Overview

overview

8

Static

static

3

2026-08-01...ry.exe

windows10-2004-x64

8

2026-08-01...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_b1bbad54b2a364d562fbf032e6edc392_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 24.1MB
  • Sample260802-aaevrszdrb
  • SHA256 5af6c69ff7e33246a495ee2fd8650db9be311af6b6c79188206df13177b21f0d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_b1bbad54b2a364d562fbf032e6edc392_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_b1bbad54b2a364d562fbf032e6edc392_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3028
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_b1bbad54b2a364d562fbf032e6edc392_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_b1bbad54b2a364d562fbf032e6edc392_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2576

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 24.6MB
        • SHA256 def48347cc2ad3a6dc58dad08a793106a4bb7abd2eb3b266a29f3fd2c544abc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 49.1MB
        • SHA256 c4722c72f12ed31d03693f8ae8cb5a110a079d954b481d42c6f45d84378a2246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 48.8MB
        • SHA256 e7d3853f2ac8ddae351814b11914148b20a020ea95f56f9fcd066dd877519ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 48.2MB
        • SHA256 d57f4a4bcfb1af3a30a74cac012f7f02bd20ad53ca330ade666b38ef9683be7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 24.3MB
        • SHA256 f88bf2cbea5ccb2e6cc775f2d16fb3ffe5dccf9763fdedb44963f795b50103ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 48.2MB
        • SHA256 436f9b46bc40d091f68ff79c83ce729e074b195443c27b8db0efbfe201943a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 48.5MB
        • SHA256 2b9e416cf046b57d8f90ec23295bb6a43e0e1fd358e8f8a3b662593f185304e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 71.6MB
        • SHA256 2fe06274984f964f77758e6738d197c1d9006123ba664ca2de6fc4c5601b6b15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 48.2MB
        • SHA256 6901949f0fa71dac9f0ef67032fd23f532faaac0076156ce374bcef5d61fbd7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DebugMount.htm
        • Path C:\Program Files\DebugMount.htm
        • Size 48.5MB
        • SHA256 f57ecbc56f61e24b4e6d7fb03699d06c14895ecb1ff4ac8c8bc16d59dd7169f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 54.2MB
        • SHA256 3f83646311ae59dad7c8d7ea32fc318ab71433f1ac2d239220aae85cf3ced8eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 51.6MB
        • SHA256 28216c1e75ba0e6c3891108be1a1fd4fcb068d7338f907346bddd049b92efe5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 50.4MB
        • SHA256 f2da488872090d987f75a3eb81ada9c86f3424108f43546a12a00661a96b56a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 49.8MB
        • SHA256 e27f53aabf641e7716adcdee65f0667a80174e96c1457982f173310309ac6e10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 49.6MB
        • SHA256 a7edc356b961c661412557f490d04955752e8435846dbee60fa8d523773914df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GrantConnect.htm
        • Path C:\Program Files\GrantConnect.htm
        • Size 48.6MB
        • SHA256 f96c580f8bde5e09bfd92807da3d09e1e4a71dfdd4bd6c57ef24ddc903905dc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 48.2MB
        • SHA256 cf8e30373d3e1ca855062ddf4dbf0275b2b798aef0652b9062fd5992f84a8fd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 48.2MB
        • SHA256 358f290998ecd6d0e710493d12890681e53b08c8acc84acc02da057691f8c6d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 48.2MB
        • SHA256 5828ad709477b53ad662bc146eb5562b49cdec76070515ead295b86944d1980b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 48.2MB
        • SHA256 dbf611ccad7032b216af12d3b07f3ce3344601d77117054823b2c58ac4a7f182
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 48.2MB
        • SHA256 beea9972931970791bb5e30722d49db4059500ef0dd275c6678ce805c5ea0e87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 48.4MB
        • SHA256 ce3791bd75635467456da8c856e009a446957e946cc9a65f43f31c461ed4fd7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 48.2MB
        • SHA256 7d4d77ae5337b9131969087f66c05aba863d51012af41dacc1343ba2734ccc85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 48.2MB
        • SHA256 7372d2c89e5608b9e6bcefcf85a411fad9fcd2fead629d71bbcbf2164f84da79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 48.2MB
        • SHA256 c31cbae07b18df99fcfbaa48e8d165c980be97df963ac5323c1b7c5545b791a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 48.2MB
        • SHA256 e5ed1e4c65eb0dfc8d8ca766811b9c3f63060f90f1deedad04baf2f44b53f784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 48.2MB
        • SHA256 f1bc7c44a75e8145fdde1f22f811b3e34bb192679351fd7f9fadd529be546f22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 48.2MB
        • SHA256 27868f7da806846f78ea1b06da01ec68a74d68b89a651d59447f2920a46235df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 48.2MB
        • SHA256 698ac4be3a0706dc19d10ffc73517bf89ea60576b13ce1caa19f7f9b71cd5f80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 48.2MB
        • SHA256 6ae5a5ae128ba52a0ef97ecda959705835be00289de28d05c7b981b469ae9e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 48.2MB
        • SHA256 716829f1403cc767409640f9251c2dc3a5a02ad882d70b54e8a850fadde33d55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 48.2MB
        • SHA256 d670627e6a7b4e20ea806db1b1488a6a471c199b82ed61dcd351790dec2d1633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 48.2MB
        • SHA256 748225a143b2945477f6f46d85139bdeeaa9a4882aa148eb99a0d0cd7ba7983d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 48.3MB
        • SHA256 17db84f15db907ca4a3306fc8c6b926d49856f502eff60a72ce058522b408281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 48.2MB
        • SHA256 d046146c62e8831c2692ade4c2bd6bbf5a2c40c510e4690c5caccf14cb966fbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2576-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3028-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3028-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download