Overview

overview

8

Static

static

3

2026-07-18...ry.exe

windows10-2004-x64

8

2026-07-18...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 23:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_33caff6f13f26cd9e43ec252fb704bef_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 6.0MB
  • Sample260718-3vv2psas6t
  • SHA256 b206707ad34b89c517d93d00e4f27033af44f01c4eda0824e5927846b9dc2d1e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_33caff6f13f26cd9e43ec252fb704bef_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_33caff6f13f26cd9e43ec252fb704bef_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1660
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_33caff6f13f26cd9e43ec252fb704bef_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_33caff6f13f26cd9e43ec252fb704bef_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3580

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.0MB
        • SHA256 86def18b861d8985624ecdea95b3dd8eb75d24565db312cd83ff225d582a0f64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.7MB
        • SHA256 30ed438f90691f95d33871478d7c7945998eae668d092134ee9ef4a4f2272d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.1MB
        • SHA256 00c3de49e610698620b2c91362020790fe9480cb2377e2643ae304f62d277edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.4MB
        • SHA256 a9bdd4ae5048aeffa5e89b15753e475547d00d183c715fbf4cd29044c0ef5258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 12.1MB
        • SHA256 27e3e30bf0b8e5c95073a954836b01fc5da523963d1c28d0bd6b0c9e4c67a050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.2MB
        • SHA256 c02452abf2be5c7150fd9e9f01273f43c10d6d27eb9b9f7095bd14c24595e8af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.2MB
        • SHA256 8a40e53edd357fb4e37fbff6de8cb5704fd586ebcba455f4969c2f7cf1139cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 12.2MB
        • SHA256 bd9a0004bf32a580788a85d40455080459420ceec3afddb4facb41eef23d1c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 18.1MB
        • SHA256 24230a60ccfa01fbc51c79ce1388eaffe9a718c229eda47e844f51ea627c6ba7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.5MB
        • SHA256 a3c3e548bdc038b76941d0b809706111339e4855c1cd5516bb8d079a9011f9df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.4MB
        • SHA256 9620afc3818721aeef54db3b07ebeae8466240f4585939ccc91d98b83b95b58f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.7MB
        • SHA256 b4bbf6c3d49dcea5c3e56e435cb8a3b2585583df9ac6ce074a8bdd472de8ca8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.9MB
        • SHA256 47441f36d8436045318c964cf9f085c8a00bba869f5706e7892903fc81fbbfa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.2MB
        • SHA256 146e463f7b950148cc265cc0df2169d6da99455a2bc035f9f4249891346c2a3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.5MB
        • SHA256 348a9e5b6b052153bf62a8712308e2a62e3f8d7bf90707ff97b5035ca488dea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.1MB
        • SHA256 ac3dbf86d62d984a582d18193fcf0e5b209b961efe21f5c416e23715b842c0e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.1MB
        • SHA256 8833b43f08619441c659ac355090a6f849b463ce10d6ff4b8060f1deb5ef52f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.1MB
        • SHA256 e04a88b8855e013fbeb439f4af50b155e05dedebb6d75a6e12dac0ebd9fd6213
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.1MB
        • SHA256 5c3b7e8c02712555e2924189022a9af5640a01eec31b53e86595b56f6e1f2089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.1MB
        • SHA256 af709f183fe073dd2c99b846c94407f60cbf4a090ce38651224f5642adaff07c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.1MB
        • SHA256 33b6ccba4acd12e04e028cef9e39a7204f8a813d7af56342c20793e887d63d09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.1MB
        • SHA256 dadf74218cc44e8036b5ea3224213e4eae2eb9d05750fad931416b28aed76255
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.4MB
        • SHA256 82634491e9903ccc4777c2285d44577b9b777c6bc7e9b1f245bd703675deb3c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 6.1MB
        • SHA256 caccc85533c8713443c25a916dd1f3bfb0a69ce57c3ce1a3e23b96282fa32f72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.1MB
        • SHA256 8f8d6359c2d121a583bb68139835505ffc7b2039d70be85d1f235e4a062f2444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.2MB
        • SHA256 90b316421f070d7cde1653f5e58aa5aebd377015f6b05d3704cc0441968118c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.1MB
        • SHA256 c2f69ec5f3639d99675655d08b6e9632e5b05498bf2a2f022b0dfe7c7d6862c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.1MB
        • SHA256 82ce034d4d5377e55ac277353751341cea4385d20d7be5d0b9001360f83a2dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.2MB
        • SHA256 3495586b4e68a4d41214895e8da00fcefb50fd4db34bc5171421052750232ad3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.4MB
        • SHA256 804f951f0397e99cf96da7f696751daac13356e54fe093ebb7495e6a309acba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.5MB
        • SHA256 0e952f6e391f24171d80d096660b409c57548da5431ba0c6d8a2538ab13512ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.1MB
        • SHA256 6ac0c95ecb0c4031ce112921e9482d392fcd3ceb671135142a7adfd1f2c99bdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.1MB
        • SHA256 cd26302c9d3ca367d31b5428cba40e8cd5449c80ea30571a72778a03e9c29ac7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.1MB
        • SHA256 f0be4832eeb3217ae6d360ccfbc800a7aeb744a9c10cbf11702ff6a8075aa7bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.1MB
        • SHA256 2d1c08b3d3faf2865087f60a6a1b810dff8afc935d49b718139d9a38d52a039d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.1MB
        • SHA256 5e233d597813c7ebd82e7bb9d3d79ce4fcfd99c93f1428360746f5bc1566c949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.1MB
        • SHA256 175788f444e8e1acb6f317d8e52ad23ce994c201ce9d87dbed3be19c3e6e10cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.1MB
        • SHA256 ab1435c6398a4067445b4a8389f6db5f240778d179b6d4b854a7352dc29021a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.1MB
        • SHA256 c1d1ff516cff68e521371a5ce1cebf3eb73a36581d0a2b047191b28cd6b7651b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.1MB
        • SHA256 ce4b777626b779e7af18fb0200198b0a55733d7b31a615a70fe416a09b96ffbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.1MB
        • SHA256 42122c135387786da701b92af3f710867ded1b50ab88f7c2914f98c49990747c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.1MB
        • SHA256 62621390479aae678c156c4169269f4a7e205c10352b03a5668aac7411d81d9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.1MB
        • SHA256 abaa1fdce27842aa927e8dacf869a77dcc826cf550b1f5b737dffcd6665f8f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.1MB
        • SHA256 0fe940dd32b97571d525dbf074aaa17d7781071a29401852b3c6c9f0fce09be8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.1MB
        • SHA256 8e5e084fbc4427db8a0c5dac6ffeefa40f88447f38067d6b08f82a3145ae17e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.1MB
        • SHA256 010380f29d9926194725bb6038d89f57dcfd5928c10f8ae26d4fecbc0f34fdba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.1MB
        • SHA256 05c97e787a9569f0a246fd068f0d7089c107865d1bd0928f5178487d92491246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.1MB
        • SHA256 2d4734b84efd5e8318ddf0fff357b75ea771eb5eb3ed3fb6eb2d12223394d36c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.1MB
        • SHA256 8264d69f62e70d7e19c2bf2616ed15c8f0c97158f08d2ed7e768d0a95bc62491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.1MB
        • SHA256 63bacb6fbc188fe0eb77212ebc18932f2a4391360245ecf22d0b89b3642fff45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.1MB
        • SHA256 c359d27610cf5cb49409d947e7f0c3d600235e2ac12fbc9da37d5f0f0f0f74cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.1MB
        • SHA256 2d0a9d2f55af9f33d8c06ebc69b0e0cd638c561d6068e163d545866c78e4f284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.1MB
        • SHA256 ea59089fdde4268a7a596c95c0945db599b27aaed5faf36bf95d599862dc6d52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.1MB
        • SHA256 f02b29d8e05bd73ab3258b7eeb8a321e4fca607584a93ce75484523b0e6dba6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.1MB
        • SHA256 9261c070c5988c28e5e0aab527aef2e8498399b6e83eda3d0a022b5bc2936a75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.1MB
        • SHA256 30a6f9f60895cec55e1f4593d91885191a4a91af1e60f14be19188eaa3da75fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.1MB
        • SHA256 e0194145e3bc021e1f9ca415b07616c7872b5da9df0ec98a0f3ccb9e47e1c524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.1MB
        • SHA256 f15abfff7329368c4fe0f18a4ffc28d281490cf561071e5f5ad589912b3cafe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.2MB
        • SHA256 43be954042a41ef24a7de88f12c7226cdf8dc288900e56233242687429c1429a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.1MB
        • SHA256 5ec5a5035a0f547cea74157b4d0c3b251c1865d82d235a9d661d59c75ef9a941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.2MB
        • SHA256 45898751b77f79989fa915175670bd1df1be8f8e19c2ee790ffa2d9ff6a2c517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.1MB
        • SHA256 698545513e8b0045c967076a15b5360f164520d774edbf5558bdf20514ec857d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1660-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1660-16-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3580-24-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download