Overview

overview

8

Static

static

3

2026-07-02...ry.exe

windows10-2004-x64

8

2026-07-02...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/07/2026, 07:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_315f136ac09a83387f8878096440b60e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 9.8MB
  • Sample260702-jppsyscv9n
  • SHA256 f86df1e487bc6c3f5c66420ad02769b545eff3f7a202976b1606f6bb109a6a90
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_315f136ac09a83387f8878096440b60e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_315f136ac09a83387f8878096440b60e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1188
  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_315f136ac09a83387f8878096440b60e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-02_315f136ac09a83387f8878096440b60e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4724

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.5MB
        • SHA256 cdfed31f9bf0f41b67ef35bfc1a4ad02f86872b8de037d233781a8502c406696
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 9.9MB
        • SHA256 482090fa86129f6fcef0ada8057743ccb072a6eefbfb6bd97e82dab995ef43fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 11.5MB
        • SHA256 8ec91d6f872ec70e37c635f982a87f709efed8d323485a8665322418d78159f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 13.3MB
        • SHA256 992583e2ad107c3f97669b022ab3f3160d0436369b87636fe9c757007fca521d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 9.8MB
        • SHA256 8881a205f9ff42d421e21dde96768d9e2f8e9f08e29761f81d6c7cd98ccc37e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 9.8MB
        • SHA256 ab31352dffacce4c8e97a5d731a5de5bba3cc70064ca7801d0fdf1fde9a3002f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.6MB
        • SHA256 36c6b2fdc2c72d71eae62f289cc937a6c23c1f9b1c9e5e0a636f2405961b6fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.6MB
        • SHA256 1ec05d05e54ad0e83aa7f0825fae05c90fa7aa25825d2e474b5b5eeae4021f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.6MB
        • SHA256 5c9267b4f8451264607a9f40e857ce1bbd2e575afc2fcb1b1fbd1ed0b8212e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.6MB
        • SHA256 d35f64edb337d0781ee6c23276767c849452a1884823fa0cbeb116aa48b256c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.6MB
        • SHA256 59ebe3b3cec9f90e3e730bf6a2b08f3cac7e6b696f1f1f688227b803a257ac34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.6MB
        • SHA256 17d1870af0d047929a5f3ae14a5339249904d00a5c908315357ca2caee059cfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.6MB
        • SHA256 5e954d63afde24f594b1d527be34d7abd70537524b74af8c6d687c1282f67a6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.6MB
        • SHA256 46f1bf672ef934fbc24c34f031af6be3e43ff9e11f168631ddb0df39be120d98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.6MB
        • SHA256 98bc671caea96dc3cf4a1e64366565d2d1eb5423d86a42c6a65c14cd98f91e5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.6MB
        • SHA256 ae4d1927c21e91c92ba549aec89450e3e756b26561232950957f701303cc1b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.6MB
        • SHA256 9d0be71156fa9e75fb0dedced35e7215cabc93e74491c470f9440b0481a1c230
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.6MB
        • SHA256 40888b18fa8ab4d91693866f616790c5eb104fc1b3dae24b0407dc066bf93be5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 19.6MB
        • SHA256 d0a343e26a26a139b8d6742fa6445f8312ba4e5600dcc627c1391eb1ded90506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.6MB
        • SHA256 f4c84ed8dd9da7a484beeaef198b2c73128392ab0323ab6ae685dd10a702c11b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 19.6MB
        • SHA256 101072cb57b8d1e931c82fb97e9508b9864836daa9050834402e3b62e5894227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 19.6MB
        • SHA256 e101854242261eb22fd3ba4cfef79d03b99d56a0a932555ee8ef93efba9b742c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 19.6MB
        • SHA256 5dfb76c97e1609f117c38af8134d769c561556b1be1b8102eac0e6cf1396c2f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 19.8MB
        • SHA256 be7215a6c1000fdc94c1b015911c82f15f0f8a3737302d55e194445bd14e16f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 19.6MB
        • SHA256 a6873be86754301b53b2c8dc5ac9466a9528708536dc35dd2a1798b6de09ef63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 19.6MB
        • SHA256 455d0b270a5dba739f2425d640a55c255d4bd98ca51510f090ede6edeb8fab00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 19.6MB
        • SHA256 75eb60cda0a28d8140ed8f7f503785e78d8354d21405408f05bac152ca6dc66d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 19.7MB
        • SHA256 212c39432af7d502b1953027b744d355bdc75e8d087d177bb54f867ff73d75cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 19.6MB
        • SHA256 a070f2f1333860e6d3744cc4f967c86e6f4964d91b990f6542f6a66bdfe15504
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 19.9MB
        • SHA256 e701be1454e6c045660f726a9053e480d9f86c0c66e3c95cff0685fbeced6b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 19.7MB
        • SHA256 ae752285a63f8df0ec4d732a9d8691e40b01651d30399de007dcf907bfb39b5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 19.9MB
        • SHA256 dfae07193f2fbbb11c8a90f9a5d52355dee9dc011e9785e5fbeaf235a4400de9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 20.1MB
        • SHA256 05f00f67cc5edfd47b31b008fa3080b3cd3313930ec6e96ef67685c0fc85ad8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 19.6MB
        • SHA256 0b08d56208389df47d5329ba66e05362e98a4de1d2003259b9760b3c712f03b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 19.8MB
        • SHA256 7178224ff3fb2858278342e67a4246fb647f6340b45f7a0f49873bae201fadc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 19.6MB
        • SHA256 d4ef255a8aab43338f376b8f10dc4a82b061e256b5b9c4ace465c5b91e2a5817
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 19.6MB
        • SHA256 627dc7afd07cdb29f942149061e79ffc3f5b2d61da72ff29e1ac7ffa9a994c0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 19.6MB
        • SHA256 784e46cc68b0286c8747d528fac54bdcd143e787403b9ebec60b36874aa12c39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 19.6MB
        • SHA256 122b265fc5ff176e8edc0845e9fe6524f9959671e5341cca9398d70337ad4216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 19.6MB
        • SHA256 ebf2eb9507c2086a36c885365c9d11f3a2dfc2e730b41551d7f5b1839f0dc33a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 19.6MB
        • SHA256 82e75984118b58fc8136f8f566bb0cb62ce5f4eef2652862f103be2ff493644b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 19.6MB
        • SHA256 64ddc50ef4415809f0395f86846ae25e06db55a3e44118b6bd04117e773e81e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 19.6MB
        • SHA256 3c0600796744ef3b3914e7a2a01c8151a5eb173badd222182ef11e1229c1f381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 19.7MB
        • SHA256 df790fa1a884a0271dbef522070a2dbbb2d6c7b6d30ffe7b5ef5800a97fdf986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 19.6MB
        • SHA256 477a2d67f02bcefbc3411f712485c1012722b57c6751d8bc4358dca712a65b34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 19.8MB
        • SHA256 8ab5043d513452c7ab4e6a6b8d80af8a52967d945057022891105b17e87f1dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 19.6MB
        • SHA256 4d69bf2ab2e3bae7e43b32603fedb593a5fc4148e56e2e3aa95064ef3965c546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 19.6MB
        • SHA256 43e9af0090ee1ec421811e3a27926a577187ec59a03b6071c5661343f00d96a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 19.9MB
        • SHA256 f179b9d1ec563e240f50872d99865e11e84042822fe3e3a9885a3c518d20527b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 19.7MB
        • SHA256 b3a78cd739aa6bb63a13f5c712da48144a831f50b25760bb63da99f585a40d16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 19.9MB
        • SHA256 3e70697aa294f34af2ab66e04561700a987d87152fc3f474804acece5d456391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 20.1MB
        • SHA256 d8f71d2d9582926d3f519ac3d5a704a11f16943e58e8485b469ba8a8a0c628a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 19.6MB
        • SHA256 42e6075facb846a0b1587e4423ac79d38972559440838323edc0bc163cc0e2a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 19.8MB
        • SHA256 c0aa19039562ad03ee142ccd6b6345539ee8c441811f0caed4b05513bd4520a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 19.6MB
        • SHA256 d4e4f7010bd5d6cdc26dd6b0394f04cc2ee5c95d049e2099fc5565167a6e9d7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 19.6MB
        • SHA256 ea16583e701605002a146e04e93d8079ccbff0a6c0b076a951511f0a853073cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 9.9MB
        • SHA256 be20c07eafff26262d97d21b16223e7bc3f38da74643161b5a53d662fd38af97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 9.8MB
        • SHA256 f86df1e487bc6c3f5c66420ad02769b545eff3f7a202976b1606f6bb109a6a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1188-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1188-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4724-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download