Overview

overview

8

Static

static

3

2026-07-12...or.exe

windows10-2004-x64

8

2026-07-12...or.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 13:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_5f91cb0e88f92a3473d87be24127e373_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
  • Size 12.2MB
  • Sample260712-qar34act2y
  • SHA256 35ee57404fffa463c05f52140d85c2768cc9603e8fe12ce33a33373bdc1d3bc0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_5f91cb0e88f92a3473d87be24127e373_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_5f91cb0e88f92a3473d87be24127e373_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4820
  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_5f91cb0e88f92a3473d87be24127e373_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-12_5f91cb0e88f92a3473d87be24127e373_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4196

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 12.7MB
        • SHA256 b3a49d514980132650b96fe5cc3d3b10e9c4c78f90132517e32b6ff7908f4946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.2MB
        • SHA256 35ee57404fffa463c05f52140d85c2768cc9603e8fe12ce33a33373bdc1d3bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 25.0MB
        • SHA256 21d9910f294ffbef68e89a31911fc7748abbe7b7a171c26f1e8e467e50f9d498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 24.3MB
        • SHA256 c133b606085d61b35753db557adbf09c42aafb0d51d01bcdcfcf8854e9e86070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 28.4MB
        • SHA256 16a0844f1e0301f25b51140cabface41d7e946796baea12218da385fb5ae1dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 24.7MB
        • SHA256 cd0e058bc710b37c97675aafbcaebff2f875efddf356a0ba3ac7aa6695118f1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 47.8MB
        • SHA256 3758085d88c103d1c5c61b07e909f7a67a6b39258c8e31054d5975f5d37c0b3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 26.5MB
        • SHA256 fc88036608ab311ce9779f0f07dafd5cf355ef1d81c5a81dba8eff2e149f7088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.4MB
        • SHA256 e6ac6d74d1237b6404168dd11ad08a5113b28813ffaaf4ae28f2f74f0bddef59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.4MB
        • SHA256 2ef5b461e0fe4ba90efe58f6a3add24fe2c93f9422fb00b85aa9424f7fb719f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 26.0MB
        • SHA256 80c65aff088d3ee813bc6d5bd7a603b2faec1b712fabdda1b5bcc0b3cc5fa6eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 27.8MB
        • SHA256 3dc2e344f1d51cf49e51e4a5472df68a744128fc82b0195df7647e895faaa68a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 26.6MB
        • SHA256 a13839ca365c10ce9d54b6317143f6ad4922d16b85eb174512acf11f3106c91f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.0MB
        • SHA256 d498f9c1bb79fe200301de4d32e3ce79d04936eb023badacd173ce095facf02b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 26.2MB
        • SHA256 07ace1cc7a18e1206344827fb6d0dc3a85176bdeb3864eaa3ca77959d1cb6409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 27.4MB
        • SHA256 597f4d712ab1d5828c7e63822a19f5b358778b6054d14cdbb0c84a08b1b24a2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 25.8MB
        • SHA256 272b5fc49ebfbe3def5c832d47cb0b445e90d345509c0ab42829536f288b3c78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 24.4MB
        • SHA256 032fbfa99a376468e4dd80c42e81cb0947031562a916cc48f8a530654e1220cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 24.4MB
        • SHA256 989de6f6ecae5aa6265956d0e12ad813608505a349984197d1b48aa3bd31671f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.4MB
        • SHA256 0eed00f93a4f44a8b66b584dde5cd04e950c4aa0df43a5974f269f48f66ef218
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.4MB
        • SHA256 137be4411dce36d13fab3d06b46afd50c59f382da1b0d10962318073ab1e6ccd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 24.4MB
        • SHA256 1223232d08038835219086263d21289b9e3e2c43a18b0655b1495ec7a7c05826
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.4MB
        • SHA256 5e6f43baf0a1e85ffd821537d195e0617bf4812274adfaacadd8b8cb14e52049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.4MB
        • SHA256 a0e866b1fc8ddf78c685a838ef5799b1163583bec29aebba53fc999249323e76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.6MB
        • SHA256 199deb7c4c70948f34abbf4265616ef3d639bdd43fc813cf1a359890d6d23c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.4MB
        • SHA256 eef4c2fda7483bf97f71bbb9ccd0e46dac44a900101b619d6ca3b141ff9660f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.4MB
        • SHA256 2c67d3821529b7bcd5152ade4e8fbe2276145adf2b89637dc36832c1046f522c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.5MB
        • SHA256 8a6da5156c552d08b373c2d3d888369b252bf267c62eed042a8e4e6b102cd4bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 24.4MB
        • SHA256 01929098c543c798f301b9b8a953efc4642bac0b7cb7ec9012b33cd1f1148428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.4MB
        • SHA256 d3ebd18941d527aea1b4163b6b76f1e93748525686751966f3ae92da739e74a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.5MB
        • SHA256 b539f35916079ea5e4089a83dfdf12f8bdfc473ca7e75de595027f550f905a1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.6MB
        • SHA256 b4c769bb3268c6e4f6c4da295d80537f533b3d2681b06feb618879f3f3d424f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 24.8MB
        • SHA256 86293e8707069c7758a1fd376e5ab598057cad43ad3e627994b5017370c8ab88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.4MB
        • SHA256 21f6f7540a3f6bc9b8b45d8b03d2aa97ea94f9c13302e09f604426d88dabcf8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.4MB
        • SHA256 550bdcb39b828edd15f8831a2c2cb35317ea31f7c3934a23c591e4fe0bfcc28f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.4MB
        • SHA256 e2f3dd732e34a153b6cc6aa95b26dbb9ea133aea746393c42f5f1eb3f66ceb6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.4MB
        • SHA256 44317486e541b69bae1e13a1598d58ec8668fd310e72dd88d7f2507b45809720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.4MB
        • SHA256 1385b3e89daeaf9d719b76c9ce4fa6e2e1674f031d834232fc69f2d7c3d4b14f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.4MB
        • SHA256 2037cf951c533973a3540dbbcde065fd0b76e9af560f9147d3927f077d90d8dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.4MB
        • SHA256 b4f852490ba9200cfcf284f359dea58b9a26378000197c3220af922bc18b6ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.4MB
        • SHA256 520064e3d53369b0b1277f73b6c0c3cdae76ebde604941178c09655fcc890d52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.4MB
        • SHA256 56c3b90a2dc359926203d8e408bfcd6970d2988b7aa741450088673a149662c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.4MB
        • SHA256 3c509d9d5a847c2afd63fcd7b3222df54eb9f808575c27b9c94f5728224714e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.4MB
        • SHA256 0bec8f891e0b5d6bc544d1ed431ac27566fac74d46187656f76489560e90bdc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.4MB
        • SHA256 1c1cdd0fffb34c0918639f57347e8e9ffb2338de153337d57f7e7a735920b0ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.4MB
        • SHA256 455dbe20cfd9dafc82e3b16abefaa1ebcf656feb05caae2c2d6ec25764a6ace2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.4MB
        • SHA256 ca666446296c2de3ddd7ec6610372a4bccfef23cebdb9824d011eed7ab153649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.4MB
        • SHA256 985d2983855412e6b8229c201ccba2d1f1bc75a831778e28071ed1b364467916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.4MB
        • SHA256 4a26aa6662a56c21f119bd3937259d041d6a22f027e769823d5ae785ba1c488d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.4MB
        • SHA256 ef64964c1f6a72e8ad848f373d2588dec9497735bf1cfa81244d555768c66b6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.4MB
        • SHA256 c0fe74431098eec8c0b4cb7da04dad22a8a9ed8398b461f8a711a48a13973b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.4MB
        • SHA256 01161f3a298e65b4096b5975df00bbd3da0ec70ed153f7deeac4e54e689856f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.4MB
        • SHA256 3eb5584f49b73098126689b4dc0ae4c6ad9c9340cf2c8e34e2308d6ead115910
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.4MB
        • SHA256 7d576fa2340e58b21231e9ae2e0fa22abfd62fb1204add56433520605ddca198
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.4MB
        • SHA256 7dc5c0511b8f1c9c912bbb8d4e10d53bd0107cd610f54054537d1e62acfa960b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.4MB
        • SHA256 80b638519b49a350a8253578dcc54002f090d9482caf19d2f1feba5514edb3fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.4MB
        • SHA256 143b93f0e92468bf90525a9e6ca51c86c360e330338eaa4f7011abddbec97056
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 24.5MB
        • SHA256 39348deeffe6f86c161118caaf7984a0691573c19c01f9d640b69ba0c19a8254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 24.4MB
        • SHA256 49eb48cba6b942968895287e24e437f7f01c921bf48dda3fc1292aef20098e17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 24.4MB
        • SHA256 d6cd8974e7aa33d9eb630cebbc429df61664a02398907237947e21a619a476eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download