Overview

overview

8

Static

static

3

2026-07-01...r_.exe

windows10-2004-x64

8

2026-07-01...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 17:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_5b5b85b65432c357269723202c1de39d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 10.9MB
  • Sample260701-vm97nacw2s
  • SHA256 90b25c9a80f67aac86cf55ca9fc6999ad5a641dd14aa9eb96b53353ed785e951
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_5b5b85b65432c357269723202c1de39d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_5b5b85b65432c357269723202c1de39d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3368
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_5b5b85b65432c357269723202c1de39d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_5b5b85b65432c357269723202c1de39d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5448

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 11.2MB
        • SHA256 d16e7af19ee6a7a9d6ee1c904be68d1f67017a844a3aa8dce2c81bf66e52ed5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 21.9MB
        • SHA256 e2275e8001d05ceb3b59f5a1648284e392c378d4e47b9e30255cd10dc3a8da15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.0MB
        • SHA256 7af82e920d6eb4820e58dca696159069096066ee143396f56fde2dcf1dba9e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.2MB
        • SHA256 1e59d584e34052f5607f64dd41ea3e5bb5ab88588e47c4086c1f6ee4595bd41f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.3MB
        • SHA256 f413295c73c6b8533a097bbbc294421b5ab252ec37816b6f3b5aaf5fd5549eb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.1MB
        • SHA256 3973a934828634eba831f2b94b1be4d8e30c61f0ea1e9e52e93c41170a098c24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.0MB
        • SHA256 ac6561ed0b31ea4c19dbb99d82d70819a88adcabbc606fcaa2dd49f8d6e229b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 27.9MB
        • SHA256 4d22e55ed8fa0caa90143975092b022592857c2dee102d779d525c39cc437a26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 23.6MB
        • SHA256 fcccc2e5bfb396c28479d7b8a949c83e9788f2945bb7db92dc28f4d46c58f8c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 23.5MB
        • SHA256 e4f3aaf0cefc319b1e0751813ae7a5a2a5c4ec2518d14555e55eb34d79cb520e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 23.7MB
        • SHA256 0ac1884a47b6babb1ff0887e45629ca6c08dbaef79fd38ce2280c841fc1ceb76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.3MB
        • SHA256 aedf234643566b229320036c8c722dfb94a4244622c407a46325d89ea6f12df2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 21.9MB
        • SHA256 0b52f5a8b99b33978978a4811d4f42dd9efab203478aace3f0593827d0822351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 21.9MB
        • SHA256 a44e2647c5e36547937bf0783e3108636dc4b220de56fcbe455487a17e1c5b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 21.9MB
        • SHA256 09d3a9a2827104f12ccc795b786c0b9f9404f162381d2ddcf0f2b43526666044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 21.9MB
        • SHA256 be67e2c937dc46ce40037bfe3e7afd89008876ea0ff3f4e55c8e959657b13f6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 21.9MB
        • SHA256 3f6eb0201c9f7e84cc4e02406c7fac6f1d4a77f3b90a4b9b68da3c37707cf4df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 21.9MB
        • SHA256 ae19b535aa994826c8d0592f5e398fab16360ef36646902181008b949abf7ff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 21.9MB
        • SHA256 d73de83cdfd800b64d5e1df7047a6116197808e9cb2742b1a4c834a188b56213
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.1MB
        • SHA256 4703c713390cb04df2c9f3a3cc4b45e7c226ae81c1fe750f19df0fbd9496021c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 21.9MB
        • SHA256 fcf9d2b614472b9ebd6ca7f5ad2913f5a2939da9ecd90e833e3438469e32024b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 21.9MB
        • SHA256 62001e52175045553b97f0fa4b53b32e78e6a1970fedd8dcfdc7b66e5722a265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.0MB
        • SHA256 40f63e5e1f3f69019f4d38edfd128141db71e2d88c93d9fd959411732104446c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 21.9MB
        • SHA256 6e2a5f8cd4791b76c75397d94ff41cd2e0d758611c521a57bf440de8d3988d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 21.9MB
        • SHA256 8639a855f7cb40dc75c7819053e0403b9f71673dfa52060f0d5dd08f1f125a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.0MB
        • SHA256 cfc40b74c8743eee57f6530e261b9113f5c716d23e7dddad9974d179814c73c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.1MB
        • SHA256 3177adc1341c10b964828ac6acdd9dd2f6a6b01009afaca560982b427880fe6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.3MB
        • SHA256 9aef4d4ab19c3dad5af46b9afce0b6ea1a3d8d8a70822a875dd1e017116c66e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 21.9MB
        • SHA256 3ef23ea155a0e4ec3b3fabe2ec9fc0034cedaccc7707a16515212ff799756b38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 21.9MB
        • SHA256 6df5b56633b1fa62c187aa91738aac321a07fe166ccb232f6b7441ac7583e928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 21.9MB
        • SHA256 a6eb83a510cbca3ba15918a4eaa408966abd468b9dfbb486854c538ae45a0153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.9MB
        • SHA256 52639ea4382d5e71b974a581b73888a046596b77aea5904a0d4314b0b4eb6c59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 21.9MB
        • SHA256 6e7736d384d2e969e87720a07e5d6e6135cea518350171be3fac7337a42de6f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 21.9MB
        • SHA256 fefdcefa461a80ce67910c6628fba87acc91c1c541811c1cf2b48270a0d18c51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 21.9MB
        • SHA256 f57e37d0f3531d7cde3615b1a19cb1cb09baedae6cb88902e153ad1d5d1fbc86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 21.9MB
        • SHA256 b23f8c686c6d1f616bb46bb41217cfc824a0cff727548c563fe547d30870ee84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 21.9MB
        • SHA256 6ee67aae6aa229140bfad478ceb8994e3ec5ce5a118b4bcc4d784329e8e8756f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 21.9MB
        • SHA256 14343025607cdad84d1665b75f316537c1f45af29c6a37233d17f3748bdad8e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 21.9MB
        • SHA256 0773af2a0352f4abd4f2cc1e8b7cd024a3f8000e94738909fac20f91661ab032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 21.9MB
        • SHA256 b515875ab83225be15882fec3a764defa5695c49f504c968dc18b56e351d3203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 21.9MB
        • SHA256 a5dee4b9bd280a43ce580ca20bcd23e4e17c3f7d9036ccc0255ec1abb69a7955
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 21.9MB
        • SHA256 7520d7ce584e01cdaadfe8e511635eebd07bce2a415fbb29346ccadb7929263f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 21.9MB
        • SHA256 7525cfe6919a1eaf7b4e6d1ede6688757d97222f86cb0a4e05e22c6dca755e78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 21.9MB
        • SHA256 950b6c597377ad0e077a98ebf07bd50fc6baea15a8b8abaffcb33f71ef4c7b84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 21.9MB
        • SHA256 ea3fab368b5a0b33218891ab46d1a3602c1e0cea3649e888749bae00badfa618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 21.9MB
        • SHA256 aa10a84a31a7eb332528be119d780b1dc92d6e0698a054c0408cda3625d3a365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 21.9MB
        • SHA256 6ccd56edf1bae198c4eba9e9bc1a5eac0056317edc9c1bc7cb39dabea9205203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 21.9MB
        • SHA256 f0daf9c8e3f3e6b4f72d3597be20157c6baa382d3a99310fd30d08d0872e733e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 21.9MB
        • SHA256 88813ca4407721b3e5a2338dbbb0403e0bd40ab3eea4b15132dbd73eaaee9912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 21.9MB
        • SHA256 28b22d16de7f7fe2aa194f05155edc7e9263b94e29811332a73957c0faa4cbc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 21.9MB
        • SHA256 266ded0f009c67b863f2e8f8843896ea8364e1d9b319a5dd079870bc5c361215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 21.9MB
        • SHA256 a26dec4f1be45cd77dd2733a28c9101add13d742811439efa65e6eff6bda1d24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 21.9MB
        • SHA256 f972d3b33c582fc3f9bb19e6eb56077443976b27402ca411e5b5e1aacdae6a47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 21.9MB
        • SHA256 9cae42c19b259d34e632d4116b09c45cebc01a0715a8b6abf1213bdfdaf9facd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 21.9MB
        • SHA256 71349800efd4b29740d1fe001f3cdbec46a825a8ecaa16bfed2d70f860ff3174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 21.9MB
        • SHA256 df7a5f9cd8d13aee52a28d9f1a60595b73b0a6848f3c14192b070c6e62588668
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 21.9MB
        • SHA256 ac1adf24bd4cbe7524d55dbbb45b05047ff45c051d1607ae65e2e5bca80b4105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.0MB
        • SHA256 0097d0680c3e054764597798c002443015104b3f59eca15b232602d790eeb460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 21.9MB
        • SHA256 ffe36c6736b6af2d53c5f71acabed26da22fa5f4b2142586dce23b645e8d37ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 21.9MB
        • SHA256 c7362e1b5e0f403497b0f82360f5532f27385f4e9ddbdf7d4a8664cf155b09b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 21.9MB
        • SHA256 6e1a255fd45eee3ec2018c029cd21e28b33b0e8483603677412e1b88f059b1b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download