Overview

overview

8

Static

static

3

2026-07-18...ry.exe

windows10-2004-x64

8

2026-07-18...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 23:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_c6f9af55706d326a03af4e2b22e4fa96_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 5.1MB
  • Sample260718-3p9ynsft7n
  • SHA256 aeb6f0a2f33cb44111942303ab525786da022b1cb11490ad8f3e363a0446c541
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_c6f9af55706d326a03af4e2b22e4fa96_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_c6f9af55706d326a03af4e2b22e4fa96_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5932
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_c6f9af55706d326a03af4e2b22e4fa96_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_c6f9af55706d326a03af4e2b22e4fa96_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1148

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.0MB
        • SHA256 e63165b4189c3605a5a249b2e8e197d32f03dd9453a44e2117c60e9a0303d986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.8MB
        • SHA256 f0261274754c629f575dfa8d90f1a0f4f2f0e354cb37848026da24cda0678c14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.2MB
        • SHA256 ef74ae54e695729b7950385582416871b0a69b3160a84973013d963f6b1e0e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.4MB
        • SHA256 e019c90a033f2f96d3f057b472fffb8c125089935eb3eee7f20aba9474a89c99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 10.2MB
        • SHA256 b8fee985d914776b14a3528ca0edbe41433a67276525be4e1471d6fc02d4d37b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 14.3MB
        • SHA256 4fa59c8ba5ce3601362785a7b716ed267f58127bf352b768865e4885f49aeb7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 10.5MB
        • SHA256 0cbb35e022146b7f9b5b26ce16e053d579c9b953402bae0d2202aebdaa0571a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.3MB
        • SHA256 a6704f6052a75d3ae1e7bc39e415fbab9cb696b832f675b5e7627fed37cc9739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 10.2MB
        • SHA256 d02e86e36fe39e4a950253b8e8fe993dc5f45db0cae187897b64a7b99f55bb10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 16.2MB
        • SHA256 d824c145ee9eeb97dbc45c85073d87a45e432885917c2823ccbbeb424a08fad1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 11.1MB
        • SHA256 047113573d458f3b6c532a274a3c6ff025703534221b63e8a65fececc079418a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 11.9MB
        • SHA256 3a17ccbc509901fe27050c9ac096a2ede4eaec5fafff069c26fcfe901bd87d73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 13.6MB
        • SHA256 80313f8cf2de22a75af5eddf9a97acb6ff385efe46194dc9cdce851a7cfd6acd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 12.4MB
        • SHA256 c11a415ff9343f7d3b1e462711941c0e088c2714b85b3a4d449b862edb995a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.7MB
        • SHA256 53eb3b1b629ec125d519c0a32568d7b3301aa3cb935b103c65a29ad4ac3a2f22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 12.0MB
        • SHA256 b2cb50b58b4efab42dcbc4b9ca2abce3b39f397318693aa6f43d21b1dc455bb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InitializeAssert.exe
        • Path C:\Program Files\InitializeAssert.exe
        • Size 5.3MB
        • SHA256 8d7c42972be6fe60bf924a944d2aad5e57115d2bca84f042a58de836462dbb4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 10.2MB
        • SHA256 565f17c701de4488dc1e79a390dbb5a078e7d8eb7115085990ecb39dedc4a3db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 10.2MB
        • SHA256 06b3bcc6d129cef61106e37973eb3e70014c4367602912ea5ee9656a47f1e08d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 10.2MB
        • SHA256 8cbc7008fba80d9097c0e434530e9ebe146208d5f8b914f0396f58fcc584ed8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 10.2MB
        • SHA256 ca38702979be5935f89f746520e21d80cc180fa5e0114abc20e5fc8d47aa59ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 10.2MB
        • SHA256 8942166fd8289df5c1e9ed09f8a3f1253225c3f5ba2e68a78f1e471066b1e11e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 10.2MB
        • SHA256 68952efdc79fbcc6faef925a9f5b224f71565acb56e25a91391b7659b013b33b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 10.2MB
        • SHA256 9d39732d4ff526502f2e477135d0bce61d278ddea89f67eb7103bed974a0b3ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 10.4MB
        • SHA256 03126f22ab727c8b9493459c1cc9f330326db64d90d23d6cc7073754bc125ec9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 10.2MB
        • SHA256 060882bcd12e744c2463e7dfe0be08472412a9d7b641aae974094d2f12e0f38f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 10.2MB
        • SHA256 7b087104766c10142ea35c0c91475cbe6a0e05f342d70efe07a95f556e75410c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 10.2MB
        • SHA256 eecab6eadd1031046ba5a93b076eb7406bdd1cfbc112cf9ef5a7061aada1030c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 10.2MB
        • SHA256 923a866c0cdb7c821a9a248e8a0947ff85550363ddc46cb5440da562f5134244
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 10.3MB
        • SHA256 832174001b04d9ab8f0aae11b57dfb1aa6149562153480a855066a96968648cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 10.4MB
        • SHA256 efe565f2f47aa299f53da4485571c0d6a11acaf6dbd18f5efaa9f3ecc761bd05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 10.6MB
        • SHA256 9faaaa829433a7fbb2625de4960e12802c4d9221a8fe16d4ff6258eac9bdefdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 10.2MB
        • SHA256 a71c4f91bec996337afbc2af5b82e41cdc4a8573483efe6e551af2d5da8741c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 10.2MB
        • SHA256 627d58556a2fd164ae35324f6a1cc4ff54450dd86b197da30690f02f1ea0ebab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 10.2MB
        • SHA256 ede78b1e290ec27863323dd1123d7cc9f84fe6fb8cc5aa2f5fdb5d8cda788085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 10.2MB
        • SHA256 fef6074b6dfb1e36acda8341afc83aa464b200b8e408c1b38df70f2e307d4941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 10.2MB
        • SHA256 818563d775b755287cf63414e6882d9e7dede46cddae5d91a1776733e678a24a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 10.2MB
        • SHA256 c821d1116e52ef86b76dc3b64eeb4515ed38415bc9635005c9f1e4b0836e186c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 10.2MB
        • SHA256 f70ba1af671d7131ed5929b19544e2f98c3cd904c991000fb77e3e8a678196a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 10.2MB
        • SHA256 d5136a3306c36b6fc6f6f89c2bfd83b20772d890b70dcdca5c6b93147d7dd011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 10.2MB
        • SHA256 ced95c661a6e1f64e63364347a256aae0339d8fa73a3662a80620f46b84e8e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 10.2MB
        • SHA256 ae5fb86420c1b6d99775bcbf78ccd9c16bb6786384008077b2cef6c8dae7b4c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 10.2MB
        • SHA256 b27767c1b3d286ff5c601a0463b46c0d58398ca62718aabe33e89cfaf5feaaa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 10.2MB
        • SHA256 214aad3e18be0556c1cc3af9076fbe6c099af1c45ba8680e2940fc10e8da5ccf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 10.2MB
        • SHA256 3359a562fbdd1dc35a9a86c7739d38fb31e2e5aa3485e85f17da1d520d362b6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 10.2MB
        • SHA256 e9af010b5f3647a17740726877131af643299999b048524afa356461d621b89c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 10.2MB
        • SHA256 6a93433ad0f05315f94717e02003f711bae62b8f7f884c8c70cd15dc0e9fcf39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 10.2MB
        • SHA256 793167e35af4c2227bc0f2977a167465429d905d11dc023cf592c31c871e78a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 10.2MB
        • SHA256 f722155748286e2ca328e6fecc5b88d3e013673cfcf5aa980353b1cba7c67d8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 10.2MB
        • SHA256 6d96c57d0eb69367870bf582938e61ea0f563f0baaa17855a8b9e3b22b4a007a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 10.2MB
        • SHA256 72053036815695dccfb55319cbc1ad1f3b40cd3679b3e5b8af6de59ca9dd61dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 10.2MB
        • SHA256 73eb57dc5c05f6db222bf2670ee9b1b9d7be3e19d14f5996a38cfc8bc77f45ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 10.2MB
        • SHA256 773dede9aea52ef4072b56af3b80c0466e635b457ae0e7f00596148e6fbd8556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 10.2MB
        • SHA256 2e4b1052ce68d3137c46cb77819da0cef42129c1cd66a4ff601180653f46733d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 10.2MB
        • SHA256 9d9847fa2fb402055192e14265b88d804639df4b00b7bd1914ed1b4053b0fd73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 10.2MB
        • SHA256 8ef31a265796014cab9d829b53a9fa60a6db789e7eecaa1ead1efe29aec8da3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 10.2MB
        • SHA256 b9a9c7119a927cac0920a09246e58a14499a096ca4471953bd99227f5a0d108e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 10.2MB
        • SHA256 c0af1d3bec51b2f57805288820c8c06281e3fcf5a2f749c26127522d288cadbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 10.3MB
        • SHA256 0e39f996e4b18106c0b838f84baf71dfe6a3c4069556f2a3868ad7fa21a18147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.2MB
        • SHA256 230198f397c8014618b1ee94d590e228fd88ef423a8e07f5f60264ff402fe97b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.2MB
        • SHA256 aa9f3e5350f9d259de5fcebef1ff9eb49de504022c95055827ae2687f6e1fc80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.2MB
        • SHA256 8545644abe20df2a3a232f90d62e750e3bb1702d24e453243004dcdf046af533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1148-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5932-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5932-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download