Overview

overview

8

Static

static

3

2026-08-02...wk.exe

windows10-2004-x64

8

2026-08-02...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 02:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_7ec91e27fcd0acdb49b44bad322ca125_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 35.0MB
  • Sample260802-df242ashjd
  • SHA256 25bee4cb872c093175c3f8525b7443c0844b10f81e72926b016713a2fef4f004
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_7ec91e27fcd0acdb49b44bad322ca125_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_7ec91e27fcd0acdb49b44bad322ca125_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3736
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_7ec91e27fcd0acdb49b44bad322ca125_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_7ec91e27fcd0acdb49b44bad322ca125_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2544

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.3MB
        • SHA256 2d1227705e2d1baca7dc5fed3333ff8264f6d0994a8dd02236618344a6ea22c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 35.0MB
        • SHA256 25bee4cb872c093175c3f8525b7443c0844b10f81e72926b016713a2fef4f004
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 74.1MB
        • SHA256 5ead64f7f787fae43916b2b48def73eaaaf4951592129f9d0fc49dfa6874d3a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 70.4MB
        • SHA256 f2f8e19731f411f22849a2d187a10499507b70865d9d36c55a2f14ccd54e1901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.1MB
        • SHA256 75043d7e230a8926ff0730efe37e73920bb71f022085d9d72fe8e5df8cbcdb5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 70.1MB
        • SHA256 11579a1cabc37949fc6aaed7fe8135d299727423e2c2432d26773ec6b5cf7b6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DebugMount.htm
        • Path C:\Program Files\DebugMount.htm
        • Size 70.4MB
        • SHA256 d32f0ada3cde2552477780b880d59a2ced4af47473a8ef3fdcb389a422a127a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 76.1MB
        • SHA256 83f062aa8bd5b98c05a9f13ab35d77f4d376e9a611c930498b341f5a05260c06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 832KB
        • SHA256 fa8b9cb29a86f59d8f273b148ff27cdaf09d33b15bbfa2790ba1fd0a9b50a372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 73.5MB
        • SHA256 5692258d102c5bf2d54836740ab2d3098816ae2a727fe9c9a607a7a7edac949f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 72.3MB
        • SHA256 56239beff42bc60dd57c2f020d73c360a50f3061070c74cd7a836a3b1afc293e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 71.6MB
        • SHA256 0b3d98e089434ffb80d02122e429b917af2a896ebe3b50de6e0c7f9ed3ecf99d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 70.0MB
        • SHA256 66d1e22950241a84ff55edabeb621932780014cfc565e577b32eb06f3a2d8859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 70.2MB
        • SHA256 2bcb29902ef2d37d69a2d6a3c1e6193c41541e6ae57adae7e969a922121fec65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 70.0MB
        • SHA256 dba6e5084df4e732ac41b55fb528466b9aea70f106ab7f101b7f11762a36cca4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 70.0MB
        • SHA256 8812e54f51caa7135464b591341c8673c3aa585e6bcc72b3348a64431331f019
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 70.2MB
        • SHA256 21d56a486f7f39a8d08aad6ddd276ce2a2288606556ace3acfdb324b1121aba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 70.3MB
        • SHA256 21efde5897aeb2aa26c9b9a5a77962aaabef25dc47173aae11c440f7f0fed38b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 70.5MB
        • SHA256 ff675c3a6e2b2cd0032f80813f1be9bee3f3999c35937d572a3c7bd651bebd91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 70.0MB
        • SHA256 b4db4cf110b72f72cf19e9c63ecf3a13da558c7f56679812e686233265041f88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 70.0MB
        • SHA256 ed7aeaea980a0f4363cb500b48e7bc6da9323a6fc1f13b45f05e206c1a09d49e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 70.0MB
        • SHA256 abcbb30564f2080e282e18b8bcb29b4e5c9323fec24145d5fd176cb53b953f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 70.0MB
        • SHA256 cc056a4660bf5559c7180f83399b39ef5901b618304f004541c9e6958e1ce049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 70.0MB
        • SHA256 4e8ff1dfa812202f50c0e218909aa0e552e3442284c90aaf9fe67a53d66e4c79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 70.0MB
        • SHA256 a690528943b10065950b2d5c3413e104b89a558a6d7624d15a141aeb03505c30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 70.0MB
        • SHA256 db540b6be76958dbda3b9173c422b6f27423907b711282f9eeab05dad4c2c630
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 70.0MB
        • SHA256 0407c85820bc92b03d2a64907719fa0a6e65ee4dcec2744b04b9267385dbf61a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 70.0MB
        • SHA256 f89b3d597ae625fd3d1336786b446334a2c76635c354d83f2c041c27e8b731c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 70.2MB
        • SHA256 fd601e6942c5b78c8dde30444339897d2246b49a32b43d37b7a74a9e7dd068ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 70.1MB
        • SHA256 53b721e8b6d0e8a3e68d43b191b510f220ee01fb254f2a6c74f4d7dd7df7fb62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 70.1MB
        • SHA256 a428da32c01b86ac56b20fa9fc676645c409170bc8efa3a94a2d3fc52fb72790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download