Overview

overview

8

Static

static

3

2026-06-27...wk.exe

windows10-2004-x64

8

2026-06-27...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 04:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_960fdc67c2fa8263ca58867009448929_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 28.5MB
  • Sample260629-fh1ebsdv21
  • SHA256 b92e43ed54eed10e5bbd0a96964e48c0d35f1334abc961934983a7063798b32d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_960fdc67c2fa8263ca58867009448929_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_960fdc67c2fa8263ca58867009448929_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1384
  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_960fdc67c2fa8263ca58867009448929_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-27_960fdc67c2fa8263ca58867009448929_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4364

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 28.5MB
        • SHA256 b92e43ed54eed10e5bbd0a96964e48c0d35f1334abc961934983a7063798b32d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 57.0MB
        • SHA256 d44a0baae19517a2a1f1fb4182c7ec391f918894c1413e01430dfa4cc1ff7ad6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 57.2MB
        • SHA256 69966cc5283cc798ba598f6b09c14ed64f5d418c0878e43e04750e62271f5087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 57.0MB
        • SHA256 24aa9b7ac7eef97ecfb61b133db1eeffcf7c5394c433eadb31488db93607853b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 61.1MB
        • SHA256 e9115b7d3617737c03cc38461c26d120aee64d94caf24900b13fd9bfbe1d7b9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 57.3MB
        • SHA256 fda2bd7f7d3a55576aa8feab94ed865917a3f5baa4a9dd9e40714296f83b40af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 59.1MB
        • SHA256 ac2b2ab70ecb5ee94f4577365a82d01c645beeaef00a78db8c2ecc773df1aa58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 57.1MB
        • SHA256 3c23fc99edbeefb5f0b0c3356c22ef85b79615ee503b9904f00b5122490bb408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 63.0MB
        • SHA256 ee60ac5c49f3ab976395056db52a213fb8f279757cb87c6508d094049cebf0c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 58.7MB
        • SHA256 bf85c26792f0fc087ff65a84d776e869b9df38f9c7bbf31213263a520f786f30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 60.4MB
        • SHA256 f9f1feaf2d77dba58b867e6a3af3cead1c56115fe1506b6df59b8914c5ed2f48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 60.0MB
        • SHA256 32f3d418e9ec2ae66d453fdce458dedad8c0c68c4a10d494a284cd4ce274cbb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 58.4MB
        • SHA256 2a1d138e5ddc22578395090a9f322a33005e362eff59b0b1f349ff58427279bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.0MB
        • SHA256 5a5f71011f614d9b2bc958274a1dcc2d33748812653c77958d7f91c6eb60b949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 57.0MB
        • SHA256 031f458c9dc7c25d295dd8d7fa89ada6b9826f94cb0089d62e2e9ed6060ab91a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 57.0MB
        • SHA256 c0a0b4e604079bd2968807fa0e4d21da949a97ed9c180b191e010e429f9b5b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 57.0MB
        • SHA256 9e61c1c876fa99c28aca35ab7b53deccc0dd1595dae43ebb6e1129588fd4b8c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 57.0MB
        • SHA256 a46187c6332abce91b3207bbadf7a68eefe5a57d1615220cbc2eb53a2bd16d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 57.2MB
        • SHA256 1b673fd7dd42e5117ca09e13536d4a908b44f67d2b3286ed760ca2e12b0a832b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 57.0MB
        • SHA256 feda444cd379e518af72cb98bc56c02d7552421466734171ba9a1412ba0b8f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 57.0MB
        • SHA256 c633ec7a25c2911a8805cdf0d6750ad2674762ec0dd36b4df1be9a577f864e2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 512KB
        • SHA256 54a9cdeaa70d56716fea0c2b033f8174b1495f38e428abc781f5cd97cc816efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 57.4MB
        • SHA256 1cd5befc63d3d10b88acbcc68850a51d4348f91094f0d61dea8afb031be6fc5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 57.0MB
        • SHA256 2b8061992a7e40c7116fed15daa739f28267978080eecf5c7691071a5cfd6c1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 57.0MB
        • SHA256 343fd3235a82b97269dddc40eefaeda6c0c6e9d1ce9d860849613f0afa6c63fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 57.0MB
        • SHA256 1147b76e2a3a4058c9f46e8f84996f024555cd8e4bb3c0a1d68dda58a73c0e48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 57.0MB
        • SHA256 7c6b823c2d2d142da194d45f625ef80172c304d390a62009544081ac2c9607d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 57.0MB
        • SHA256 3e3f44d5c23efe87952c9b75f579308e49b855d0b2e6964c0f5799c0f29b5787
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 57.0MB
        • SHA256 8b72950843b0a6aae1266649cd9108fe128533911ee743bea1e6a3ea5a9d79c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 57.0MB
        • SHA256 777d7311ec3adbe464deb0285d910f1c9e900ccde36ce024f070c2dee9e0d93f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 57.0MB
        • SHA256 3c9c000e817fcd982762e01573dd8fd7ffe76532ce51e8e62239c3b5ad93ec06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 57.0MB
        • SHA256 6b6a8340717094e0ef86259ba5d4fc24ea261f0a1bdfa05a53e6e80fac88d022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 57.0MB
        • SHA256 b15c1a7ccf5c243ed0f5155ecf26cc22e0af679bfb77c5d2aa39f4157f57e81b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 57.1MB
        • SHA256 1b72f57e597ba580c1f1d1d3d25af66400d461c4792b61620836bcada3541d94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 57.0MB
        • SHA256 53652bc44a87554b4d334493d46ba3a47dbba4150b0e54192b528cabb260d03b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 57.0MB
        • SHA256 6e7c80d99eac5413ba00798969ec831a6f70fe659d9f47d74fa32a33ffdd3d21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 57.0MB
        • SHA256 3a8f885ac9b77f89ddc53095812ecfa76bac99fc8939855d22ac8b2a02774fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1384-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1384-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4364-24-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download