB
        • SHA256 c434cb0bb13078449e457744527f10e423e15761302edecb6bdbfa12f1279220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 10.2MB
        • SHA256 6c532337d13303138545de244fd35d305da63bb30686327a26c2fda247c2b95a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 14.3MB
        • SHA256 ed56a97fadb6682be3510fdab073d369b94e3e3b8372b10d5084e460e642c6f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 10.5MB
        • SHA256 6dd4d977dcf02862919412c89ecdc3eb6426e64202587eed580bca765cba60ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.3MB
        • SHA256 eaffbcb679e6ed6472a1b1f70ecb6d5ba1cd2c94becb689fdbf8c43115c639b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 10.3MB
        • SHA256 f8f62a66df3efd37d618f99622e4e588403f427b807dc4eff6d835fdf0d7885d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 16.2MB
        • SHA256 3ef72fecf469d513567555f6e0f9af85c7ee032db1e73f1cc22181aa7d492564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 11.9MB
        • SHA256 4db425d6c6df7bcd679e08f0c56087785a63a9ac8135d051cd46a8ac6f728518
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 13.6MB
        • SHA256 82c0f438c3c565c1a1a57be592f40ed20dee793088867957747fc30f7bafc115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 12.4MB
        • SHA256 8a599e8df4e54aaaa5b0f34e8736a8a7397777b08db00897c19da8e9eef4da78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 11.8MB
        • SHA256 d165461579d9c7a225fabd19f6f7775fb9899c72ff6046b17096b241e3fde535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 6.9MB
        • SHA256 f2fd60897f7a2b4868a9ded7f5fa7ddeaff10ac83acdb280e03c765ef4f5d8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 384KB
        • SHA256 144c4713f378ec54938375c9433afb979bcdaf05350d70c3d422e883e7e60d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 11.6MB
        • SHA256 532a6f9d2fb43352a000ce459cb151af47e15f6fc388bc60bd6e8fadb3d7f222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 10.2MB
        • SHA256 4c448aacd6718b2063eeef5c8f7e52846ae4710dcbc61f9deb80d6ec4813ca41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 10.2MB
        • SHA256 93fd5b8e3794e608d0d59627701e17700dca453efeb9eba57521fbf91cabc3ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 10.2MB
        • SHA256 9543ed6639d0f38314ddd89343b52df57eb35579a10dc5caf125d80a2567c6cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 10.2MB
        • SHA256 6347acf29216e43ba2afc7ab69a10791c0b5dec9f085208edca454b3fafcc3ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 10.2MB
        • SHA256 f717721b12ce14ece722eecff55a7a7234e211592ea8fe828739c5fb67776a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 10.2MB
        • SHA256 eca39c4a181fb6ad1a857793a829e1b9db439b62a09a19029f3c12a484e32c33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 10.2MB
        • SHA256 f69104608bd8feb05d50e0d5bd3daaa5da1ce55a8b5348b019a3225c11a3b38c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 5.4MB
        • SHA256 d4fe908454c2e1dec9d2581c75546860c481d89daeb2cef9638ab809607ff0e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 10.2MB
        • SHA256 f3e392caf11cb4df4f732f4f3ad33a80e04352d4c329d29c8067e0e1457fb9bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 10.2MB
        • SHA256 15d465bcb27ab7366c85de6a6b57fd17303e4ec66213928b5ab3ab1f3e5774ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 10.3MB
        • SHA256 fb27dc452adb54a8300e49de34e1e3899fb378348abb47e50399162ed2855758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 10.2MB
        • SHA256 a1e3fc7e8cc145714544d8898ae7e843c97c6e06b17fbc060e872cfa5825f665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 10.2MB
        • SHA256 5e8a7077f483e77fdcfe60d126e0c3df9a5cf90c1791803956dcedea468d07b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 10.3MB
        • SHA256 43de705fec4973176ec4ce1f4203b73fd59bda868dbbfaec8f22da57d314fbb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 10.5MB
        • SHA256 db0dcf64ed98ad4016674d536efd424ac8774e599fff35949a9cf26b04ae5a11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 10.6MB
        • SHA256 bafafdcafe2a2894115645ac7781343814ca8ad523b605bd3d27c4734bb443d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 10.2MB
        • SHA256 248dba78ff36a686a4796f379c567ad7d5a37b1104b8290b795cbd14b30f9298
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 10.2MB
        • SHA256 7d1ae493e4fc1ca7faa75d1a2691b899ab4cedb280d321f0c823f2c0816f4b18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 10.2MB
        • SHA256 ac119063f71f60decec713c3818ef3fa39ff262272e63775f89a5dc79201c31f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 10.2MB
        • SHA256 90990ba25833f822c6cf60deb926e766c3fe2f4ed2c3bf61b5a1f8add0640c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 10.2MB
        • SHA256 6d515febb27863c937c2b40ca20da260d03973cd5a3399faf81a000ed7177bfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 10.2MB
        • SHA256 c1d050dde0de69608000d86ac648192e8124631764fcd82d9705699f359fc849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 10.2MB
        • SHA256 bf551ff6d61846dbc2ecaf29772790c9b55b3fd9367b8afce7cf22f2d8081a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 10.2MB
        • SHA256 17c319a0ed45d0d7cc9e7b0fb2d00daf8529feece414a16f53cae2c84734bbdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 10.2MB
        • SHA256 521ec349265fb20049fa6b266acbbcb04dfebb82c991bc5657a72d82e01acd43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 10.2MB
        • SHA256 3a110939f266cca2f8252fea37d429a0f3a5b0c2d1e48d3b367373fc076fc53d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 10.2MB
        • SHA256 8bdcf9ed7dee9efec52439e51eca7535bddc893cdea1a7f514355ec78a1f8b38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 10.2MB
        • SHA256 8887099948452eca445572caa1c75e4d9010098995891c2986b6d4d5b96eebab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 10.2MB
        • SHA256 c4edf6af88872e97b1880d5b4ade8374f6fbe7f16708ad4c0296f58dd87d86dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 10.2MB
        • SHA256 fc8ce66d649425f0544c64914439a2cb75bedff19cb939949ccddd7cde63e65d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 10.2MB
        • SHA256 744797ffca003c8eb1300ef63e14d7db4b832d80644c0588df8875337588a5f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 10.2MB
        • SHA256 eed1fac00c100cda9647c054d208910e6621b2023f59b49f65cf22f9cacca526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 10.2MB
        • SHA256 6d3b5fea2056c2bd3e3496ed57084ce683f07e6b30171e9c3aee13b9ff410652
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 10.2MB
        • SHA256 0c1583e10b2aec65d6cd60026cd1447bd269862202934d39c31b86eb7b2c3e60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 10.2MB
        • SHA256 02e019015d82759ad103650a68cdb88ac6afba5179866e235a6367a6d49bff63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 10.2MB
        • SHA256 af83f9e3cb704a50ad62ed9e5043ce595672a9f97dd743749bea291238c740e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 10.2MB
        • SHA256 be4b30668376bdd33167c3668cdcb7ee63d1dbd67a4856d17d83147c07410fb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 10.2MB
        • SHA256 39980e00d916f2faa3fbaa05c55d9a0bb98d0a9fc22650dc8a605a352af16790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 10.3MB
        • SHA256 3c78057d7235cf9a4f0e9cea822333817638a3ed32c1cb2628604b165f4600c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.2MB
        • SHA256 fb0ee2dddc8b74d5cf60afd0410eb61aead6d3a2f647d75d9ac9b08c6fa89123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.2MB
        • SHA256 a2144648e04d6c3bf2ecd97f9d5babbca504bd3e8b18159247f4a3efbfc4c476
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.2MB
        • SHA256 18aa396007fe2a61186de5a28f5d79d068200180e8c41a098b8106faa1fe0e5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 5.1MB
        • SHA256 e257ce9cca8cdfb24760b69a2871bed8b274b6812ea97fcd3f5bc4dec95bc1b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/916-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/916-284-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4012-379-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download