Overview

overview

8

Static

static

3

2026-07-09...ry.exe

windows10-2004-x64

8

2026-07-09...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 17:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_5ee8912e57e8921bc60d7d64d98d2783_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 17.1MB
  • Sample260709-vydylaev9m
  • SHA256 484102986f757bdbefad513b1a0758de93d9892ce14b01d460c2edbb517ade3e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_5ee8912e57e8921bc60d7d64d98d2783_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_5ee8912e57e8921bc60d7d64d98d2783_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5964
  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_5ee8912e57e8921bc60d7d64d98d2783_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-09_5ee8912e57e8921bc60d7d64d98d2783_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3408

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 17.4MB
        • SHA256 6ac282d120e33fa6cfba4e53a0ba88d8a97b27cdd6758adf450030eaed1298af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 34.3MB
        • SHA256 b2c911fc499caeddca34a5c748ac527dc18c2be131e7f0eb58b02a416afb5c1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 38.3MB
        • SHA256 f5970b70205ff355fa5a5953d437f623261a91a73fbefae97f3edcb0b589b961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 34.6MB
        • SHA256 d00e0734e7db511243a19ad362f33fddc87143ad4dbb6e512fd67507d95a2100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 17.1MB
        • SHA256 484102986f757bdbefad513b1a0758de93d9892ce14b01d460c2edbb517ade3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.2MB
        • SHA256 98375333a2d052d28329da5888edd5ddb0aa280054167b8a6d63e6f7d2119055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 40.3MB
        • SHA256 db8ff067638695aed7e2f2f227b10159e7a3c78a1f16bceaa02714d3283eef81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 37.7MB
        • SHA256 ea06a0c127a95d3d29cbe9ca3f610d147bc62c6a83ed20b9e69ce397f677126b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 36.1MB
        • SHA256 69ba9f1dbfe253bce4d804c8d829f72223303902334122d578d8f9cb7be94fac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 35.6MB
        • SHA256 59c32be26a5631d09ba5d414c8606426797534b7b6912872dc96c0831e0e9b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 34.2MB
        • SHA256 c83da1105875ecaa15dcc214624863745474310e0edfc0d68efbc0f6edcf4581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 34.2MB
        • SHA256 400db7259597205b715b3f573719180168fa4318c2d7bdb8433af919559c6a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 34.2MB
        • SHA256 3f7bc098b76463d1671c485d54a033529e5090312af4993734079e328205775f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 34.2MB
        • SHA256 a63dd01409ec01da0c0c65045061d5ba8916a927ccb72ae6dc81bf5b9abb68c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 34.5MB
        • SHA256 4c29a6e7088bc2ff1ae98833f00bdc349373e57bca462d8c369cd2a79eee5451
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.2MB
        • SHA256 1054e2d73b33a14651213a211eff6034bf7073124558f92fc40005ce02c4c93f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 34.2MB
        • SHA256 3cf3304cf778df9fdfeb014b7aa9ac1ea17255361721a022d34cce2bdd3722d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 34.4MB
        • SHA256 05d991fd4a2a186dc4969e21f4bf41d925b353c3a16ba3a13e831c712fe8135d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.2MB
        • SHA256 4ab273123c26ff24b87d7a1de687e6c86600bef0e2551471d24ed4e259bfddbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.2MB
        • SHA256 51d9f72ba5f8e9347993fbc68651f5305d6b7fbb992a8c1b79a885cc7575decc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.4MB
        • SHA256 0062c5d2b7088aa7ee5721ab90676e22a1b1e3973a52c9b3faa0881584be6d51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.5MB
        • SHA256 70474766b192fa1ce671e0d2a7ddc85d140200f9680d592226e0494210465d89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.7MB
        • SHA256 17c3352865d6e2c8f0d692288ffc0b52e7170a813aab74f8d2550b563528e0de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.2MB
        • SHA256 a117b61e2d204a64df0e6f90f62c9b0fabed8e566688b7f4a5c9a384e4b4b1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.2MB
        • SHA256 00a1aa4fa393668c0a081720011f20d164b8e845fbf6a0f4bfad6d58941bab13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.2MB
        • SHA256 ebe0b486c5d9bf723fd54191f221cd5576618d253326f6a638c845d1063d079e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.2MB
        • SHA256 cb7434cabf0b627bd6d169a1511eacdcc1115a3262dd4b450caaa5ee49aa790b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.2MB
        • SHA256 02ce887ab6b9c3a952b7ee5c15fe052a25b96fa1e1867f67086cef4183ffc08d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.2MB
        • SHA256 5c06e653bbc6f5e5cb06ab3f42cab2d23699ccdb2fc3ec708fbc42db14cfae66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.2MB
        • SHA256 41e0ce771b18cb73c3c0c613612663c3bee373ac298da320fa6b31b307b65b49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.2MB
        • SHA256 d1594fcd56b8de76483fb9cf9b1c94c92a92ed3749c0f85c223ddf3b7246a129
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.2MB
        • SHA256 1c3ab672ce970bf7981361f4ed8cc5fb529766295e2b223711d0492e0ccf352c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.2MB
        • SHA256 0a84565e91534511c9df94711608d1e58b14f5bfe2d581675daf30385408e4ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.2MB
        • SHA256 2e1f81489008c40c737f2f327f08ed79753dc14c23313b9784d0339d49687627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.2MB
        • SHA256 e7b54242cc702379f31333227f975ace0a8b80029960f5f8bfea5b36b3808f28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.2MB
        • SHA256 c71bbc8ad163e47b276468be02b83245f9665b701a12246d02a726d1f26d61be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.2MB
        • SHA256 1401ceef5dfaf5775b337bed6a86f0e03b42bd4c3eab11c65f3e3b8a75487aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.2MB
        • SHA256 2f57d70d5b36746135a66ec4cc4e23a0ee6f40764906bfe2d6308c67b087a97d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.2MB
        • SHA256 4033fa3d473760cc9d0207345b538f5e18c2fefb68c4d3109c5999254cadc1a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.2MB
        • SHA256 4345305d35d79e83425d50f579953dcb90a88fab6cc6292bfda3a68239ce0642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 34.2MB
        • SHA256 710dc0c18bb267b2637bac07740802ba3c5e193030224f5706ea3a3a945d7713
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.2MB
        • SHA256 9453f4ded39cc54c2297551ebeb6e662c413c188541f43a1ebd5d08cd354363a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.2MB
        • SHA256 efae62cd4ffbdb6d67248fb79c1e213f61030c5b979145d821d46a0bc24a44a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.2MB
        • SHA256 ff9455d7c17a52c7053747083a9efe905b0ba5beb71cfa61dc697cbd95b2c3a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.2MB
        • SHA256 070ce95fbece6c800b1a7fa6ceed6fe7cf58a7afd4efe85891233e46a8c48cc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.2MB
        • SHA256 ecd8b94b6408fddf2a47c27516c2a8705a853ee623ff7b9457817a0d02aba5a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.2MB
        • SHA256 4a2c0e2c69bd8b61b0c1c1ec9ac98465e0e890d628a5c5194babe8158f2bee87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 34.2MB
        • SHA256 957d23e71c87840a7e2347e54285a37443047e5d66f4b0ee0ecf671d43a9ad96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.2MB
        • SHA256 387a87199c1f9b45de55a4555960b68296d1bb535c104278f1126d974528cb93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 34.2MB
        • SHA256 2ebf1164892351b589ded6a524db7caa9c58516bb2b597e72870231d783fd0bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.2MB
        • SHA256 262d34f315f75dd9a25316251ca2703a23c1dbefefebb218c8260d4147269ffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 34.2MB
        • SHA256 f049cfb30c3565177e465c7a80325f3c53f782b318690ab0d707bcb7660038bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.3MB
        • SHA256 6d50a021898297674c053929a72a6f2a1adb5f71ecd860fcd4b55750e10b3b23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 34.3MB
        • SHA256 51ae5ec3cec60d149c9b20a2151c216bce67c454cee310eb3fcc823bc35bf33a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 34.3MB
        • SHA256 659a820979247634c2802839f7b9f512a2633e8de1ec3bdb4c115296bc227d27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3408-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3408-28-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5964-14-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5964-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download