Overview

overview

8

Static

static

3

2026-07-29...kl.exe

windows10-2004-x64

8

2026-07-29...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/07/2026, 05:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-29_cd97cc42ecc0f6d63bb3199aa344e186_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 16.9MB
  • Sample260729-ftft3aeb84
  • SHA256 367c11ad6214c6c6efcbaa9ebcfca80c6ba9169867c8f69712e61cdbe1a80a8b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_cd97cc42ecc0f6d63bb3199aa344e186_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-29_cd97cc42ecc0f6d63bb3199aa344e186_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2576
  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_cd97cc42ecc0f6d63bb3199aa344e186_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-29_cd97cc42ecc0f6d63bb3199aa344e186_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3148

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.6MB
        • SHA256 5ccd374036472df17aa1f831ac0d472a30ee468bf61f4e2350e54efa89d10bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.9MB
        • SHA256 b6e3552d1fe3d24e16087d40b4dc9d4834f0600b761f45e0bda72f0e31e41ced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.9MB
        • SHA256 c74761446e6262ec481724e18ff5b09ee4ea83599fcf2298aff23be2d36d2e55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.0MB
        • SHA256 51b4eeadaedac508cf89691b829c6243abf156e01d0e7c11227d843f61fe2170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.0MB
        • SHA256 ac0f384839a411974577ffd7ca09979f8ed4313f98623241761a943e47f80450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.2MB
        • SHA256 69b34000f7d6dde4bef99201d51a8749d2504843208d3b11992012f63b1d3720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 33.8MB
        • SHA256 80e1421e9d2c4d3811ca2f0dd6beb7a7e19072e8b1ab7216eb42fa91f8a9f2fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.8MB
        • SHA256 a7e269816e566e0a07222f751fec37ab0f2ad91aa106c9d2535064710524121c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.8MB
        • SHA256 2cc3b22784e63f78631609a7b67e6817200b173253caee53ab92d3a92d0f7e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 33.8MB
        • SHA256 eea6c9ad5f46136aaa468707b8d7a4f93050c1f124911853b596b1f8c235d8bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.8MB
        • SHA256 3677854350b224f6f6456fb789b39af8feb09c2b558d93a66a399d0c07c61c6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 33.8MB
        • SHA256 79f6b167af8b2f802eb558cd7a4ab9715996702b3dafc7a9eca36b870c9287e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.8MB
        • SHA256 adbc30a835c36ffe7eecfd6ba3679f541750cd650717ff2314f1dd9fb3c89113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.8MB
        • SHA256 3b0bf5bfd1c2b542c61f68f1126d19d2b7f0dd1ab295c000f02e0ee5e32b2e24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 33.8MB
        • SHA256 006164f71d6bfa57cf36bbefdfcf4aaacc30f759c6f3151502fba22a2f2a8d17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.8MB
        • SHA256 8996446203c8d0d417ddfd7e088b40f49fa085eeeb6ca5720331a0d30936af59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.8MB
        • SHA256 915338ef0e31cbc3ebba39291ae757c49c170628d49c8f48848907201e7c305b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 33.8MB
        • SHA256 e8de8b464afe506fc6d1a2e8a011e7f9c8ae469799d044db78adc098bc378c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.8MB
        • SHA256 fe4ae9c27399cda9ebea1a5f4b9194bfbaef8d6896a4bda3929ebc5bca0250f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.8MB
        • SHA256 b8573673a12cb6ee281cd87391efaf7da411f68eac4a90d6f20fb02493950a43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.8MB
        • SHA256 38a82d48b2e0b77f90c878e6fc7ee20c3cabe03f38eac958700dea2640b7a224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.9MB
        • SHA256 8a153dd6ef724af398c9ff1d7c283c483ec3906466709395571fc2a11c9f7782
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.9MB
        • SHA256 1822cb389e3b5b44fe4552871035509f9871493118bbf537d18a1e57c6dcdda5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 33.8MB
        • SHA256 8d4c7b5b3ad5a76612c6ffdf06e510dba9e5db8f1645de896d28308fa1b76d00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 33.8MB
        • SHA256 290d3596cca83ffebe5b3ba4903a93d6792d8c8f71df25f7689141b8f2652e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 34.0MB
        • SHA256 3ea07406213b786d0eb3c8a131c050d3da270868edcca194e5af6c50b2ef7064
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 33.8MB
        • SHA256 7dd313c99f753a02110e0e76a42417e4424fab2446f8a6cc32434b15dd269898
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 33.8MB
        • SHA256 f5f4574e7d1be16463c134cbbaade252530e404dbf57c81132cc38aab61e3ead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 33.8MB
        • SHA256 2d2b19315cd0de7434d1005c9c7b9bad82f787a8cc89cde53037f189d61cacf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 33.8MB
        • SHA256 7f634214066deea20fde0b4bd78f5fa59fd53cbe8de4d62fc4822b7b69165fd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 33.8MB
        • SHA256 a97ca7ff81ab5fde9f89cf56eaed98fa7d0b5b6293e0e43bbb7ad4c583c7c525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 33.9MB
        • SHA256 610f143064c78d491e4da90b3082d5fcbb2e6acc270bd5a19cd66a05dd66b165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 34.0MB
        • SHA256 04bfd2ed272fa5040ae380848b8b4be3ea7991b9b96979816191e30f65264c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 34.2MB
        • SHA256 5ff93db48b320f02d72c30b770bf61401334ba0aeae78dcbac6e9c77983f6790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 33.8MB
        • SHA256 aa32de2898013fc2ce8cb81aa70bba604aaab067b30d7acf62fa2f670d98d158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 33.9MB
        • SHA256 8f79d2a5b87054ccce863fb9062ab5077fe8b31f8486a2bdee0d508096639205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 33.8MB
        • SHA256 bb9f6b921fe19c1f5d322f710eae85496005ae04ea49bed9b203271178d089f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 33.8MB
        • SHA256 f592fe0b79039280883fed556cc641fb1c127bfdd714e6d1e4ebb1b3a0aba755
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 33.8MB
        • SHA256 dba328f727f6aa0e2f1de3e95cf799155239b54d9da61cfb0c72eee376ee1cb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 33.8MB
        • SHA256 a917f600b85fa90969e1f3567a5e457400930718f6db1de505e10834bdc3a821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 33.8MB
        • SHA256 abd0ddf9793b05f5963ec1ba1da69cc50e8a9919393036896e44806cf9b6532b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 33.8MB
        • SHA256 2d6db8e46154ff55285ad75688d33534f8f25b32c9d1d4090385a72075ed3474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 33.8MB
        • SHA256 9ddaba42aafbe47aaa52a4895f55b8a6afabf1e8903c9fe58785b8860e4dd6ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 33.8MB
        • SHA256 12b51c107225ea0d54488b0c9195ec07c42a7f1a6ea145e9a7642ae4bc522b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 33.9MB
        • SHA256 2c039566432f61646856dc6ad969e0eba7d05f6e884f372a58371520b9a54349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 33.8MB
        • SHA256 b16b3a375740ea99d9e92ca152e6b19d76dc01fa042e606dee9f257eeb35b11e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 33.8MB
        • SHA256 c02bc20f0efea50e42de0cb80cb1f12ab0d50dfb8e332c433477a3326035d33e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 33.8MB
        • SHA256 d729c54f0627030cf4a98b7b4567a0715b410ad3804c2dbf38eeeb5f896117a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 33.8MB
        • SHA256 3cb201a2598baa37dd2d6bbc79d37002be66477fdf1ad0722c2cd3024e6c7c92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 34.0MB
        • SHA256 33b91c2f23c163e402fda50b6ac58de95585da3e35c41099e41f2cc0319fb16e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.9MB
        • SHA256 ca9e7d31943fb7bcd119458d9b5c7a7e6c6b6fa258c5ea2bac1e7617006ccde5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 16.9MB
        • SHA256 367c11ad6214c6c6efcbaa9ebcfca80c6ba9169867c8f69712e61cdbe1a80a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download