Overview

overview

8

Static

static

3

2026-07-09...ry.exe

windows10-2004-x64

8

2026-07-09...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    87s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 17:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_343a2c37b121d5a659ded2d2df9be416_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 17.0MB
  • Sample260709-wb28caey9m
  • SHA256 54cf5012dfa1825b2dc0b0ce3a99f974feb7c29fa61ac6eea0a12e38b92532a1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_343a2c37b121d5a659ded2d2df9be416_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_343a2c37b121d5a659ded2d2df9be416_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5108
  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_343a2c37b121d5a659ded2d2df9be416_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-09_343a2c37b121d5a659ded2d2df9be416_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1392

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 17.5MB
        • SHA256 239c08fb170630e72792b1b13ece2ec887a93708c9b304cd70005503c5a5d154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 34.9MB
        • SHA256 8546e53205470b1bb422c107db7775deac9acb6b6af86bbc59b21ac3f51bb7c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 34.6MB
        • SHA256 987a0ba2c25417c252c64e5b6e7c187364ab0a956ef1018cc6d7af68f8cf0b38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 34.0MB
        • SHA256 77c8cf5753bf4cb7f65673f5f5a7a79abaa40de0c1e4e06a0449fe61612a43bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.2MB
        • SHA256 a5c43714fa12be514296db88fcec2c809938cef4bb87fbddb2098d328aeefc0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 34.0MB
        • SHA256 668bad55e38dc10c5bdfc5be2d831f9ec83bb143c5f8f9e116747674f1cf14b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 38.1MB
        • SHA256 60cd899a4d6f6339e98889adfb2eb7b4ecd79c9eabe751741e259810c222c0e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 34.3MB
        • SHA256 07be1fc9106d508188c235a053425f1a1b9fa0cf92d8124ac6c97cba65062009
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 57.4MB
        • SHA256 49c6a328941d9c3ff7d113b4dc8d8a8f5406f7f72d04b4d496b27ec4f1bb71e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 36.1MB
        • SHA256 4d47a7087e5a3d98f33fffc4f84e7bef197dee32cdbbd81cacb8e8b078201c28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 34.1MB
        • SHA256 c6b9677b63a5fb4f9d0b36228b2dfb4c2eaf766e593645ca391c7fc7512e27c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 40.0MB
        • SHA256 5896052e4057929153392b0cbd004088b4fd67673f8bf04b95f0f80b48a96d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 35.7MB
        • SHA256 158db5477341120fac5036f108f41020eb2e42528405bb3150bc26ef15b62aad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 37.4MB
        • SHA256 57a24cbee51a1e13ddce996fe6cb7ac83813567cb5201204b98b693311a94d7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 36.2MB
        • SHA256 7167c1912c5cb0baca1038b5e0a5d9104fd5a67ea374ab2698ba178a80fd8d81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 35.6MB
        • SHA256 9d27ebe0c380026bc294f65bf94c4b41e40354afd1ba62447433c38549c848ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 37.0MB
        • SHA256 5e58745ab675fc0341e5417384b10699ad2016fee16cb9e2c328ab60ba393824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 34.0MB
        • SHA256 d8b11e5caf2e2e38ed69606d866e95d30b0266a3f3dbdea3c39d01467bda2f75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 34.0MB
        • SHA256 009643d632d45fddfee570d7153755c6db7063ddbbf9219c0eb10ffae5192db6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 34.0MB
        • SHA256 047869f75e0dc63a9edf725f2f809f387c6d9bba2ba73e9e482fba37d872380f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 34.0MB
        • SHA256 a38fe9231454d4ec2aa0446ad734f0a3d64e0adf2364c92eebfce483535d7a13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.0MB
        • SHA256 052990c1a47abc9b27a3a8902f2e91cd119967e4746f62630848fd6522648bfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 34.0MB
        • SHA256 5f7b4339663ce32d30f2eeb5bb4094fe828ae7f7d90ca51f163d87eb93d18177
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 34.1MB
        • SHA256 bcd5ab393e8cbae1b86fff6235c15fef566d2d996bc6a4dd2ca388b39bddce31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.0MB
        • SHA256 00596fad2de6272bfa5eec9d8e954d8a640dac1ea572a219f111eef1d05354f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.0MB
        • SHA256 5449090a643a7ebe5cd4c138572233dc8ecbecf17b796ec018f5d8f0fcf7a1a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.1MB
        • SHA256 b615d856ddc9265a2f0c51db5d3938d4780b9a64744a88352b7c83567429ee3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.2MB
        • SHA256 eed676206f58a3051ae2134ec123a552eb1ca905f55003cc4643245c160ed2d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.4MB
        • SHA256 fa4b2ff14459eca3fd7d31e0f0db7507e2d1987638c9a3ccac0a4fb4d44789f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.0MB
        • SHA256 56079f6fb5fe9a83d478702fb0d1c453703469257c56bfcf1fcb51d7df55e219
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.0MB
        • SHA256 3558db9895f9fc6dadee9f21d32af7375d2b952a47041b0561600a14a7ccad4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.0MB
        • SHA256 1188067162ef7b982aed3f7b30aa8b02e9bb21138c9e54ffab25fac507ee9e85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.0MB
        • SHA256 c825358e7c889bcb7a74667d400bb0b0cdc0075a5ba7ad40e1175f7926262dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.0MB
        • SHA256 a1dfa969a3fe277602d0f1d7b3d1fb140ddfc378febfd6042cfdd302b1c86cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.0MB
        • SHA256 9b29e308f3dba50c6d1ac49212989a6315170b7f88ca588a8fe6ec7948b88131
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.0MB
        • SHA256 fa7ec09d1bfa74ee3876e4e454e12f2772b742ff95a128647329e63a8d2d2bf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.0MB
        • SHA256 813c04ba72a4d7ca961a5677a38a2b305c18418d653bbc07b52b97e60eb6b720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.0MB
        • SHA256 7a0183f28bb1e4cd11195bb09cc6826a83083402b6e2aa76b22e340cbfcd56b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.0MB
        • SHA256 72a6869fb32a0df292cd60191322fa5fea74c18da223c467f21adaebb32f4536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.0MB
        • SHA256 ac26addec27354793d983d956b007eb9f7f79f5749688e82be376a838b09d836
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.0MB
        • SHA256 713c1be59212d2ea7257e29421a0b3948d4cec5fe44be42165d6756a4c37f412
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.0MB
        • SHA256 7d6e1fe54467763b9d94de687cd9ffa8ea154ecb579887ee6410d96cac38505e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.0MB
        • SHA256 84e49c250133cf8ab6db6a48e0392cb8d096b78fa18c5da5d2d4437bfeb92b39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.0MB
        • SHA256 ce0dd08a7bb9c0b33ee45370fe36c5c6df3ac3f69885154ad7acacafb380a767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.0MB
        • SHA256 56cd427580a4b1d51c27affca0e6edf6db8116a62afb793538261d276689d804
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 34.0MB
        • SHA256 162a1e95b5d40d054693e1437b2fadd55a6020e8d0ac8cb41b0826114edfa2d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.0MB
        • SHA256 409f1c243e3602b8b5692cb5dd836d07bc221fc47f6d0eee939796022423074b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.0MB
        • SHA256 c951c1ea02c91d0fe0fc2eafe0811d99cd0d4e68964f5acf6610c3e21a4abb5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.0MB
        • SHA256 223bda560be3bf536d34338dcfe73219b8484fdd71bdf8d3e0f1219cce8fb6b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.0MB
        • SHA256 653e64e69ba0ffe855fff6c48a06f0fba5fc316bc7cdf2c49cc41e96783cb6fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.0MB
        • SHA256 ac15792ddd44a52ad23effca85cf18dfe4ee24cb6629b3717a9336a9be96abf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.0MB
        • SHA256 2a61eca845125b0603ba52592996f9636ac5e1771c9c6c09409044579168aa55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.1MB
        • SHA256 400cfd0d069b730ec3756bd00bd1192076976ef43acb050e583816246c1df640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 34.0MB
        • SHA256 72549c8f460f632be187804161cb76cf66ed954ff945764c3cc0b66aeed87df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1392-7-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5108-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5108-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download