Overview

overview

8

Static

static

3

2026-07-31...ar.exe

windows10-2004-x64

8

2026-07-31...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 18:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_64ad2d8962384725bce2fb36b5dfab1d_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 14.9MB
  • Sample260731-wp5wdsdm81
  • SHA256 b66fc42c7f67f63435aae77536bf8d5aceabbdbccb9e49cc0887f593f6240a60
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_64ad2d8962384725bce2fb36b5dfab1d_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_64ad2d8962384725bce2fb36b5dfab1d_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1084
  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_64ad2d8962384725bce2fb36b5dfab1d_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-31_64ad2d8962384725bce2fb36b5dfab1d_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5840

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.2MB
        • SHA256 06c899c22fd8141eff2e3ff4991fe45ead17edd954a0392aecdb4fa1e54a5869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.9MB
        • SHA256 0e79de79d14eba91b5df6244a14881aae8d3578b65cb9a0acf2042f62a48ae2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.0MB
        • SHA256 b40bac6d75ef6b2b4b0b6b9d25b24f9f62f592526283a6f08dea4d197edd99b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.2MB
        • SHA256 7cf4caa09fd070e86d541119054d2e60a72905d714e3a47e4a90fef781d20751
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.0MB
        • SHA256 68b200536a1edcc1db831da8f135ec3a987f97a3933e88a5ecf347e4a211f46e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.9MB
        • SHA256 86df1209ed734bfd33cb31ba3b28bb254ce2b48d851f169b854fd4e9587c7d46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 35.9MB
        • SHA256 59640d20c05c9317130907adfe4ae4176dc5c306dd1b1ee36dd893956e77f954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 31.6MB
        • SHA256 7886b4cba9108970c9ef792bcc0f8d44376ddb22683c22628bf89d28f9f17f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.3MB
        • SHA256 989b0a7d811f8156f2d7eda261285a5c894eba8cadb94204022b6cf61ba33a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.1MB
        • SHA256 902ace9558b56720bb01e498ef5d40679ee576eb836b1eaeaa9fb31135166363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.5MB
        • SHA256 4f89c2a0ae2766b570a70d582560e92e7ae3f63edb032c76be9c1df40dfb4067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.7MB
        • SHA256 03423b1f9742b67b1ed1c19daf1155324f2cd4e554b05f2aa627ea093c07913e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.9MB
        • SHA256 4b0b347328aa9710176c69c4c09cd0079e9ef249c496f348e6c012857e8eca63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.3MB
        • SHA256 8a0121b4cb9e1ab1d5064172925f079c62cac33b65594d1658885d5c80e36b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.9MB
        • SHA256 cfac6587978543e5892b2dfc79307d0c8433b438a9671893b812b8c2c0aabeeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.9MB
        • SHA256 2cbe3161f0bd2a355d9bc5da248f835de06eca70ddf0001c40c37d57f8af4354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.9MB
        • SHA256 2bd9fcc37c5227ec5a41fcec2dd62c19ae8b7a10aeec5779f6c29223fd3460ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.9MB
        • SHA256 6430d61ced18db00b25c0b40f9967d11fb9a56b6862c4b96a84dcdd9541c6802
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.9MB
        • SHA256 38a4fe2c062553e87d58ff1de2e89aaf3149dd281b270eaffec082de583bb979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.9MB
        • SHA256 4048cfafdb3ead961a7d2fd9b4056714cbc6246653f1b68f834a96a5fd8adba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.9MB
        • SHA256 16cd335bb55ba67783c1f59d484c99fb44a439569b15e8369672136c45ae75b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.9MB
        • SHA256 1c06129ae66c075da240ca076253a21979a846bf816ba48316a83b4b44d1c1d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.9MB
        • SHA256 cfc1dd2b740e4b0607858962ec5e4cea3d89475b6fc70b344635193b0cc765af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.0MB
        • SHA256 63b3fa46b6a4b28bb3447d9f0b57c036a9b592e936c8e9b9430e4292fdb72c1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.9MB
        • SHA256 bd43e41a0f0039c678a292d2eb6a73ca15897cac22602ca26726e6ed80d8eb34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 128KB
        • SHA256 43487443e34438846ba103b7924eff4a32e10c362356ffe679e3f7f007a74316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 64KB
        • SHA256 561e710c0f12a9ecf3c544ad6eaf227983f3f3f2dcce0bb2f803afccc641ad14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.1MB
        • SHA256 8ec17bb42ef48732b0ad9bb9a9a467103e3dd91ef8d75f43b9188434599d28c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.3MB
        • SHA256 f2ffeca491f16b3237601e4c60e61bcaa84d027c71bb7966e2f172f535e51f0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.9MB
        • SHA256 fabb522b139cde46c77b26239052defa6fa635d32be4f8ba1cafb77558cc58ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.9MB
        • SHA256 f4f389aa5416978ad298242735c5fb773511b9a4900b694b6201eacd17c10e2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.9MB
        • SHA256 abd2f808265b1016fabbf0d9faf8582e54eb41ebe8f6f52bd4ea4af598cfc993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 576KB
        • SHA256 75c7e791b87adf1ec05a04ce2dc7bb2b4a82a6db882cea23eba5e17e5cda2bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.9MB
        • SHA256 36d1d09b360a275b9838effaa6c852053f9d91f8629d9fe4bcf4b4c74e5faec3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.9MB
        • SHA256 7c49063aebac3169d323dfe881cc99ae4fa5c5f9af95a9f2dfe6c3b07d056c4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.9MB
        • SHA256 92f48b38d1a0298ea5ffa0d2f0132015f33b670d93961d8192a04302cf5e6091
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.9MB
        • SHA256 ee7873efc4d440380da83899aba6124a7d77c349855fe6b7252f953b20d7d6ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.9MB
        • SHA256 f185f254d2733f5ee85bc94dc2f7a550fbd44d568cb7ff1bd9c4d705a8a0b9f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.9MB
        • SHA256 c2bf6480029eac4be116d1933c64a3dcb271d184c770ba0fc7cf2de0dd62d521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.9MB
        • SHA256 b9aa334aa688659f91add775283195f26b4230404916a3720a5042a0fbeb1739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.9MB
        • SHA256 95e55f35c30af2d5e3f4b7d8fb8aec23a1cf1e9ecb4a9b61def22b60b3da960b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.9MB
        • SHA256 d078b691f155a3629aa2c20a00972548ed2dc0dfb2dae784b74ba754ba578729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.9MB
        • SHA256 6b0dda7b9b4f9556c25d4e006199fd0259cfd1847169a055452de0f73d7bba1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.9MB
        • SHA256 6ad206731ce5a19359c95713dee44634c3471a44b5466acd76491f9d1c2af985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.9MB
        • SHA256 66eed9509822df36181ed80643c36065d645dd66fae0d2b7e2d0c166bd93a133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.9MB
        • SHA256 05af877b180d8b2ec1d72ab7befd76608aa654ff5b035ed4a7a895ca53d289c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.9MB
        • SHA256 a8a6941ccb257b18bb0873cd077fa4a6b3f6ec4e482747d9a71ac4aa465c70dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 29.9MB
        • SHA256 730d09cfc7e76775f217d0ea417af15a266300dc76eed606f643144da2bb0783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 29.9MB
        • SHA256 2c033959bf4170f695a7c7142460307bb0c3c3085574c1a44ddb2ea1c4f317e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 30.0MB
        • SHA256 a73aac135b55f3c98c59da6a475c00f35ead6180fce45ffc5595b15f7540f759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 29.9MB
        • SHA256 8bfed4d483db420feecedc513c0c6149c356f42dd9d02b216d34b0c591a8bfec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 29.9MB
        • SHA256 ac426d1e48f099f6d6cfb251ff59a59da30af1a0197b11571c639eb3d1c35632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 29.9MB
        • SHA256 c423901a4bcb97570c6cbad81655a9e587a47084753244841b82115e731c38d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download