Overview

overview

8

Static

static

3

2026-07-06...wk.exe

windows10-2004-x64

8

2026-07-06...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 20:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_ad2a822c6792ed0bebc0aac84c8cbc84_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 14.6MB
  • Sample260706-y52vsahs2l
  • SHA256 b29ab9729fecaf135918ff14417781b2e73914fa93283d4b96d36871155b1996
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_ad2a822c6792ed0bebc0aac84c8cbc84_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_ad2a822c6792ed0bebc0aac84c8cbc84_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4792
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_ad2a822c6792ed0bebc0aac84c8cbc84_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_ad2a822c6792ed0bebc0aac84c8cbc84_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5332

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.9MB
        • SHA256 566925236b7a6fb8433e725d39be15e7a63ff3fecc55c5028f31a00cc2e86902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.7MB
        • SHA256 fe63e5f575dbeb34ba52b04449f7f71dadd9d9cdec616a033369e1f6aae6c434
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.7MB
        • SHA256 f8e6fdde642623062b14c33abf0008743708eb05b7d582fbde554eb985063ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 29.6MB
        • SHA256 4a2a54c44453b162184eeb5f97838eb4806789eb7480287ac222ffe62bddcd6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.8MB
        • SHA256 8b3c8e9d9c69eebd547aab0e65c2fa23987b17a92f1044081a962ffa30bb1d00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.4MB
        • SHA256 96efcacb5a3710652ed1e63436b65860c5e20ceb933f8bf9d68ac8eea4be96f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 35.3MB
        • SHA256 95e83e252f2cfd503a89614a2623cac18869f189cf8e0c66d06dd8d5f1f74016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.4MB
        • SHA256 389aa78c3abb40aaf6ebedf85f58a383058a8dd23acf87637d3925ebe024c741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.7MB
        • SHA256 1de9f4ad52b4cb75b597c15b4a8e020cc602cba1b371aecc49f287be1dee8cc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.5MB
        • SHA256 9e1b6f579334183f53c0e7eccb8719b24ce2d401b796a5a31f1ac6679dd9a39e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.1MB
        • SHA256 b24c46c1edd7e7653158d194ad0ccb2e098ce0f5df287c8c15862943e3e15e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.3MB
        • SHA256 f9c56d26358dede53b3c8a7278b4d12b2ddf9cff7cff86fc7cd158f662a849d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.3MB
        • SHA256 10f3724511a8b16ee42b25a9346b74782f623e3175d876b28f88980122cde7a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.3MB
        • SHA256 6590b09f0ce1d3c4e6bb64baf551658d335a770c2cba3b4c40bebf74c301efcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.3MB
        • SHA256 3bae5c54dcaccb8afeba0e317da4704ebd0cef07f17c4c3144cc6e923c9047c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.3MB
        • SHA256 15cdd83c162cec267fb3bc6d33956b0fe05b26b621b186930ed53d7de15e6a42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.3MB
        • SHA256 9f9b9ec90ccbb8caa6e47b4396fe9df4031e7f4ca6764cc1664a49548b5ee139
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.7MB
        • SHA256 d6f90700c7782e04e2b7f3a9b90083ec096f29b01d935440c5bb58ee09402975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.9MB
        • SHA256 42f35129b1742f1877a588aa3b31b7c584bacce65e8375ff5dcc9bd71c38df12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.3MB
        • SHA256 2158f61a62776372095f8f507d8320e14c4b536217e1fe2cc4112c4f46a176c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.3MB
        • SHA256 86f749e1bf2301202bcb3c33890f22aff31db527e2768bc39b8426ea1385c3ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.4MB
        • SHA256 bcf38275ebbdbca50732201dea4a44efb1dd7c201884cc81becdd0af118876a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.3MB
        • SHA256 b8d73e1c8ef47cd0241de96bf79a162055d4c8acc80cfa6aa8c41c74bb5f990c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.3MB
        • SHA256 5ed984913067aff7d36e10e58e2bef527f061cb7cdcbfa9535c67f8853b5a36e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.4MB
        • SHA256 aa54b5ff57cf294ecd2593a5483d0987e84bbdcdbc002546fbba487b40f036fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.6MB
        • SHA256 e61f9f23a208e926f816dc1e5f75505c6ff8273b1396197167c1a6131e323d57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.7MB
        • SHA256 0de3052683bc4f3f3be1c3d325af53b0f4d0577ce9259b30dd4457f7da006d81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.3MB
        • SHA256 59c2f682f2db2d0a65926c0b59ad49dc4b63e7c441f3d6acaf6f15e1b90ca6a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.3MB
        • SHA256 447e3d8054ba89d846d41d7352a2a9561d818e968fc8bcfb23dd3cb0d71269dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.3MB
        • SHA256 227e392fee01c709a59cf016d3361d4e8e0e20cf740538d72f1b02d373dde6e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.3MB
        • SHA256 fec8583d9faa21bdf4e2e1fac8d46095c2039ce2ea78a9b128a07efc72c7d77e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.3MB
        • SHA256 90849f288d932bada27fc5583b146e3c5c53c2895d4eced8f8ef77dcd3870e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.3MB
        • SHA256 954d44076fa20144429130f93cf5f39ac79973c1e4c3ef52eecc44f70c9e3dd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.3MB
        • SHA256 809a25965ce772759ad5ed818499efbc3adb913355e72fbcf2237689b5c944db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.3MB
        • SHA256 c8a60e6eb621a1e19dac605998135052d4f0ed5bbb43b10af021d66ea1a3fb68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.3MB
        • SHA256 4c822f7c77e72892b0ed897fdc36f794f067dd7799c41f0d576fa469353b34e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.3MB
        • SHA256 5e5458f094c2c2c01c3ca30a67722aa01a5b301e57df3e354f36719abfb7a084
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.3MB
        • SHA256 20ef8fe9270c5a23c21ba261cf388c8708c84c8faa9bcb6237c0d0e56def45d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.3MB
        • SHA256 2ffb32df0532cc2a0bc1fd83aaac44fd9102f6e7f02534d6cf79835ca9494b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.3MB
        • SHA256 bc3225200a33ed80d87414a1f4b5cb89ec21082897f0f002f4e8a6702af08932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.3MB
        • SHA256 d873943cb101a4e30d58d8eb81a9b23e6c815f1903ccd7a0db9ba1add8a498f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.3MB
        • SHA256 2918e53a4822dfedde5e840515acf8c2826f31aa0e145548267adbd81e072599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.3MB
        • SHA256 361858e24d59bf797d5f0fbd2eb85a86e9d99b6494e996e6f59b257900bad781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.3MB
        • SHA256 cdaf19f75cb253224c989c0f48559fcf5117b421b89d55f90f738b03f7f509ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.3MB
        • SHA256 2b2775c5edddde88ad0fe5cf4b946f7795f59453defdebac3a8c3e747523346e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.3MB
        • SHA256 83319adeddc1430f39964c10e371c5c356afc46609347d8965ac5ac7a79c93c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.3MB
        • SHA256 95b028ec392c590d947e0707d040f58807a9df1b349c93f97f224bbc5a32ef02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.3MB
        • SHA256 7bc3fa21537bdabd97489eca102caa726e570e26b7a8e543084d44b09ba1f14d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.3MB
        • SHA256 afa54ca576466d7f9172f74d3d370bc3cfd99b740e67c2b52ba39e082cc17f91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.3MB
        • SHA256 b4aa725a9498a7a6a9e9a8588f948341ff3d3064f01dae7d9675a2f955f84c55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.3MB
        • SHA256 c32170327cfa6e8378deafce3a03907b54abcc16ce440061a75425f94c407d56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.3MB
        • SHA256 1287e1d9be3db58ae6b25c081211be65ff4d4d3ea3bdfa386094f5b7f5b1d20f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.3MB
        • SHA256 3a3857c1e0210f4a94d168278f43834e5d4359d21c69e3f945608c3c769a8991
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 29.3MB
        • SHA256 3da3c06ab82506ff4edf52904202a88466e8f479aeded468904ee583e5541f9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 29.3MB
        • SHA256 c5bdb9c7368ed5310cbc310c72a05691f45d078c9f753fa6cddf2fa3933be244
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 29.3MB
        • SHA256 3fbc39c35d9cc4e326ddfcae4fee0f279746accbe0c0db6795e5bc501db12b2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 29.5MB
        • SHA256 4ec1e239967d3115030a76601dfe29f9ac198f54a2e2d8550840bd3c2f874650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 29.3MB
        • SHA256 4752f70ac5a44f2efeae27e43c05ee426adc643b06b1898ff79cd9a96ed95015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 29.3MB
        • SHA256 22f22b8b295af90adc3bd002e1c9de1c35450ec4d85481b8b1225527374f22d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 29.3MB
        • SHA256 f0281bd6a7e1f96f215ffd46d293e9c275e6b92212b960e33b7bdeccbefada8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 29.4MB
        • SHA256 374ebcf24367d02a98b1eece4538ae6cdb736ea781cf80eaec6ab10c728fd7a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 29.3MB
        • SHA256 220af45796c9c52b8c44e40e70da4edb97b631212f0fb169e4b921b19e99bd7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download