Overview

overview

8

Static

static

3

2026-07-07...r_.exe

windows10-2004-x64

8

2026-07-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-07_f0a7a3ae782488304baec3627e954ab8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 44.8MB
  • Sample260707-2b2jpse161
  • SHA256 dff041eee9855ca5d4d8b9901c18f12395b3be79f3d9aee8d6d475e40c4a429b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_f0a7a3ae782488304baec3627e954ab8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_f0a7a3ae782488304baec3627e954ab8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4644
  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_f0a7a3ae782488304baec3627e954ab8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-07_f0a7a3ae782488304baec3627e954ab8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 20.3MB
        • SHA256 a1a3a2833990db73de74f14ce149975845b41f904b8dad6f97fc2193918ce256
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 20.1MB
        • SHA256 0b7e08ba7751bdbf8acab1f2f78efd35cef81029db98e2d23803a6b1b87c84ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.5MB
        • SHA256 95bf4c425d5e9500ec295175c0a0dc66c3cc5cba33580e8d6ec7eb313d6261e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.0MB
        • SHA256 920e1a3d6c66c3f6883bae8493f1c4e54452005561deb1cebc83f04e9ff7f0cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 29.7MB
        • SHA256 8ff12eb791bd0456031910cb293e30ec628520d6d7888903e0551b195379ff88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.0MB
        • SHA256 4d509598e1e308b3d47b4172da68f0426ae80d14c6b592615b32bc6f0e02afe4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.8MB
        • SHA256 ff5a898ba39a3698bf12d8ab526e1b2b40eec9faf5c0b99c768baecb3cab1f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 14.1MB
        • SHA256 1665de491e4643fe574fcbed4d180fbc3b64458c18f35ee596c8cd9d457f797e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 13.1MB
        • SHA256 12b78f424255fd3a75580b87eb386850c121b2a69792f89bbfa8c937f63d7a19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.7MB
        • SHA256 c2f4e0c62807a788776903e3e96fe93a2cd50045b222d9c592a3e7528b8484f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.2MB
        • SHA256 a71ca5a12742eaa66fab8b0bf41042db7e53a0a76234cc40d0e9f8dfc7bb9796
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.4MB
        • SHA256 03a1523eb8e4fc954c5a25aaf0d6643a29e452d433ee5218028c346925825932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.0MB
        • SHA256 a8ca8844b4a0a44c400195e909a9001bbf951b3310e783321c5a0744ce8ef62e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.1MB
        • SHA256 e2bc0cb3642df01eb47f2694ed6391741f46321a0e5870911f757e94758f75db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.9MB
        • SHA256 18636b9d872cb4a6ab399ee8a04fc142e27858dab139b0454f528dee9764529e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.4MB
        • SHA256 2f10504c6b5b7c2dd9d706018b01826af531a3297904dca60925a7ad8a6003b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.6MB
        • SHA256 d096b4f7592f0037ee16ba519e35034d00c9c3201c1591ceeb58023ad1de0dc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.6MB
        • SHA256 5cf927adabfb9ddf8a074d9f2fcdf9998ce34b85576f62020b4b53e9befab8c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.7MB
        • SHA256 0f233b52bf8e10c99499a7163f1166e1af0545d1c29882160018bafd095b22f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.9MB
        • SHA256 80bac13fb73ccd617d6c1553272f189c5f6bcd72069031ca7aa77c2792bac239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.1MB
        • SHA256 2c41270336a170d71a8f396f1ee821e02376ce651b0e11917883cf8706043bcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.7MB
        • SHA256 26aab75b502df9ada8f14ecdc10a7089688ba7522f8382f689e897355c1a14e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.1MB
        • SHA256 4a7d933681b4ca6ae4bf74331eba68b49f452f9cb5c0c536fd557a4d3bebd5a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.3MB
        • SHA256 47f6d7b1ddf54fba7e4bd9459efacafedf4d23df300efaae57c67b78dbf25b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 11.3MB
        • SHA256 091c871d1600875926dc28661b69bb508481b6f8abe86dbca9e80881944400cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 11.7MB
        • SHA256 94f525baf7f79072b46ba8e9355870a558e5903e05026a956162b0a29c830ed2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 13.0MB
        • SHA256 febbfbf3cfc2b3b396f7b6d3d6f8b02e5712587eaaa0228431be90348bfcf1df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.5MB
        • SHA256 ded9280559ceee912f149078dcfc88b63a3054066627cc9e89ef7f97e78bac99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 11.4MB
        • SHA256 ff2e245db7fffe8ed7cb40ffd8ac656f63832288345a66c6cc0319d6e8c1414b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 11.0MB
        • SHA256 3fa270acd21f38e893e3afaf0b1edeca450512e43e9a1e83abb589ecb62e117e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 11.2MB
        • SHA256 a28c9bd7dd61a860be3a47293a3018803c44adc0882e558db9e92ce23a855578
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 11.4MB
        • SHA256 704bbe8f98ad03a0950e0650cbd0d70e076cbcde2414340779458dbb299d1318
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 11.6MB
        • SHA256 42ad1d624579796bc737bed8fd7773934bf7f567ef16ef74e1ef6503238e4f62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 11.0MB
        • SHA256 84cbd3b67554d3d50f53f991bd70be3827bc55910d4b21ef0089938c22f88ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 11.9MB
        • SHA256 a0ad2f0bec8a857b933bdb6eead7779307fbb6707fad63bb594842d810c2d622
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 11.2MB
        • SHA256 df128c2540680a77446ab0056c77c104bc5b1d79a120118c96bea5241ba48ed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 11.0MB
        • SHA256 2f97110020d2fefc3783593834936160da4c773df12352f1dae130caf2d67f41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 10.4MB
        • SHA256 0b6d5fe405b3e64b856b09259dea6ca810a489fc99d620d9ea5205696b2f0872
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 10.1MB
        • SHA256 9ceefa462c66e713eb7dc2a3adea20ef94188cd38a75c0d0a009a6d90e92635f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 11.0MB
        • SHA256 7d37dd4962a3e99ee5e13bb3d25f1ead0e6669c9838b64fd769939f5c589e9b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 10.7MB
        • SHA256 6f01114c07c23bdc643b9d703f32043b0fc74dce2708b15d3e83f3132720e1e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 10.9MB
        • SHA256 efe6dad816d96978b11a06fb511a6097422778f9ebf67c6396016029013628fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 10.2MB
        • SHA256 a4cf83d10b2b99cf1c7ee30c36e10813c86135a5220fb8de39ee64a685596dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 11.0MB
        • SHA256 cdb2089c3605ee83b2af6128311e800b10e27e3b1e237ab17c9b0da546b863fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 11.3MB
        • SHA256 7beb937213ced93ac0ae632555c3765ce81f3e9c67de38a430e19d4913303528
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 10.4MB
        • SHA256 d02cc5f7e9b39e4369d64aaf6f6ecd86d8b3a1fe5b808fede9c66c95e914be89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 10.2MB
        • SHA256 2be3cfc04ae27a7a0199d3cbcbbe60c90984137af3c91bb1e805d5a10fce0ae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 9.8MB
        • SHA256 a8dd41626af6e3f1dd39cef8d3636ad3ed0206c2150a72982f797e1e2c1e55d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 11.0MB
        • SHA256 38a5828aba118c8f2b07351895fd16b44a12a9c6076937d17529f5137b6ac2c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 10.5MB
        • SHA256 02cd267cc1e5d318725ad0a6e9831d008e80f70fd7fefc87b12ef3a7e08b65bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 9.6MB
        • SHA256 3d375af3323230bb94a4476170fd1daaa73240ea8eebc22c18d6c42cf10a38fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 11.6MB
        • SHA256 8be9294682f0cbe6010c1595b4ca8f32bda023e10c51f0f64315521326481dfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.3MB
        • SHA256 08238e2d065757a73bae6cd4f815e487df4a19ee5eaa8b591c38befb7137df71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.7MB
        • SHA256 06f9f1a9d00398229921a3d3ed240945923fa822d35e2cfed3f693ccc0075dff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.6MB
        • SHA256 727b72b33caa787128591c1d669cb754b2ec39c6ec6e29861be7214aa9671afd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.8MB
        • SHA256 198818c0679ef59fffd3f0c8e8561f2ee101d41d2f80a2b74c46d172bff87fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download