Overview

overview

8

Static

static

3

2026-07-27...ry.exe

windows10-2004-x64

8

2026-07-27...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    94s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 17:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_ca67fdaf395d947fa0cecd4ecd0f9f7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 28.5MB
  • Sample260727-vx2chaap5z
  • SHA256 df1e6d4552e22f75c7aec3cc3336e714ea7ce54981f1438d540332e235bbc343
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 3 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_ca67fdaf395d947fa0cecd4ecd0f9f7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_ca67fdaf395d947fa0cecd4ecd0f9f7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5860
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_ca67fdaf395d947fa0cecd4ecd0f9f7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_ca67fdaf395d947fa0cecd4ecd0f9f7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5064

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.6MB
        • SHA256 6c6ad0bed54799315c8d5ad3df51e1ffb615a3f7d23a8952e80e977825ce9975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 28.6MB
        • SHA256 54d68c1dec49dedce56a1783ffed2269bfce4f385c836505ccf7e6430947b32d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 38.2MB
        • SHA256 30c08c15a84ab0b6934758ace577766f4e16300de37678867e7990098dae66bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 36.0MB
        • SHA256 130579036e8259034f7ff41c68d040a9f0e7d40c2330ec458ccb3d925cccb3d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 39.6MB
        • SHA256 34505ce119fc88f86986d73b9f5c998eb6bb7751c76e78a1a60ef52221b530e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 38.2MB
        • SHA256 06e8b61f0037a3d00094b0d0713b5cdd28398ecad0af5033c7fffd99c8fea2a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 37.3MB
        • SHA256 7dda39d83e66f8a1ff89dc85d352b35d3c99cfcebdef02db72338ea4a95ea167
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.9MB
        • SHA256 c3c3322f3aa740033951f0f0f083f80ef9a0599c24801fcb4be7bd54eee8ad3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.2MB
        • SHA256 7d548ee6fccc1b32c2608489fc4c1682acbb0f8f858cbfc796efe852b978711e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 35.8MB
        • SHA256 7b88a50c732497c65bd9b28e23699434e770fffc448aa671757728d95bab6286
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.8MB
        • SHA256 ede731251de8f519a2159dd1c1e28dda056760424e263cce6ed87a792c4d6430
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 33.8MB
        • SHA256 eecbbb108c5c61f3ba6b9eae36389d7d1b9aa624aa4625b47fcad667a681cb78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.4MB
        • SHA256 185d0722c488815272cefc72e2bfe6c7b414e36b91ca5c27acff77f3483945a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.5MB
        • SHA256 e7fcbe5bc5a98df8bfc5de770636960012fb787fda469b8969e964adc0451650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 33.6MB
        • SHA256 7d494f7711ff9a18674840b9772c436e1de22e128c5e6726ec989a3dafddfce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.0MB
        • SHA256 e19e2f25713e4e32e3aa014be575b30560d8cbe563bb3ce956c365f6d63e0b1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.6MB
        • SHA256 d35192775a1e6741703de449d8853231c82fa95c3748bf295730bad7c4821a96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.9MB
        • SHA256 c4da6400537ab63b807a181742576b6ec1e58c5b173dbb65ac66bce2eb667749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.8MB
        • SHA256 f441a62ee04ca20c8bfa10d721a987e5728038bff80e16c9d12b4ff0de199e7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.0MB
        • SHA256 6803218a6605136cf5941f73969d434978c9bcac7051cec83e15e3f92d77b19d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.6MB
        • SHA256 8bce40351522b6df96d2794ec332235f7e8b2691ecac6a7cd87f5bfb8c07537b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.2MB
        • SHA256 410c9a9966e8ad28ae57bcc8947f58996804762bd5d7091ff8d3bf2b503c2996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.9MB
        • SHA256 91533f2c5fc11b3a28b211b268bae7d0413fd6c74da4f24b1dce14197b8de6ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.6MB
        • SHA256 9b68c4b6de982be2cc04617f56c98af36e2d768ca8a0069d6feb917f73161acf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.0MB
        • SHA256 0649365a8d63b63fbad13bc364ccd041e13017b9cc0566521afce8b5c7d2a4fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.8MB
        • SHA256 7c0d90705058a4622031045ec6a9a20bf0424ecfa3ca1b44ad2207c9ada18081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.8MB
        • SHA256 7b5f3b0a0060ada6de14c16e3c66736e3df17952004164d5b8dc0dfb8bf77bee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.9MB
        • SHA256 2abf2b29257cd28ea5fa7683f3fc412ade2ee0981db93496871d839f2109fcec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.1MB
        • SHA256 39c1606a1784f34cb3ae90295fa2b5f3233db8b65322d6c544f4233c07f77240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.9MB
        • SHA256 5266a8ffcc902bd6bec8d8b7e87651fe809abd76b5d7d33feb8389bb8e42d9af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.9MB
        • SHA256 c5a9e2adad2d936368219a40f3319ec619e167c514081d058de73b341911579b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.2MB
        • SHA256 73e931696231f670a1254c9e8662da406e7a0cf347511f33e302a6d8b62eba63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.6MB
        • SHA256 4992202ed916974c87913cffb304ebdfbf0343a1abe27a001700c0001db6ee06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.7MB
        • SHA256 ca006cc127f8cd20c24b3cc826d22405946a23b9250382ef3af95a1db67ca651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.5MB
        • SHA256 c35566f38aee66795204cd3ee109b80e79b2b5b356fc745bcae13143f7b473df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.0MB
        • SHA256 993f194597e88f6c359af776f365d245a001e2f72785828e6c80a84b7f9e489f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.8MB
        • SHA256 c48e5c9501e0389dcc77f656636b8792a334dda4662c1a5e866ba4c28a91f227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.7MB
        • SHA256 7df47e3b4e0b432fadcc983baabd1bd380144a9919dd0527cb4a552102c2eafc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.3MB
        • SHA256 e5f418932b5ae8400ebea87c1db9b659f434e17f28a62f41bdee64282a9087e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.2MB
        • SHA256 6ff9738af7021632bcab03e02cfdde623b057af5e9ea05e7e88adf204a34a61a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.9MB
        • SHA256 57c575f5b94c1e34ab6f797764f3ce9b61b2eba89453498f20f148d2e5de1b5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.9MB
        • SHA256 681030e2ef590da2c81d5aa93f47d9a31ec00d4c7e9bb7ac72eaa838776e9c34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.1MB
        • SHA256 c04b1104e52bee8da278cbc8c912935362d781423928c70be5f5631c1bce6e48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.1MB
        • SHA256 815298db3ac93a74e9f5458a9f5a4c9633aa965644dd0fe61f97443897810dac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.2MB
        • SHA256 abf836465b60b33e50e243f1541009d0d10c426c3b84ebdb131aae080d55e382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.7MB
        • SHA256 20e3b5fb18ae61156a49a66c778a4565d7b7e5f81ca4593147ce29f1b414666e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.8MB
        • SHA256 8c019f9962b5ccb330cfbac7443ccca338fbecf67020006f90e5d39864405ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.0MB
        • SHA256 5cc28fb931d34fa3e0d17f1929b0169760f69997dfdf76f6f4c10eea4b441319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.6MB
        • SHA256 88ee0a758248bad4b61e180ababee7142affeb8ec03c61f3562661ea0003b332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 26.9MB
        • SHA256 d97e28f13c5c68ce7a231b0b66046dfade419d59542ed7ab0bb657459d5539cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 28.4MB
        • SHA256 ef75a704be9a86bda7d56a4423ac8088beb93e6a6962ff228335d964a89c05d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 26.6MB
        • SHA256 e9a379fa43e49bf64bf7f0d2a9208fa6bd36443c6b8a92d4b56ddb0eca10e39b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 25.9MB
        • SHA256 191fb3a3eea2bebe83cb936d1f3480655fd11b06f0fc4a42c85cc663eb6bb326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 26.1MB
        • SHA256 cfc2aee0af81eb653b1c600f427adc3aa66ea208aeb1dee1c4c50bacf18a6208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 25.2MB
        • SHA256 6fd55898d0257dde924c34ec74f726415a15c97c87e1b1058ac34770195ffbea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 23.6MB
        • SHA256 bea2766709d710aac53fa7464dd90c83607a2519ae14ea0f3e166bfc3fa79d59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 28.6MB
        • SHA256 ae65e7764279dec128ec538fd174031bbf69f35f95f8e2edd617d9ca39d2dbad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 28.5MB
        • SHA256 df1e6d4552e22f75c7aec3cc3336e714ea7ce54981f1438d540332e235bbc343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.1MB
        • SHA256 6ec43c0a7feae9f377cd17ee214aef5804aff3527d39fd0fea50110600de134c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5064-12-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5860-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5860-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download