Overview

overview

8

Static

static

3

2026-08-01...ry.exe

windows10-2004-x64

8

2026-08-01...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 16:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_a894325a398390da5130f28c4fd35e7d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 12.3MB
  • Sample260801-tlehxssxht
  • SHA256 9e760b8f5a388063c803d945934aebd2ca82b7845ff1bf61fac871a71d2285e4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_a894325a398390da5130f28c4fd35e7d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_a894325a398390da5130f28c4fd35e7d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4960
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_a894325a398390da5130f28c4fd35e7d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_a894325a398390da5130f28c4fd35e7d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1696

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 25.2MB
        • SHA256 4b80ca3dfde02cc718b7fcbc32dbe50ca662dac48043f6b49efcdeda8e14c155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 25.6MB
        • SHA256 fcbc2fe82ca0f0c17dd3c86c11c043c5c8355b3c3526f06913fb1c9f870caec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 24.6MB
        • SHA256 ef04092b8c94fecd31b53098f6b98baa9d076292efe79b653cfe99502ad98a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 24.9MB
        • SHA256 7ba00ae1f22fd58e986a28cd7a68cbd578df4fafb773f3ca793dd558b9edbfc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.7MB
        • SHA256 97758bc34f86e76dd6135ced7a0426ce73922c04e563ac597271aecc7bde70af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 28.7MB
        • SHA256 586d78d3d6347d8060ba8b655ffd6bbcdc80ef3fda99f3634c57a700847be691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.0MB
        • SHA256 662b7127c2aeb7b76354992148070c0ab3ca75cc291d3ff7d7b4d8d13f060573
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 48.1MB
        • SHA256 e78eeefb542a9d92e2ac2f6a8e4b8278afe23bda89c67ade762ec0f0e103c4e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 448KB
        • SHA256 30fda89260062596f8473df15f576de632ea44d623bd575d46ec46d32766b91b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 1.2MB
        • SHA256 a12da995e28fbdcc6d83e66892669b6cf4b2779ef75e5d7dbdc6be6b8e0307ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.7MB
        • SHA256 c07c3cfdcd5eeaa89313549d96ada9436c3f50863fad85197d4aa5e23747801e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.7MB
        • SHA256 f37042d9faa6c276e0d3f7fc7afbb9f10e775fb425939aa9b386a955169da71b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 26.3MB
        • SHA256 9e415da8a21d394616f89c07530e84c8491128d38e04987c4c9a2e36114619b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 28.1MB
        • SHA256 7941062a081c087e3094bcb30acea457f9218642b93e1e06279372694c7a631c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 26.9MB
        • SHA256 79e7c57eaf058a9eab187f906ca95c68ccdd6f8ec73c5268ff1f2dd1b30f8731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.3MB
        • SHA256 9ab99cc1abe59bdafefcc02ae63305800749956c2ec00fa6cc9e4ca713382863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 26.5MB
        • SHA256 aedbafcb37869a682fccc665eccbb0d930fd923a128aab55ecb6970e93bffd76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 27.7MB
        • SHA256 7e4bc1075d8ad55e1ee767c3bfc3fd0d9a3776569e6e8c8f4c5075dcb4502a0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 26.1MB
        • SHA256 01b5cea29b51d3798779bc8bf3fb29a8e0ee6ce25d045a8f9d6eefb78a73c7b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 24.7MB
        • SHA256 f99a97594bceedf4aca258c594962b6686de865fd0dde96e23fbb355f8b177c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 24.7MB
        • SHA256 3348327d9a7d321fc557291c6d1aa9c5051cb1ed43e194995d3710a85d3b9494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.7MB
        • SHA256 f925645e5eeb245657e09aeb90276b0869eda9935c9aeabd65703c2585f538cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.7MB
        • SHA256 6fe6e63c9a17ac5a41be1160e50f0bea5279fa523489fef73f6172c7317f54aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 24.7MB
        • SHA256 420ace7bd458581e998e68731c63f532ff115aeee4cf489feafc971ff97af5a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.7MB
        • SHA256 7c6eb19e6d2c16b470fcaba5d01be8d5ab495698b2615286bcb00fa7e448ae29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.7MB
        • SHA256 0455f446c663a542cd64711636b292a69f717455536c4b275bd58e314dafca31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.9MB
        • SHA256 876d0343af2f3e578e21973b59f3d2daf81febe12758e311d01b36b3b11b2004
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.7MB
        • SHA256 b493e533448e6b996ac85a62dbea0897151f2749e8dc6a7756d0979eb378cd2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.7MB
        • SHA256 0149cd474383b97edd8074bb3d91b46657c5b33a8bac2420aee7ef02ec5a58c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.8MB
        • SHA256 3ff9a75e6cd5ca21823fd7103ef7be3b41a2f02eed4cc1b37387329cc45a9716
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.7MB
        • SHA256 c65d01d00ba72373792f8d12405f9e5c6e3a9b86ddf5d2f5fb642041d630e648
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.8MB
        • SHA256 4daf55d07baebcba50daa1b8d5bcb1389b095c0c6747bffac15e902ae0cfa07b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.1MB
        • SHA256 f5782732f498f87f3fb8a9aaf876eab29048642908d58394ce42fa749c608978
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.7MB
        • SHA256 86c99a4f2e694678d109c7a1016b74532f5c92337ba02ce8390cc6138a5d5805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.7MB
        • SHA256 2e0892f08c78c06cfe878a14e4e938b29510b1badaa93a163c0b0336b724de24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.7MB
        • SHA256 f7c17acf562dfec914e20816a9481bf7b792fa705b72ad9c07101d52f0516ee7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.7MB
        • SHA256 9d72c69833890d6981db4f29fb6eb9bd772b7c2f318333da10e0591465f6419b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.7MB
        • SHA256 417e9cb2c252eaae9a78014ed5a4cde457100b1477c35b3a8a182f5f79827c49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.7MB
        • SHA256 ef0633593059aac55c1080adc6af751ca64854e135b45a251cdb6a9f0021d307
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.7MB
        • SHA256 1532a0fa41b6679693d57c73d0bd89df1acf8e984ed832dbdad7bab62b8a7e20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.7MB
        • SHA256 f7ffb521fb16812567f7bbaebf0db757d1ef6d1f59004cea56ff345a7dd032ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.7MB
        • SHA256 eb0bd780cf1701e571a7dc77d4187740b8083e882375da841e232d67c740a0a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.7MB
        • SHA256 f6b09ea793585ae11cd7fb932974944f178935e4a220f72fd573edfd579fcf6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.7MB
        • SHA256 dc89aafcfd4f799e10d5d29f18902e67656a784d222adfae67ddb1bc9b9d0710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.7MB
        • SHA256 9c1c2d32e22d44f534ba4821f70c8588b12e523fa97e7449ccde4dd5baa9ef71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.7MB
        • SHA256 bf93d804fcdb58945841d1bbf322ac634f400bfaa993c717e7ec22caa01f788b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.7MB
        • SHA256 fe0ec1efb62d24073442b7b95a57daeea36c630571b23d99f2893bdc151e5049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.7MB
        • SHA256 a39cdb2ce0d5244c6aeca35bc4686ba3b6234fe59847ed759f97dfd00e2ce44e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.7MB
        • SHA256 6c5bcbfa1d51cd3eebc225d4492bf437d51a246dbbecfe5df8a0de26f88fefa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.7MB
        • SHA256 523249b4a0fde9be9e643d4ebbbbf2d1c3a7920c33d11dfaf96e4da51a6d88a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.7MB
        • SHA256 cae4240d9075cf331da7ee98107b8a813ab2c234b8e029d0ef9c17cfe0c464be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.7MB
        • SHA256 99f7410602c0e4f850a299d9f73a2204682e22836a0394f303544002ddffc609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.7MB
        • SHA256 0fcca0387412d0d84cd180eacd7e2b4188485def7dec3a403bec1e30a4ad68d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.7MB
        • SHA256 8a9ef882c802475689635ee244bf1e844287dfc8d8a5e3fe062709e3969d255e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.7MB
        • SHA256 c6c51b45a6c1b6e6e7e4b5a201ce49d2e365fe2cc09dcff5e276986aa0f7c1d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.7MB
        • SHA256 6160dd8428452bee078773ef8489b4c263e963c81222e9f63cf7fae19faa9830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 24.8MB
        • SHA256 6c88caf2d38df9ffa46e627d51d59abf746a4d13c6a6fbfd2f38e9f6f03a7cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 24.7MB
        • SHA256 0c58f996ebb392e718989cf47060ba3750d7c0638f037833f61e81dad4483724
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 24.7MB
        • SHA256 824880e2079529ba5fe5cdc58375c8beeeebb19cc0aa95183c5ff106f1b372cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 24.7MB
        • SHA256 b89c2e49b7da26bcee0d10054cd6ccaf6cd3c3f9367e88a988c794db51501519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1696-22-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4960-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4960-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download