Overview

overview

8

Static

static

3

2026-07-31...kl.exe

windows10-2004-x64

8

2026-07-31...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/07/2026, 17:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_74f984eca62cb1ce1b6b2766880800ad_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 8.1MB
  • Sample260731-wgnbdaxfld
  • SHA256 3781f2bf7e4c1b67883f28863899e203499380b06719a87fd12a36e9e690d907
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_74f984eca62cb1ce1b6b2766880800ad_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_74f984eca62cb1ce1b6b2766880800ad_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1536
  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_74f984eca62cb1ce1b6b2766880800ad_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-31_74f984eca62cb1ce1b6b2766880800ad_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:988

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.1MB
        • SHA256 36b75dbdae0186ee89eec20036afda141910e30387cea1eb9077bfe6a00fde60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.8MB
        • SHA256 4634895286538d3df6d752d80911470e387afcf5de6bb923bd4f1eb8130be061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.2MB
        • SHA256 e8b2d89121ad9cb9f10ea2b64432550ecea683c4e8ac029801021f29dd5b2000
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.5MB
        • SHA256 27bdbeb8a94f5e2c27936bf2119d8deb45fcd5d3edeb93542e32460e7247528f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.3MB
        • SHA256 db8e1a86c0cacccdf119979e8e3bf13692b14e85ca7c5b8fb2e9a035b3c18418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.3MB
        • SHA256 4dacd07a61eacecfc312fcff858864efb4d476562e7d3568c3649f584390567d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.6MB
        • SHA256 21fbf8eed983bbc2f86bfc0e8cb25eb2ce6bfb4019237857c92577875b5e0577
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.7MB
        • SHA256 3cb85edc2c23754fdbcd4b27fa5486abfd48440db6627a62eee2bee7ed6f6750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.4MB
        • SHA256 8eab86221b398c1f8030c49be332ba3a9d9d48590109fe59a95d9bebf0775bc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.3MB
        • SHA256 447de5260e74e8f5b148ddfbba9a00b25d3a43f4733eaf8d914dd1cb3179d127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.3MB
        • SHA256 c0a5fbc4c2620e771b9a216346d15fba5e4dd89d5e4c1fa6f7cc4e635782434c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 17.9MB
        • SHA256 b6f6ac7779f4636b77210b190e853505310040655d9d4813797fcec969529064
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.7MB
        • SHA256 69d9686dfa9cab4e6fe467afed4077fb366b7a190babe484af4420d9c096d469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.5MB
        • SHA256 a1ecb647be7e1b4671aadbd3be48d6db1c01a9ffb0461a9966b7f3c3889bbc9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.9MB
        • SHA256 49d3e4673babe33728da5af41aed6355e068fe83d836fd2e5f0c729196682e4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.1MB
        • SHA256 c751ea455d6b6b5897c72402476fcae1ea150294fc35d605fa30b6104462b8ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.3MB
        • SHA256 b1b12903bf3a1115517d08db72a79be059477c19b63d083924f4acf64391b753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.6MB
        • SHA256 217d8936eda6f3f09e87130be43c28c9633bffa0c119336e7874fe71c4a82fa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 16.2MB
        • SHA256 8ff811697d3c8666ccdb1a7422da622d51b3f647f8fa342275306da9d9a90cec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.2MB
        • SHA256 fecfa629923601145352ee68177e76418292d2a18ed79226062f586cf1247464
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.2MB
        • SHA256 4e95c1d41d7312aeecb9d8c74082d6ee14194eaf524f9a71d4428fec5c421aec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.3MB
        • SHA256 77a86d372d59c936ab03843b92fd56ffecd88be10328d3b3e570e70846595b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.2MB
        • SHA256 d869ef5546a179d26173cde937816f4c80d9b19319783d997a7ca9f21b5d0ef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.2MB
        • SHA256 128cf9ca02244e0dcc9addd303550b446607fd70ada8a3ce9a655d6ebdd0095a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 16.2MB
        • SHA256 e6d6cc844552652f649c478257daed155d902cc437100df9034f0f068d3c56f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.5MB
        • SHA256 1a9dd2ee000709a24cbac1b9934dbdabc1068ae41bea7a501c19f832b9763c70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.2MB
        • SHA256 8eb2d6ab3f8855ca096aacc621dacb2e3be2df391f7af75d0e55925c35a6a7b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.2MB
        • SHA256 862a6f8991f257952cc21de86ed1ec468d097766443eba3a047c837ae3339b24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.4MB
        • SHA256 a1fa03b180767be5569e4c2e90d3081fb8503a466c27d4618385e49c4159c24d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.2MB
        • SHA256 5caaa0b75ca6fada00e7349bbec7bbf85472718bdce580aa52907f23daf3bae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.2MB
        • SHA256 8e7a5f358f55b89e4a0d5a4dead6c885b8be3ad211cd379066be2488c1ce605b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.4MB
        • SHA256 a1ca508963bc1686a28590d304ecef6b393fe095476dbd19a1f9ee71ba49465c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.5MB
        • SHA256 7f684b675bd0715345e3d0e064db0ea3248433376070333223c8a62441552585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.7MB
        • SHA256 401a23dfd4c671672b956552984bf67c8000af2f9120eaa5ff3dcfae55332eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.2MB
        • SHA256 ace1e341d27c75c295f06f5f84e070c796b7e9186cd33f5e9d06bd1814156378
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.2MB
        • SHA256 e94ab02f5cbd8591e2188e0aaa950c2a60634ad4b7fb307c318321a8eea5a7d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.2MB
        • SHA256 48d446d4338857cd1e36439c8abdf350a480365a1fcbb2af0c99c78b522d37d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.2MB
        • SHA256 67d376c9f3cc2c7bd5f34d8efa48310bf92d587a1f46f758a2daadd6a59b5f09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.2MB
        • SHA256 b59d5ba0c54809c3dc728ec6320b0e053f28106ac5c30647f85808df869eee96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.2MB
        • SHA256 0203a4c17ddee621acf5120b11e7f1ee39995995f497cf2417b3427fe58a0572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.2MB
        • SHA256 851edd3ed03d6bbbdedd52ffdf412670d74053d6db67c11af8f82be2b58945a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.2MB
        • SHA256 79eefd547aadd02b9daa6bdf8e39b40ee98f873a09e9d7b774ac0e3a6a8812bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.2MB
        • SHA256 2c2dcc19fa4f79819c0671a8399fe0b4f7394b80186b56161bcf724c39588847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.2MB
        • SHA256 1a6d3c56b66e3658c8c68e5f8f36ab77d52c849200cc4be794da8d58924d72cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.2MB
        • SHA256 85321f62a1bdac0ec7513def33b746a7d39a4bb0826ddabb1e0a12705e41a3ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.2MB
        • SHA256 1f77b3b5c916c0a117ad2cb719d55fb10974a836b14075900df8c999ee57db95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.2MB
        • SHA256 4f1225c9c374a76553690d07b6e0e11da09968bba09ed57e397470289482f070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.2MB
        • SHA256 19c3db6fc8d258057319e737dbfa3577461f577488101a1ebe4d8d71184c3af8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.2MB
        • SHA256 b0f16edeeccd956872669e1068042603999f40d04c0f4af18650685273a63b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.2MB
        • SHA256 4394dcd20aaa15350969ec104c460896b37c281e730fdf1dbca08b280797a8b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.2MB
        • SHA256 bdeadfad08c7f5520c782253dfc8a9221c856917fa4d55afa124ad81eb00bbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.2MB
        • SHA256 0cc90040b6fbf32f6de2fd52d866b385a33cd1865a07d2840eafd4869da1f614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.2MB
        • SHA256 a753c75afdc8a33330c11cf59721bd6f88248526c4914c740e7523870cfd70c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.2MB
        • SHA256 6f58fe60c67a28b87e3a3bcd69807b461d078c9f1d3ef94f03610ee0083aa86b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.2MB
        • SHA256 39a2a62d85aebf3be721acc7600cd1d22e8269576b8ba7a5d427b33ec8251a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.2MB
        • SHA256 3e99e5e4b22f3ffff6593c84a9da865e26330515a4b15d8d20bee97fb7cb65ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.2MB
        • SHA256 38de1957a9838815a10150859e285364a1919e06d232bf81133aacf21ed0a79a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.2MB
        • SHA256 9b8c5137a424f69cd49ecffa976eea36843c6a71710cf14fb76312da84705270
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.4MB
        • SHA256 462c1d5c4276b47f63e71ffafdb105cf4f7e13a4f6e9719cc0e8be7b655d3b2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.3MB
        • SHA256 4a580db61c229c48808f7d34d89dc39bcaeb5a6611639b1b2b1b89005e2ef1f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 16.3MB
        • SHA256 e1e51fff53bd0d878babe428edc412d79eee7c46f4f5bab344ef4c6030f401ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.3MB
        • SHA256 4271244d251a1b2f3a2f12b61229aacc5243e974b5c5dc7f616949591bb99a30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 8.1MB
        • SHA256 3781f2bf7e4c1b67883f28863899e203499380b06719a87fd12a36e9e690d907
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download