Overview

overview

8

Static

static

3

2026-07-06...r_.exe

windows10-2004-x64

8

2026-07-06...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 21:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_53cb9f019a8d908f2a95536b1cbc1016_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.0MB
  • Sample260706-1ext9aby2w
  • SHA256 58a8ff4d7aa82165b32ef3f3156ae520d686ab9555625b1c876b65eae629adca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_53cb9f019a8d908f2a95536b1cbc1016_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_53cb9f019a8d908f2a95536b1cbc1016_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:896
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_53cb9f019a8d908f2a95536b1cbc1016_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_53cb9f019a8d908f2a95536b1cbc1016_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3240

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 14.5MB
        • SHA256 7e9a40d8ab7f208f2eeedefc0686314eadfa8baf6785bbcce84ca9c12d468185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 14.9MB
        • SHA256 b2d7e69c3878e14e1e3fe0357de3bde3b299dc4d69821ff8ada9c66bd25ed784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 28.7MB
        • SHA256 c56e41ef2cc6c4b458aa6c6f04f20df81c981f418c6cca937f823a15b526eda1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 14.0MB
        • SHA256 44cdbecc40712aa34d7920e562f2594b5d5e6f53922561d265870c6de58d6ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.0MB
        • SHA256 edac359613833afe6abbc0f0dc70640c56d478f9dbf7f737bf679a8b479f0ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 32.1MB
        • SHA256 44303644df69a0e5cc591b256c839ed657ef03bee356cf1666795fb85df80e88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 28.4MB
        • SHA256 533850c3d3b3928ce1e456474bbee92529f1793d7b0fb61b7f214abae937f021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 51.5MB
        • SHA256 b0a064dc928d8a60c20fc3e77985018dd2208314727321e7cbb55dacb584f47d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.1MB
        • SHA256 f6139fe02aa5d64d56ca64223316ff6b4250479dc9f3184c53f5f40e298d8292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 28.1MB
        • SHA256 fa98c811a7db9461bda13f57b6c58b7a7032d44c3950b12505781ea8fd9ca631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 34.1MB
        • SHA256 7eb7756592fd2b2feba0e32ee31d000afb700c84efe635471dae2ebe3656d2a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 29.7MB
        • SHA256 49415fa685ccb5f2d59942f336d2e7a132e421fd305d09d6b3703d9164fca66c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 31.5MB
        • SHA256 d17bd6232cadb468a1141d6c73efd18f2738bbc1d84e52b590bb947b792ee351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 30.3MB
        • SHA256 d9c682a3d79c7440efa3f7d6543acae61d2b967d3080bc9374aa5db5e4c10ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 29.6MB
        • SHA256 3437c453b72f6d1e1ea5a33265e88ffaebf888a5d2301acbb2ea7f81d154be47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 31.1MB
        • SHA256 54bed83779167286c3ed5ba7218b1411c765f0658ef8c1c472facf1e38188daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.0MB
        • SHA256 a124f3d5535f9ce3fc1a37cf88d0fd9a01b88741b077ca42af1e0b34086fc97a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.0MB
        • SHA256 8b2dcf341946a0072313166c5e8044ba563d4fa9d178ea38fd4b2a70994e0cb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.0MB
        • SHA256 4fc11e9f8bfe8ebc44be6f1196c4d7ec8ab50db240f08db413ae14d12c1aa43b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.0MB
        • SHA256 7b316452ff88f97a2f64192ddd2094065f5c6cf805f6b696e9c32c917764d7f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.0MB
        • SHA256 a73d8d1e0bcdb33e61bbbcf1a9bd4c41793f87a25e3c896bb19d25a96e5be537
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 28.0MB
        • SHA256 560558199a00818af2f61fb097b9de7e0b0d7989587e1d29f65040b1d2062539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.0MB
        • SHA256 ff0cdd895c0d0afb25ac2ee8ef18260b281e64d1dbd7d611297998785df6d638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.3MB
        • SHA256 2330a365a89e7a3232202538c6d6bec3a8947805476c73728e7e37da8cb7b6ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.0MB
        • SHA256 aaf5d865d9d61ca4b7586b56cdf50859da005a3024f7beb9d670123589f8c4d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.0MB
        • SHA256 7b2a8c31324a5f682ec33d417b8ac03aee004188ec87f701cc2b69d8a71d7b2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 28.3MB
        • SHA256 4bb5332507e2b0d1dc460f432d340b61c7c86888ccaf64441c91bac195fb258f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.5MB
        • SHA256 e2c3bb46681b8ae3d82f19ecf02cb1ddc5ad9393b1c19e2122a4e421c5906a3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.0MB
        • SHA256 c00dbc822b20d9f8941e0132671629ed24044e398380e4b3eb5aa7c399a7f3a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.0MB
        • SHA256 c58a846a9475b79d7ac991b62de6d512bd444ef3b80920afe808e574f0a517b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.0MB
        • SHA256 3f0e182597b69589807183f9c062ae08f5880e81e54360502430c5429869e123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.0MB
        • SHA256 e034e139a3f1a6a3b259db5c294b7f9a0999fbb15950e398f9106acbfa389502
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.0MB
        • SHA256 bd47fbdba79be88c7acf14b37745aef31b8d6767d87ed261b71b0361c5295e31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.0MB
        • SHA256 a939297fd3dcb3fce300333f8a8f5e0d1f7d5a52cd409c14639b66b0726ac23b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.0MB
        • SHA256 17ace905885851aad180a33297c2a974d4b79cda4b9171e892eb85daeddc9bea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.0MB
        • SHA256 0d85678621913cf5e95bb23fdd18d7a0fce3cce95564a70b6389c0a0495e853f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.0MB
        • SHA256 be1c8442cba4f6c3c838fe41ce677cdd63130e512862f0bfe6e9c32ac955f3d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.0MB
        • SHA256 093438ece56e1a3a68d58bbe5d195c4a1066bd9bfdf83dda5c3a80f3bc61f797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.0MB
        • SHA256 855541b9be5b9975e9fb813107355b69d1685ddaaf03b91d27a448444f321181
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.0MB
        • SHA256 8d9e4cc56e050aa30851cb424be0462462f94936cfc9e838bf8e5a32e0023c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.0MB
        • SHA256 930cdf8baa70866da1850bdfdbd1c3583e39aa4b3c0dc46095042ecc2938c970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.0MB
        • SHA256 9fc7424a96cbb98fc5bebe332a67a5b8e24f2071ce1201455a891c77df248da6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.0MB
        • SHA256 c00c9ee89f9aae5893ac58cb945fa529f3939f43a8531d54ae78b0f828c55c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.0MB
        • SHA256 98b95b53fb4150320877e3db37609a97ac4aeb355bfba80cf08d930bf0f79f2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.0MB
        • SHA256 6781ce1115d932906c4372e9073c0e8e1e132e9dafe6cd8b9e6520accbfe7397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.0MB
        • SHA256 0daef7080dd6c940ac9cfab356d539556787a7046458b0a578b58b6a823f1dce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.0MB
        • SHA256 6e7c8d12a311894ff3f9f10185daace4b931eba7f2c9a9c0b074bc8c720c6f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.0MB
        • SHA256 539830d9e2c990e291152525418faf7d623d8cbbf5dbdc78b063ec328b1dc8e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.0MB
        • SHA256 cb759b4ed6d36591df3c521d9f1f48ba148a5bc94e256b78d7174b414ab622cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.0MB
        • SHA256 817e499be34f22f72efe29d510f7ce7f791463b3d3e0a37dede37b93b2281707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.0MB
        • SHA256 9c850667fdd28d29e81699c9e554a23fc768677c9584d4fc4008608434beef1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 28.1MB
        • SHA256 97a24174459cb8ceb2c9da10131793c5a5a79b15211da5f62a300f121c9cb936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 768KB
        • SHA256 bdc27c8dff2c5efbfe92933d0b7dc63b882c357c0bef3c5029c67931661e75c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 28.1MB
        • SHA256 467abd108a66ccdda72422e243537fd75f29196c587130f8b23c46b4daf5d823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 28.1MB
        • SHA256 360ea7f441add8390d5de51920ea1de7046efe2bce0d098a8e428871fef15165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download