Overview

overview

8

Static

static

3

2026-07-30...wk.exe

windows10-2004-x64

8

2026-07-30...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 01:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_0d961b2812825389706ed7658ac9fabd_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 28.6MB
  • Sample260730-b1cc1axaja
  • SHA256 217f1e3c203bddf0cd0b151dc244d3da4b98ae240f8cc5fa3203c58ad783eb0d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d961b2812825389706ed7658ac9fabd_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d961b2812825389706ed7658ac9fabd_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4920
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d961b2812825389706ed7658ac9fabd_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_0d961b2812825389706ed7658ac9fabd_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4768

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 29.2MB
        • SHA256 617368ca66ee76c1443a30903259b0832d1924541f5a0c0bfda5d7a295f33485
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 28.6MB
        • SHA256 217f1e3c203bddf0cd0b151dc244d3da4b98ae240f8cc5fa3203c58ad783eb0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 32.7MB
        • SHA256 ee80fab90d29dd938279b2dc9fa83050659f0f7bac9eaa6acc0aa20f8e52f02a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 57.6MB
        • SHA256 ce41ff6c16e831359533ec99266cdf974b5e177c5c33af1466a6285d282c6ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.1MB
        • SHA256 2fdee051c68b3424ee3a938c8385bbb6411695f2d36df5cf19fffca734b95cae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.8MB
        • SHA256 13079c09dc40ff5ed0b6caa58ffab318411aa0a4a0aa1766f1987ea6178866b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 57.3MB
        • SHA256 d326136c1dadb65a5c644ba9ea51ea37c5913f0ebaaf006e36f2e64f01bed93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertToSplit.htm
        • Path C:\Program Files\ConvertToSplit.htm
        • Size 57.8MB
        • SHA256 6e9e2f3dda3c2a2ca2732bf32da88c0654ab551a3c943bdbbd4926ff713af0ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 59.0MB
        • SHA256 39e7d5ed8c3f5eaaa3e3c3b7055bf901a9913c00f92e03119b59d3e39e9a9882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 60.7MB
        • SHA256 521d7ffdce7ee645aec80a68d93df0d9b330a4a6528018f9c09b57e311d1c1c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 59.5MB
        • SHA256 c6e7a906cea4bf2c29d3d1420d59d741fdd6e615d1ccfb3c9c35f375cf9380aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 58.9MB
        • SHA256 02373ae35eaafdacd65f4d19cf8f2e8603f2800434657dd1cdc7f4bed0480887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 59.1MB
        • SHA256 de004b6d33c85cf67d63e3b8936e72e97bf1d497ef8c411bed0d393e5a0539c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 60.3MB
        • SHA256 4d31aea6216aba1c5fc0d6a0d9a7830aae5ef3ae226a382a6301aa56d7961ea6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.3MB
        • SHA256 b58c70fc65c4acdb5dd788663d8fdfc69a3f0615a66509c093a54457a63b4b58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 57.3MB
        • SHA256 77f4f47e74a86a8874f9920dfd9c10d4adde78c87396c83028a8b622bc3a5e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 57.3MB
        • SHA256 41c5cd119637b22fc460457b3abed0996d59f050f9030a389b3b28fe540aa377
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 57.3MB
        • SHA256 c05903e70a018b27685360eac3e4d1cbcdce4d31b119c2fd5442199117ba71fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 57.3MB
        • SHA256 ecb295e5fbf3083bffe4ccae7a72d1f256a437b3b8be4456a165b3b85368c607
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 57.4MB
        • SHA256 e2c782feb09b46e65374e80f441aa10c508ef582227834b13b24c65c697ef16d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 57.3MB
        • SHA256 bc518dba85fc8d8bf4faf3090c7e8c5e322efa5421c0929feb29829a297252be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 57.3MB
        • SHA256 9674fddf50214e99121041642ce72a9f9272a3a050d153533d0681e519f0902b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 57.3MB
        • SHA256 c66f98e156b9fdfa40f9e6df29bfe52312c9aa537342167db1c0bff15da91721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 57.3MB
        • SHA256 e2e492ce5ebb3ec6f13b8e58e94b09d88690aa27c47df2dd799c48541077d0d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 57.3MB
        • SHA256 31f2a9bab61c862799687c1da67a165a86bda910ffa6ad8a68d5c87c9893d9d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 57.3MB
        • SHA256 bce0ae20da2574d6f5ce6a106dbcc9d76ac87ef8fbd18fb02aee184347734721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 57.3MB
        • SHA256 3f4cbd2346c97f3808f350db4a6f1f24fb2f396e2c4826d1e659270f15a408df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 57.3MB
        • SHA256 259e9bfd6edbf38d786c9ca785c1a115ae9bc6b1337ab62cd1abf429541cd01b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 57.3MB
        • SHA256 d617bcd7509efba8ba48968b6163b79776a60950947e7a50680e8d48cff2913a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 57.3MB
        • SHA256 d46f39cd2fe8589cea80b0d031bcfc9c9f9b72c6bd12f6459df461ff85321041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 57.4MB
        • SHA256 53903b093b9d7a451b6a0fdd81ea8163f8f088778ae8bc4243ae123444acf47f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 57.3MB
        • SHA256 c59a32d4f210a104d2ec01cb10c8faeb08b08956c1c416ae9a227ad3fd093023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 57.3MB
        • SHA256 0129a47a03bd6d06cde5b75bfb3dff30ce49040226496e631113e09504ed26c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4768-25-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4920-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4920-7-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download