Overview

overview

8

Static

static

3

2026-07-06...wk.exe

windows10-2004-x64

8

2026-07-06...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 14:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_cfedc2e19becfb87538b5a3c8dd1af9b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 17.8MB
  • Sample260706-r6948act7q
  • SHA256 ce228963d85dbb01a259775811e7f9f55a48b3a6bcc12c886c1a758acb356f1c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_cfedc2e19becfb87538b5a3c8dd1af9b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_cfedc2e19becfb87538b5a3c8dd1af9b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5540
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_cfedc2e19becfb87538b5a3c8dd1af9b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_cfedc2e19becfb87538b5a3c8dd1af9b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 17.8MB
        • SHA256 ce228963d85dbb01a259775811e7f9f55a48b3a6bcc12c886c1a758acb356f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 39.7MB
        • SHA256 bc71bce7d8011f32bc37e8d910eba3331940eb311342be37821c871d182d9947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 35.9MB
        • SHA256 9a0afd5997b40418e3212aa42ab98b3e3076b08ba8fdc879d5e2a6f2ee10a371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.3MB
        • SHA256 2e6d7aa9bae1a9c8b28b9249df1f5e84cd4f6791cbd306615cdc780e8c476896
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.9MB
        • SHA256 8f9bbba6d42833c3cd2b7886ab6b5fdb709543c7ccc0772d5dff1e8586f5a0a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 37.3MB
        • SHA256 ad204466c7128bd0c12dde2fedd1a0cff0d0091ba86a2bcadde5d9f884530fd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 37.4MB
        • SHA256 b0ded86b24ce5a7873782b68bf73004b814637ec7fa2544e288286e1aea17280
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 35.6MB
        • SHA256 1fe1bdbd68a46f483a6e364ece1bbd52e7771820bc9c3819ac2f7f34175e0481
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 35.6MB
        • SHA256 d06692740a6af1d21143bef1867e3015838a9be976ce58f72bcaa5950c2aeebb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 35.6MB
        • SHA256 b1f7f1dc68d83cb6688af946da8ebd5e1bf501b9e36fc0c563fcb32c0576ce56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 35.6MB
        • SHA256 b5a5f6da36af4dd243f3cf90deb85eca1f85d0cf9cb1771fb5815a515e09a25c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 35.8MB
        • SHA256 82ac88f0be59713b7f34ee1c675ae18116c5c606bd02d88dce25e6b15a541c74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 35.6MB
        • SHA256 ecf42e698036333dd80c019f2f194c6a30c5a616cf970d841f22dae94a50ae0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 35.6MB
        • SHA256 a66fef559998c23d64b43f904e37911cc29b70d39a48d5a3b7a0634f6a692cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.7MB
        • SHA256 468fb0c42af8e8087555c776b6cf7a557df9991dbab2b49fc3c6ff80be8e2236
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 35.6MB
        • SHA256 c7e7c5121648e006087c42a9b04c394c781e825478a38780ac50793b8057e828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.6MB
        • SHA256 ddc027dfdfdc6462e8a8376d745e91639cf3b9ae8dc6ed33ca1ce16cee8ba0a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 35.7MB
        • SHA256 9a15950b72132a4556b44b8b9bdc2276dc61efa46ad126fbe464a218599b2bb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.8MB
        • SHA256 eed9ca2f59a38595735d8df07922b0fe0091c5aa264426f839a416aa65eb599d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 35.6MB
        • SHA256 403b7abee1c13973b0645de72f02e89add53a9259696a39e71719db80041f73c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 35.6MB
        • SHA256 870ff290eae699bd8bb7241b6d66b45cd7a438847bb12d67b8d712ee32f3cb28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 35.6MB
        • SHA256 eb7402fe105ce28488a70afd8eb0ec684a1ef43e044089666e6dd9dfccd60f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 35.6MB
        • SHA256 8c8ee3b73feb300abf524f54ce7178a90c1708dce706cda34bbafe73e393022c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 35.6MB
        • SHA256 4e7eaaffee4ec2fd1db8da310c97d578e4c9d577744a39c3266d683024437670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 35.6MB
        • SHA256 06f83628e839a9c08372e639c8b4faf0a7f7745d2f70b52306e61de1202630a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 35.6MB
        • SHA256 c651fcd5bae50a164515f0e9b54739308ea9bc7a7ba3bd932e8faa4871026fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 35.6MB
        • SHA256 a03e7c8fb0e15a9ab1125c1c9cb69a87588c372d8600c3ce645ba30c405432f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.6MB
        • SHA256 7974dc8585e3ffb3f8f15c615bcbab510dd69b354176199a68b012f186cc16d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 35.6MB
        • SHA256 a19e8655a0d194b8382c622bfa3269e9185b0158facef728ba359ff5bef30d55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.6MB
        • SHA256 244a4cd009db05f7839be89df6137a844dfea5be3f96b78020c83113f08fc4ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 35.6MB
        • SHA256 7f26a17d16d4ab0caf238d7a616e942827075c3a448daf4f5fe09638622fc512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.6MB
        • SHA256 fb1ee102c8ad35fefac1ad693afe74d66d3e38be6b7183f9897dbfc667bf88b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.6MB
        • SHA256 836146236a10a2b4616f18b97a92fa662e78193e513a30012690725ad5861985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 35.6MB
        • SHA256 107fbacc4628572b48ac350a5c87701a8e11c62503fbef3e21b82de668649479
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.6MB
        • SHA256 38e374d7cd25ecdfbe5b0049d4b507fc1e38ee3625c64c08a4de674de2f636f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 35.6MB
        • SHA256 d369b20825ed3da64c6b8465a9283dfa048071f288a3e57488674f917568b301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 35.6MB
        • SHA256 7a7c9c71ca362d5b3d57f06a3c67045c857b73ea53304595536cb2bfda3630b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 35.6MB
        • SHA256 0f3a5f930fc8bee1eed0e0a4c4afd6ca43d98c1c390b7e03f18b5f4b144d3e62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 35.6MB
        • SHA256 9dac43b8692c10c9efa74345ba9eac580c8e39429becf1a402cdf5a86c31eb56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 35.6MB
        • SHA256 8c2ab3f6223ed1a0751df5ad68361da20b5f2bcc1772900cd7967d0c15ae9b34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 35.6MB
        • SHA256 80d30fa557c96f872dec150b078be9fc56ced5fb3df5ded55d7cdd7989693ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 35.6MB
        • SHA256 14cc5e86dd443ff6db987eb4d0a4224dcaea3b8f0bf10b0b720269193f31c524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 35.6MB
        • SHA256 b2ec1c21b464843b493e7cf0021f96f1d15d221eb62a1657c824b0b60e9e44df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 35.6MB
        • SHA256 b0fef377fc6a2dfebd8cb7851feb501cf0011de6b5e2c918cef1c14c7a2338d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 35.6MB
        • SHA256 21a1f5a875412c66a90f36f01ad93309e564ae0dc235191f7fb8070ce733d494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 35.6MB
        • SHA256 d762c0b0c94bdaef51053a076308f49d3e3ddde24dfb4561fbe1aae1af5c1384
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 35.8MB
        • SHA256 8ceec2786ae9f0eee7c75ddee09fa76d9c08f24f631921dedeb4bac3b65cca57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 35.7MB
        • SHA256 7225d7c1f623d7ad7fc9f66fc110eb4529b4f82e1cd3c41fc04e26dab02609d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 35.6MB
        • SHA256 f2b242689516ee4aa679d1cb814bf9c2776c23193346614ef18c9561e6d7e9aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 35.6MB
        • SHA256 ce0b52e0d4a72b4c6bf8d3bb43b80ce83121debf0e63e3b5feb698a2646e203a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download