Overview

overview

8

Static

static

3

2026-07-29...kl.exe

windows10-2004-x64

8

2026-07-29...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 19:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-29_fddd1ca67395fb0b0f550b9fbad76a12_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 16.8MB
  • Sample260729-xpjtlazgrc
  • SHA256 624c512137a628849cce624103c74e3c1df7bdc492520b28000a2945dad90313
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_fddd1ca67395fb0b0f550b9fbad76a12_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-29_fddd1ca67395fb0b0f550b9fbad76a12_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2060
  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_fddd1ca67395fb0b0f550b9fbad76a12_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-29_fddd1ca67395fb0b0f550b9fbad76a12_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1352

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.9MB
        • SHA256 fa2fa5f7ff0919ecf63e9e3ea80a42e9599caf4ee5ca39a09829044eac593c69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 17.1MB
        • SHA256 1f5dd648aea88b50b87c07628ffbce7ebf3e1d7ede049a15bc87cc99b3341d5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 33.7MB
        • SHA256 ea1e8d53d0ff207779b510f91f961b5bc89f74c141b764480502963d19d3f66c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 37.8MB
        • SHA256 6d9adc71cb6ba008c38c9c1db369c67f5d0dc40100a1fe777f725a0aca54d041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 34.0MB
        • SHA256 a4577031146bbff3c37e544075f55b77896a9668a842d51e08a0aebbb0ef0f08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 57.1MB
        • SHA256 275c70d1fb8f26a76d97e2d92a666a9aa794e68eed5a78304dfc67778ca098d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.0MB
        • SHA256 9959866e045e89277ea52fdb65ff62f4a346ac42cb724ff38e441d592c6fe450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 33.8MB
        • SHA256 8d2f8d90d1682cb97ef9eb0b35ce3bb4f7193740bd96dc453daf40f0f528bb60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 39.7MB
        • SHA256 882d96ef848d40e4c463160c741c0ca13d869cb2a481cd6992dfcea4507f5954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 37.1MB
        • SHA256 d57a8def6368425a470fc57743640fe78caf89090dadbcd8058ee570c7a466ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 35.9MB
        • SHA256 6c4c921ab1580ad92af29594c8c03f32a39df9b3999bc165e712b96be953ecfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 35.1MB
        • SHA256 d37022b3b4cd0717a1c13c89bd8776a1f30e126d6a586f5d3cb8dd51391b0f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 33.7MB
        • SHA256 f0e2483127f33561518e53e4f9509d8462137b1f5b5805d8a6445b6120d2c2a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 33.7MB
        • SHA256 7ad4a2191eb31009f4aeb59c8969dcd0d086db2d09672dd129ff304e4fb92109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.8MB
        • SHA256 989491779a615e706cd2a73d72e9ee46ecccc1d92e6e0af99c7722e8985e144a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.9MB
        • SHA256 1a1810b287e87831b6949a6d5da8d614d4658f4c7b0cdfed97cefc2f4b5ad464
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 33.8MB
        • SHA256 7deefbd545419ab48cd618c6be2ecf98d0e6e4ce02d9130ee95455c24227f688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.0MB
        • SHA256 24c2fe10660101ab72ec9f493ea06625e28819b20a24983f5b300ac75663c6d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.1MB
        • SHA256 4171b251535656bfbc42385819b08edfefa208aabe5d05c01407e97a75fa9642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 33.7MB
        • SHA256 51ad4c5501d43e1d8614726c158f25ddc058d018a516a6e8e7d1ea70c857655c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 192KB
        • SHA256 c61d5a2b5856b5a273a4b636240fa277afc38dae069b227c270bb7f4cb23e995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.7MB
        • SHA256 a67a6b15d0786dbf71ff96515ebc48205faeddbf2220ed84ae04551a9068f7c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 33.7MB
        • SHA256 45546dba7f64fc0485d2f389110a27f49a280cf4210d16084771c326f7242d8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 33.7MB
        • SHA256 3352e4235f5ff1191c5c8b87112fca1b08bcd38de45fca8b3ac86f982e1e0feb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 33.7MB
        • SHA256 b7a0669668976748dd92fe465cce70822bb0e1f4eaeb2c80a5fccd19b9844900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 256KB
        • SHA256 60295b05dd477e3f151981e4ada08090298a0ddb349ba63df0f728dfc8f9cd6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.7MB
        • SHA256 25521ebbb34966db0a33d5774949e5fb58280b7628694aa51fde4ee7c39281ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.7MB
        • SHA256 f45c633fca1a1d64dd30095b4260bdc5939c486dc432b57cbedb3231b98c0fab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.7MB
        • SHA256 09751ad717fa9689c73905a602ca350e86de5cafc1b5b72ae4ec4293e8e006e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.7MB
        • SHA256 ca427aa975880121e06f87e6a54941ce3054631286b02aa090a66cabd40ec4ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.7MB
        • SHA256 03feed3454aa0e7d7b1555312e0575e64a44a0e8794f0b3a928f7c84162ceb36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.7MB
        • SHA256 97f2c9c4bd8286cfbc59bb409e0e381e8f89129e2bb62e12d1fda1416dd43e02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 33.7MB
        • SHA256 fb054ea5bb28e753ca8c8d167d42f75ed1b0c627b48a142162975d0aafb688d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 33.7MB
        • SHA256 228b6360032674d731a32129f6f4799452b7ce942e90fed6b0d173977c8d8b9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 33.7MB
        • SHA256 7509845b795cfe03d69416cb7146e722e534e8fb82cbf752d826d485ce2a7c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 33.7MB
        • SHA256 60af432888b5c1a3c0af2ee90663f8748a85a0196e5e2357f119711b9bbe3513
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 33.7MB
        • SHA256 728a8e627c72ecb40b2e0ccebaf6ea8ec185d9afadbb55fef2e4759d090b45c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 33.7MB
        • SHA256 d0b91ac8e7d090337fded1a5100e208a0656ebf56cf61765cae9dbe1964d092d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 33.7MB
        • SHA256 6e7cec5c4525fc732bc6b93c67be8fef215908582d6ac8741c9eebc90528993c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 33.7MB
        • SHA256 9c3c238fda84af2391260beaa949707df79cce0d95bce605aa960a8aea54aea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 33.8MB
        • SHA256 830554fdae7413fd01b5c4b3e1e0fd2546b7375c5e4bd085bb344dea4c79f56a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 33.7MB
        • SHA256 ebd5f1347244ea935a5222bb115f64daa10aae2c5f04eb73b8f9b04999c88cb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download