Overview

overview

8

Static

static

3

2026-07-27...ed.exe

windows10-2004-x64

8

2026-07-27...ed.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 08:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_4e8258794ce8fb3fdb9e6215a3803dbc_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 14.0MB
  • Sample260727-kdkwasygmd
  • SHA256 b975c2e0b96e00d4aa6509005294e3abd2e5647364e7094d49549c9559ef01b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_4e8258794ce8fb3fdb9e6215a3803dbc_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_4e8258794ce8fb3fdb9e6215a3803dbc_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4092
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_4e8258794ce8fb3fdb9e6215a3803dbc_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_4e8258794ce8fb3fdb9e6215a3803dbc_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2208

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.3MB
        • SHA256 69710ddf52eaa5d28205148debe16f8a0169cdd5b1b23f1f8338d4d943997c0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.1MB
        • SHA256 5084e5e4f1cfbe765e712dceaa0588720d8896ac7c2401dacf415f6af8dd6208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.1MB
        • SHA256 ecf4b3f73818ac0ea82c3ea23db73f74c9b776cefd91451c1cf324725639133c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 28.4MB
        • SHA256 fc365ed23a9c0cf96b15320081234ea35428af4c997191fd7c974578f5a1b145
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.1MB
        • SHA256 606a67350c52d1b7d3d061932d764b727404ce3a38d2e9d19365f81b0d91c524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 28.1MB
        • SHA256 33b0f0ce87011ba8d27f2fbcaaa1071624ee2337b6cd5a718447ad23f21eaf74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 34.1MB
        • SHA256 a51122a0e8bb1738a3cc93fd0f736602861d5b7f9df3c8a7f39e27c564fed871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 29.7MB
        • SHA256 4c74ccd4d328230e3baf8069c6a787bd7d5c98938d6c9a25b72b7f4bf50d3415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 31.5MB
        • SHA256 34f9898fdccbddaa8c57e2d0680c533a6a21b930116e25f163d38222bb543ff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 30.3MB
        • SHA256 10085499f67116128bee9602f6b6290ce2179d5aa8c34a6c26c7dfd930e8b946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 29.7MB
        • SHA256 06113348149298d96ed6d65d6e2ede2d3d47f14aaf7630516096e899b2bf1c67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 29.9MB
        • SHA256 46f1454753fb64c584f2f70b9d1c78100a27a38e8596e637dfc29259ae37efb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 31.1MB
        • SHA256 77fc84467a8b7071d0729b7ca51c9885475c0a7e5fd2f466fcf5f4befab007d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 29.5MB
        • SHA256 7ed88b8db025517fdd8e918501feac2fc9eb8cb9f43dd7d982439628f3f3ea95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.1MB
        • SHA256 cf938d4bae287aa49555124ba1c055b92290959a527d700c8794d004c8f83fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.1MB
        • SHA256 be7162a4cdac390364d1058aa78245119fed3c9bdf69931138dcecbb938fea69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.1MB
        • SHA256 c409646009eda02d6164e9758f2b5da589be309800c5f24a5edbe8cb0aaba7e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.1MB
        • SHA256 5c3996cd9115026db37da3fd5337fc6780098243b8a4a60d9d9adfb8f097a458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.1MB
        • SHA256 d7a89e228158dc537f0f942a277710b77642134ee95b33925e53c89a08ab5a62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 28.1MB
        • SHA256 9472190fd79f03bc8bea3a6008c13c8fc153c7a4358510dc89fd28d3582a8217
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.1MB
        • SHA256 eaeafba91dcd217124d3c6cf2bacf3dfc8ad0c10d618c6397863ae95c7c887ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.3MB
        • SHA256 4ce36ec9166d7b0b3141ae77b3a432dc4b8e711316253535630a0b33491e858b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.1MB
        • SHA256 48d81b567193a41b1326376754fd620b5acad549be81fa088731f6a0328b6777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.1MB
        • SHA256 171990725b514c5e3a681b8be7c50f43c717e6b3d25d98bfb24d87a57ca15b19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 28.2MB
        • SHA256 e1e0a933b6455b411578925928907e309854c2935564ddddef619e0cf5942e4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.1MB
        • SHA256 65a9f1f0efee9d2542bb146bd32a4cb38610f4a84d9dcfaf8953f31e6a0b3cac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.1MB
        • SHA256 f127cfbee31298042651004580b8dc935742da5cb4d113575a1b2b300630d2f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.2MB
        • SHA256 86f91841935aa52af328cdf6dccd2011a97e0577830970bcb3e9418c7bc14f70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 28.3MB
        • SHA256 d22ccee7d3f88f96f951a28af09775d8a24c107c4e1739b108bb6620981ea9de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.5MB
        • SHA256 b289b5dce108c7a76504168a49fba8e94ab543b825818094122be2be726b48eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.1MB
        • SHA256 9589675ba5d44eabc6f8e7e5618e4f12ec5d34a7c8d3d15bd179ac0aec1c6873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.1MB
        • SHA256 bad0cb376029004ed8d6864efcf92a1399500aedf02a8de48a4e6288a2598c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.1MB
        • SHA256 7443f512479d2a744bc91e90e0a9bd5007f13f2202957140a20ab6463417d6b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.1MB
        • SHA256 b9386cc1e2b67fb8de65e16a7a49b40c72d4e3c632bdab08a24f914c7d248f94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.1MB
        • SHA256 004944b720ebcc3db37aa5666253d3d949b9efbc15806f59f275268d3b278e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.1MB
        • SHA256 3b3d95fec4bc6c49862d4f370e104ab5b9abca4e3f34d2fb35ec8a4bc0c10eb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.1MB
        • SHA256 64e268113bb6e6f5694f3da7889732e85b7dc98444559c3c5ed7d1b4ab83b01f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.1MB
        • SHA256 267d2e884c9293f45a3b22f09e09dbefa02234413b3b07b108a3a9c6160d1bc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.1MB
        • SHA256 ca2ddad4d5a4e439a4102cbcd80cbe6a261f92ac0c37a6c6cfd93fa6853d9bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.1MB
        • SHA256 fff250ce33109e73d15fda998ddc0b87642787bcea5730fc0d34f77bed8dcbcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.1MB
        • SHA256 ef99febc2ae2fc40f8a66f3e77bc98e0d3072babd35c96a4718de7d4ecee2938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.1MB
        • SHA256 81a87cfbdb44ca1d2ef51992cbb4055860beac3f82c68f8fbcd729c2b452cbed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.1MB
        • SHA256 4e9448ad61a4ab0e38d93cf94e6408d2acbfed71679c383c3aeb14e647b52dc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.1MB
        • SHA256 ea6470367a2a2096f4055ba2d33a61d61be9e3287c9be48d0a6c5ae5e187cdf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.1MB
        • SHA256 233a2b3e32f7f627740f7226370c585a4c1ada8e83a15d034774c16db0aa59b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.1MB
        • SHA256 133d50cbe5a5513101e7010799b565698a289a10584dc40c6f28630141af6a4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.1MB
        • SHA256 f898b3a77588901479ca247c1ffee5d0d23eb4217e20db568801cc0e1f419cb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.1MB
        • SHA256 53bd75f8753028b6e1cbdc1fc9bc68e7939d95939dc86b26eca7a0bebefeea84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.1MB
        • SHA256 e314766e02fcfbd56c136ca90ea762e1b8275dfc952d37c9dffc30dd30f6a8b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.1MB
        • SHA256 5ed0ca81034904db43ec7c1cd3049e3bf10f83fd5c8971e0029fa0ed11bbb53e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.1MB
        • SHA256 39d70a39de0ba806ded15d332ea9d4a22711bc7dea89dedbe90afa22f8ed43e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.1MB
        • SHA256 7f7400da06dc7b624db0bc48f444f01248e34df3708fcafe5555967ee075691f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.1MB
        • SHA256 1cb5e9e398c868c15061bede8c0472d4915180b611e7a2378c9d9716539e5903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.1MB
        • SHA256 6a087f864ac6540d929d57afa161178a93f76a1483a98824413d2213788b998d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 28.1MB
        • SHA256 a3cf4afe61458dcc9f35ae4ef7669a3d852939c000d35c8ef8422e199a2cb30b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.1MB
        • SHA256 c032750962012e00c9bdbcc47156ba81fcd9a1a68c8006f80b1534f91e4300d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.1MB
        • SHA256 d979cc554e8196774ede216a1eae358b6cce52663070fa270214b7ae1c4cf2c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 28.1MB
        • SHA256 48294d3f5e21de27c6cab926d8c2e1209624bdfad1b20ab1b1e93de89e30f87c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 28.2MB
        • SHA256 716baf875a866d3f9045ec4976dbea726f94665adcc03161c18fbedb37fe7d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 28.1MB
        • SHA256 704ad59182db7433249d2491a1013730c9c214dd3d01907ec42a2ff233bbce69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 28.1MB
        • SHA256 3f6322d179ef248db52176a1bfe3e9fc7c00532a13dd1028c921f7c6edbf9480
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 28.1MB
        • SHA256 bfeec80d927089622db1cf55df07aa151ec216f3ced83d29f21f0e337a7a78df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download