Overview

overview

8

Static

static

3

2026-08-01...ry.exe

windows10-2004-x64

8

2026-08-01...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_942df9e575996e45ae5e74722e56405d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 11.4MB
  • Sample260802-ajbvgazgpg
  • SHA256 8ad7a67858950699ebbfe7c3353e4357dc01e1a5bbcd49637da7565bc077b6b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_942df9e575996e45ae5e74722e56405d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_942df9e575996e45ae5e74722e56405d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3192
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_942df9e575996e45ae5e74722e56405d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_942df9e575996e45ae5e74722e56405d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:336

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.4MB
        • SHA256 bbd7de1372c3abd21638bc6f8b0dd6706ac5b6d7fd757dc5af493c254928b6b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.0MB
        • SHA256 1481ba3bdb1c5ae011d5e57a9029be9c9958d82b9d57c9c02e3bd2af7ec23ef8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 256KB
        • SHA256 a88ab2eab13680012502e10692ec5c6fb70e333b6df630e671ad53aaa93b2f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.8MB
        • SHA256 1b92ae57a0326edcc9526287642250d9c88791d7f57c56b0d0b7cfd94bc4941f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.1MB
        • SHA256 2aaac693d91705901bb338194795c5abe1428f967f525e45411a4d4b802dae7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.2MB
        • SHA256 7e558be2b28919ff12003a28e229b44ea2e943f5fe6a4ec026ff48a71c28e947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.5MB
        • SHA256 025ab75c94cfdaae801bfec876448c28080489c9206e4ef05b1a5065ddc0ede1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.8MB
        • SHA256 c3a1d5756c6c10d226270e2e5b090a26cca4bc1dbacb7e694ed463fa4fef4fae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 28.8MB
        • SHA256 783aabb31c361edbbeb877ee22c856a2b1a9c85d4bf78575bcad70a2555e09bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.5MB
        • SHA256 54668b9d47fd7acc6426a4a182ab0bc4d3b2d15ef6402d809334305fdb199446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.2MB
        • SHA256 3d260c2329652f131687865050ff3eafe3039a2cc890bd152ce34024c5ea67bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.0MB
        • SHA256 849ddf5f25fe2bba540825afe2fb1a9e03437b2486c9253e3230a91d0f5ffba5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.4MB
        • SHA256 f5dccb83e49b8f190b98b77b236c43fb81b7548e824db875fc9b5029173f022f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.6MB
        • SHA256 9fbe8d6536355c5e0baa725250d50fa914d4a111fb287cbf36ad65209c88cca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.8MB
        • SHA256 cf2baa7114ebce5bdc579053c91097ead94094d795795990833bb4739e9dad30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.2MB
        • SHA256 e3684f9c41a3e340e1421d644b4d8201d4c4856ae52ea4cc63c7e03a6052a46e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.8MB
        • SHA256 8ec85f777a7f08fd80420675764876d7cafa44790d3b48a1ea3334a2465f5a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.8MB
        • SHA256 f4c46e5255d881e42470b994b8a92b8d4d7bfed8f844e02162d41050d1b87215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.8MB
        • SHA256 2e7015d7f478586cc6453171615505178bcdaf249716a608c69f6a35b12a751e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.8MB
        • SHA256 cb92c3f03b20a80de8ab50957e8b78c1210eeb764c3e792493f4dcf5be216b31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.8MB
        • SHA256 a4c211ea5fa3536af9d9633a37e1bd59e15f82d6b071975884f5d1cc78598383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.0MB
        • SHA256 75b72104d88c1a4b9e1720abf430663710a0d453d3aee65bbce929791686cd1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.8MB
        • SHA256 444f15a8488fb4a5029c44c210e710e6cdba392890bfa4b73fd000859341a0dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.8MB
        • SHA256 573171a77336be946124749114876648298d4df616971bab368d0687f0a11047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.9MB
        • SHA256 b2130cd7953f51d05be79e496dd35e910adada9ede144bdb5a5d562f9031f7e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.8MB
        • SHA256 89617dad6aa3e0a3c17c18d12563fb180d39e6276210ba496dc100175d77ed95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.8MB
        • SHA256 f96da6f597ff037e8ce65d60bb32c8bb74590227a91721ad3ca9c370f799d66e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.9MB
        • SHA256 587e02cccf5a9b589ebae5ebc984b0a3f4ce510ed676ffbaed7c8a1160fbb5d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.0MB
        • SHA256 fe403ac264084ff3b8a925a01ed589aaa8f226ab8e493993f178d3f6673cbdf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.2MB
        • SHA256 0055ef7f4dce10f82583dfc16c66817493f77d8f7c5a662325b2ebf9b4c0b548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.8MB
        • SHA256 f6f22e6de54051d6143105d66a5965f6ac9283e3d54ac995c41d71023a19746a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.8MB
        • SHA256 4895f57ae777c336b3aa51809865a0b29cd57c1c20529de414f64028b38370da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.8MB
        • SHA256 4833233731c81f21fca3e68a86a18eb3d74155c3fdd7fad93872d53551d27a45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.8MB
        • SHA256 8452bfa2d18f85ea82278fc7419fac2fb6263926adf5f52a66ba020c3ebe0a7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.8MB
        • SHA256 0ebed6596a05ce827f298db7370968cfa95089f3e35224218aefe3a4abc0037e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.8MB
        • SHA256 87333723ff4c427fe1e9de6108f36df9bc08626909d8bafb3ae99b4756bbfd03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.8MB
        • SHA256 18af5dd66b2fb8e9f6c2f06006c4cad098aceb505b08fccb02620cef31577862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.8MB
        • SHA256 540e56461a3bcfffa669244ff4a61adacf8280dc56939d0c4407222e09ccdca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.8MB
        • SHA256 46d00aaaad33df19b884728dd697435acd211ac338de17dc45a7fb051415ab5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.8MB
        • SHA256 77652c69f44db78f624e0d600316b4bdc5d5a9bdde95709dc3ba67cf9ec27dec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.8MB
        • SHA256 150cde720635146a027a4640b03d749bb46bfc176f9f1cf30f358791133b918e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.8MB
        • SHA256 4d2561ce3cd68a3839182127ca74de8f5fe02ced5809f851bec85e89c48627ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.8MB
        • SHA256 212c184268b271424ed22c2b6530e80b4101ae653247afedbe4fb87f66bfa238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.8MB
        • SHA256 4882c465ae5470998ac658b6ddb7adcbeb42feb6ae68a6ef733577ee108f77a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.8MB
        • SHA256 20e270f4a4dfc08b94e53516e62d2955cc3991f1bb08dcdadff65630791b1c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.8MB
        • SHA256 2514163c79361254504becfb9027ec81e5ad01cfd7ac36782a6e878869e0087c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.8MB
        • SHA256 a1406fac067624ea181640648e2b8727075e7b2819b198076453a2a480ebc669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.8MB
        • SHA256 89644deb847308211bb408b08d924f700888a27684664d38ee73cae5a35ae05e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.8MB
        • SHA256 91c346d6b77bad23190fa0c9564efa055afa646ad7834b610c62763f6b397b1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.8MB
        • SHA256 3586666f4728419becc97f57e7598dd79fdb317d2b88dc93798d72726c80055a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.8MB
        • SHA256 8159d0b74cd74ebddd714d5cbb6e28b30b085b6acd8b8c956c5ad5f97caf394a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.8MB
        • SHA256 6d8a50c83350abd8ec4113ec152ccaf117ce7ce2011991d98d99f564c8306c06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.8MB
        • SHA256 06bcb8113e353c82e51c1753a0e7dad6835b57057b475f0bb036e8b7247de71d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.8MB
        • SHA256 1903eaa557f179bcab0640d7234df1fc0446d7a5ded7dafa7285c8e1675e9d68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.8MB
        • SHA256 55acbf033a714e45059c8a47b984f585008b90130ebc690701b6f8cd23dec6e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.8MB
        • SHA256 86db7b893592ade26890804f083053d3d45686f70253588ae37b0dfe9b48a031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.8MB
        • SHA256 73b4860d4413ea2bd47f0e30050b4ec7043d1f5a5218c18dd495b4a88c9aa420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 22.8MB
        • SHA256 db63ef2bbb58c9a5db663f3cf569c6206e5fc918afc851a88dccf6a3f9c93788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.9MB
        • SHA256 8654b9828847f78e75bb4b08f1cc437031c497b671bc52d235fd9aa0498db08e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.8MB
        • SHA256 f408a23516c6b1f7f7210c91fc9f4b85ac25003b3fb6553333184fba8c583a5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.8MB
        • SHA256 e3e99096d07793f081a91cf1995299137537fcc77a4259ae5aa74c6e01bb330b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.8MB
        • SHA256 394c81b9230525eb900b216aa5d0ed0b3c2b3ee2437fb2e43a016cec05e9b1b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/336-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3192-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3192-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download