Overview

overview

8

Static

static

3

2026-07-12...kl.exe

windows10-2004-x64

8

2026-07-12...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 13:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_2903ecb03c47a936ed52791e832d7ad7_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 8.0MB
  • Sample260712-q8d9wsds2w
  • SHA256 15b52eadcadb987f5783bce00ddc415501ec31ecfe63b349fb71f54fd202301f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_2903ecb03c47a936ed52791e832d7ad7_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_2903ecb03c47a936ed52791e832d7ad7_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4680
  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_2903ecb03c47a936ed52791e832d7ad7_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-12_2903ecb03c47a936ed52791e832d7ad7_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4112

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.0MB
        • SHA256 9ad47206db27e8de8e10b489c533b3b5522f898a92df7b01cae92f236b7f38de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.7MB
        • SHA256 f75913d8aeeae768b12f0e7c7b76c7105413c1d9c190e49feaf8a9bc080c0fec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.0MB
        • SHA256 ec49a004a8c28fdba8a2eade9cc502736d4870a82d1599374d5d48aa31d5b113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.3MB
        • SHA256 258ce68047ee49aefe4bfd63f66ae42e77c6193587d3468306e4a9dd29b315df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.1MB
        • SHA256 d0ee8104b28663c8d59f0a4b25c6aa53faa7d9f81219622c5c7a636d97ea3fa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.2MB
        • SHA256 a6e02534eb0906bec97286e511cd337b251391e722aae52aa3851d2bc78cb586
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.4MB
        • SHA256 afc7f2962ad0c8e5d120bd8e4332964ffa986ca8129ba01f843765e345aeff87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.5MB
        • SHA256 16a8f2ff369fe5af0ae556e3f2d90f7be6037b62777df81e84f25dc3a5cb1564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.2MB
        • SHA256 ae019efbd9a3c71b80b38c57762fd3c19275efe87578a9010bdd590028fc80a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.2MB
        • SHA256 50f0ff02256038a86b5822f8ee76234706c0f7a1d72ac33361a67048daa4d5c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.1MB
        • SHA256 b8fbfebad30cf5001c4f4177a72c98cc71d6987bcd4364af7150b9e4c6e8536c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 17.8MB
        • SHA256 9558df0d54985c2e9e05f0fad17b32eca55bfb00db2560597a1b60ab89cc56d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.5MB
        • SHA256 effc43b39bdde4f217ca8a94b8992c91d6aa2591a55c5a9e58edd6d9b9fc5dd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.3MB
        • SHA256 1d4f43725cfa05afac4614f45648bc329a2fa6cb17df5d188548381907bdd241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.7MB
        • SHA256 8475825a0419735072d55a46df654fa0d29f1cbf564a355823ec427518c6df60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.9MB
        • SHA256 eacb3c37f582a3a2f6e8bef85a30833821f452202a2653cfdce95badfdb9d1cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.1MB
        • SHA256 24fd3f9868ae08f3da4e3e86ce3cfee509df58e92004e0799446c581a805f29f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.5MB
        • SHA256 da87326fc4bdf29e42ba96907f77976cae0f85c145a239095c3b4c5ae119ace1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GrantUnpublish.exe
        • Path C:\Program Files\GrantUnpublish.exe
        • Size 16.8MB
        • SHA256 ffadc6218cee234847fb2b838bfb4965b9c5bc5ebe5a3be67718793de800e175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 16.1MB
        • SHA256 67f92a9f66af540aa28e1dedf2e2f962616d19fde5131dc6026bf77da1bc440a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.1MB
        • SHA256 dec8324b4b62cf7eda4253c1f752a217714b8c6229d61f8dc79ec148f93b515b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.1MB
        • SHA256 ef66de351661ab4501da749d8e348968a3bbb96f2fdf73393d3e4e375f48fc98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.1MB
        • SHA256 56ddd0abefcfaff31989e27f5a17475f1b274a502845bd7278362cbb855d6469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.1MB
        • SHA256 2313105d4acad7131e809f451364b7c57472f01eb261882d61e86f3e198a49d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.1MB
        • SHA256 6a389b093a53167374f3f38544e6effa65d331a2cf6a9bd8ad67d7ab704b40fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 16.1MB
        • SHA256 7249b29756d209bf3849d01224213356eabe79e0bf8ab72c63a8e6b25b3f26bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.3MB
        • SHA256 4c5722e37d12b20c8d5c3fdec61cc4356a02c27d72db2c1d97310e0905158740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.1MB
        • SHA256 61fcbec83aec6c2429665eca035f139cd7992a3769a53f159d46008b17def767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.1MB
        • SHA256 4ed05598ea7764feacd1a081fdef806b7d14e1786cbc18d29590bf73845e5af2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.2MB
        • SHA256 2fe6e734bf3c65f495f58460c6502e9672487152df10408582b8ad67a91aa514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.1MB
        • SHA256 9bc7b384ac95a9cf587d7c6382bcc20c0bc0da6da5e23c82e3dcf62be959fbdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.1MB
        • SHA256 754e1a5506ed55f4c17bb4b78b3767062e8ba6af6fe9e3f79205811d8e6c88b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.2MB
        • SHA256 288e15226f3c88d4731044f7a6d612786015a6a3e8875ecec3d89b87f1725653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.3MB
        • SHA256 dfa8a4a68964adefae6ef59895162a2dec994a43419af240ad8c6d42c5b71de1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.5MB
        • SHA256 406e429e15302f9827a9f3dac53c62a75eb5908187d8987309e648727b25c314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.1MB
        • SHA256 ee1a20d711c35fd8f0f6799b3536a3edb71cb3e83fc72c20b53dd4c10fb8884c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.1MB
        • SHA256 04787577dce34a1c6f35ae59f481615914ac53edfce53959b384e36e5fb4df42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.1MB
        • SHA256 9cbadd1b4388603a1a054e71fce1a3772241786542b185a8230d3714a0319b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.1MB
        • SHA256 8d04ff3dcb4862be1830178fa66d40e03c0885bb0c05af2843d95d9989f768e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.1MB
        • SHA256 4ccfdad7cb82944a27c3b7802cfdedd8f2887ed31284738a4e2043318349f1f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.1MB
        • SHA256 458c8819a62f9e301b8c453977e1c17213e94ef033857d5f6d62b530ea065da6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.1MB
        • SHA256 f1561060526417cff579e3f0d28c4194d28469d699971a9bdfc6ebf75de9515b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.1MB
        • SHA256 b2466333f0f3e24d5d9ab73f85a383904757d790bd9da9ff4e4e928c25579b26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.1MB
        • SHA256 4e9d5af03583a02486a350118e648f78f1ab0a3989f0429c813a4e83a5cf72a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.1MB
        • SHA256 b382ca6aa10bdeef08d66cea960c5f11ab828b56d3f4ef62ee3bbaad45b1870e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.1MB
        • SHA256 ac4a7e47c1c2399dfd15a0e37b9dae40fb99fc03e8701fc8eaee956bcbf3c10b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.1MB
        • SHA256 0bbfe06f3c5e8dc5bf8cbf320839f89fe85e5a1d3cf2bdd4e2fcf87473c16613
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.1MB
        • SHA256 6b25bba95b8e79b261bb81e2ffbc372a4f905c1a046abfa313cef2fbf7fc4daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.1MB
        • SHA256 62109ef467efd44d320626a79cb274fe54ded97f4e86143fa59e53b47b918dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.1MB
        • SHA256 824bab033793c96f42a9c10761af35582b14d0a1df52f01dd2f36d03336980f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.1MB
        • SHA256 6cc71a65b5300796a1566f08fb7250dd5f4de78add10f99461bf41b09918f925
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.1MB
        • SHA256 7c4f081a0568bcb061022216fd888f2b1087944c93d341dcb49cb68904ba91a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.1MB
        • SHA256 207af64fdfc08a583a64d32b3197434d2a9722b410a0fac5f6fb5de53681c4e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.1MB
        • SHA256 8da0ca81056b29dfb8edcb893eb2734b9c24ee7c74971de7691019b01fe2106a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.1MB
        • SHA256 67907d8839b0b38e0c439341a60e73edd17d892dd21eff6e5758ae9c5c192fac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.1MB
        • SHA256 e231d4c367d6161dfb3341835e542714600533f63d412af8fa0a442508c42391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.1MB
        • SHA256 8d289a14ea3d66e124ad34e2149f9a7b5adb2e6aa65c8a3db1283ec84b68b22e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.1MB
        • SHA256 77b5a6df07edf574d2c3a51d11d818ebae2e1ef0e8441217f08a625b44501f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.1MB
        • SHA256 011bbddd67f3df7c7cc7d38ccc03155356786d89d67bbb46dc97065452a4a72d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.2MB
        • SHA256 8736a8533bc7a627976b866803e557a9e0e8e4fd3971b6404fb245779f08352b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.1MB
        • SHA256 23a821de8820e4edc9e2c00a763abcf0b24fb37d4c1667fa260a6177a20cc777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 16.1MB
        • SHA256 39e5e13c9b4ae9281babcd11a9093cde2fea1e0ffe77d0336be852a771785407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.1MB
        • SHA256 034f9f552df99c12cc7a5070fdc897b378b89fd184978e3f1f0be0eae3bd1270
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download