Overview

overview

8

Static

static

3

2026-08-05...ry.exe

windows10-2004-x64

8

2026-08-05...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 17:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_cc3d04b2d32aed6ff4927e7453c0ae01_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar_wannacry.exe
  • Size 5.3MB
  • Sample260805-v187hscg86
  • SHA256 3ebcb8e45c19f0043fa6649f2e0fe2829d286205a6689ece5068f08aff2602f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_cc3d04b2d32aed6ff4927e7453c0ae01_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_cc3d04b2d32aed6ff4927e7453c0ae01_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2196
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_cc3d04b2d32aed6ff4927e7453c0ae01_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-05_cc3d04b2d32aed6ff4927e7453c0ae01_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5004

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.2MB
        • SHA256 b45d15ceed1a1098f736818e02f53fecb63425c884283e0f24f832ad38ee45ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.0MB
        • SHA256 7865fa113f2252a0d62be9dd0fd33c4a3f41e1825081b10e9ebc9e72501281b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.3MB
        • SHA256 d76e18c9b92ab5e2f790cbe0259090067e467f7e4e251d728181bbb32aa416ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.9MB
        • SHA256 3d26e915e0029089ceaace7e3e90de259e520d47ea2e453fc94c20f6d6bfb722
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 10.7MB
        • SHA256 9bb0847eba3fb36c8f1e2e1007d19e9d0fd4539e0a6a602bea1683640fd3a602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 9.4MB
        • SHA256 28ed101f411788f43c6b31f0f3255a0e200309e1851487e4ad697b99d61855b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 11.0MB
        • SHA256 f28a8116196f4063b1694c12abeb70ccafdf0ceaf65191c83c5a56dca248c7e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 34.1MB
        • SHA256 24fc6d1b733549da16f2a008596e414ef49b208ebe20c40ef35fd9243b28c139
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.7MB
        • SHA256 8dcada8a1dcd26716a335542222e8386be5a98aea28d6f1d334610a6055eaa4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 10.7MB
        • SHA256 a78f3ee4b279c5240907d7d6fa97797bc128bcbfeee6dee47860d001f8e00507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 16.7MB
        • SHA256 60457cf3ff33e85bb74ea452c33c97a435bac955c965471e79f80e6c00cee79e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 12.3MB
        • SHA256 3269cbfd07e81d2f3a8b5de1c06859feb9eb4449e44faa5a62a51121e93ff9a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 14.1MB
        • SHA256 39bc1eaad6c9a9923759c95dd645f4fea5fb1b2f0c11bfc9f028dd3c94e0930b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 12.9MB
        • SHA256 46216d5449d6ee7ff67708e7c9018f76870f0f7d651f0a42b315a2312242650c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.2MB
        • SHA256 c5d3e5d8eee194215c432672b80ea23a79032fc9e64e34df1fee573e3d038f1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 12.5MB
        • SHA256 1d88e156a8cd20f136bf6d0bc5da7212f9c821179165a726bcc09a1181d69494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.7MB
        • SHA256 c84cd73b4e7d82f77b8e16f04c60f696fd6357c75325445c735ede81f11e51ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 12.0MB
        • SHA256 5a2afa151ace31770a9e1d1870a5c8b2bb16022633b8bed6939dea4006a65d57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 10.6MB
        • SHA256 341bc8153ce7b3584817e0332897b7f07b68465140fef11e060eb6b760d1f5ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 10.6MB
        • SHA256 e357b79962737748dd65172bdcaf995dff3b2924870f3d666832c545baa40f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 10.6MB
        • SHA256 01273b566b80489612af102511556a37e5b6489d72607c09190d2a9bba09ee94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 10.7MB
        • SHA256 9f6f009259ddc7307de2e6732a98bb5e36430b9cecfd3dba12d70068f54d7f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 10.6MB
        • SHA256 03a6b264ceb0a395015189d93273b7027597dce0c37da77e165cb3dc88f503a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 10.6MB
        • SHA256 364461d048714247737da28ddb99db62b41a64109b7f34095735eed7a23b8b9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 10.6MB
        • SHA256 b85cc78b62becb24ee44bd753d800b6ab6ee608eef13e8f5774f038b3717e9ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 5.3MB
        • SHA256 618c682d5c48e5937c726891964ea121fd83a24715e4c7d4d2790ba7411f1f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 10.8MB
        • SHA256 66b5d7feeb077b94c5a1cb43e0ea46794ed1da6e009ed1882df7985138819967
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 10.6MB
        • SHA256 6e15bf14f5b99bbe6d093df9f3413d9b438a7e47d94eaaf776c0a63814a475b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 10.6MB
        • SHA256 96fd0a84a47005dda6a21f4e6cf28d82d967f88a8e24997f5169dc230c12dbd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 10.8MB
        • SHA256 8c2c2b6687646ff4c0d00cb56274e8941a9ede7501e008c2541abdbf52c3f78c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 11.1MB
        • SHA256 47e4cdebc65d024b5a61a23589bb8d1f9743d94ffb0b6144edc6d129ba7e4568
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 10.6MB
        • SHA256 2cb364dee1c4b9944b77b2a92bc4bdc9800ff55dc530c719e8caedd46e1de06b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 10.6MB
        • SHA256 87a90775834118802cc0980658b599694034055d9277b4dac6612a207c6c0deb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 10.6MB
        • SHA256 5739f193485822f8690f79c2dc8059464eb1bb09128315cc155081d50be21e57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 10.6MB
        • SHA256 ef7b2a5554caba25358d1e1900a4e2f2133cd095c8228838324c7f4c30777866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 10.6MB
        • SHA256 cf77512ca6a7353b868e0cc55318682958c56d44acebed32388f781c5d5fde5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 10.6MB
        • SHA256 d53cef84dd6715650061075e01862d071cf6ac96261896111a65447b899a9f94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 10.6MB
        • SHA256 0e726ec0fb757ef9fb125f2d2abacbbce0c387ef49cf837befea2f6dd4687567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 10.6MB
        • SHA256 5b8d3e0b0936a52cf31792dac7ac581130e46a8ffeefdda53ae0e5f97ae1b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 10.6MB
        • SHA256 d207c103c5ea5b7e330d298c709ccc3667dfe53652001318af6a5b2eaaa493a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 10.6MB
        • SHA256 f43d5161413a92efcddcb2b83b3c00421b2b061a47b94c6c4d0bf76bdaec5f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 10.6MB
        • SHA256 7cd7a81d37eecebdd22b61982318e15456b38491381bde5e6d82023b17d0c855
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 10.6MB
        • SHA256 70ef2903ecc07cb84b4d7516868e3bf730391765fb78cc8d954a9f822a3d0bfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 10.6MB
        • SHA256 0d45ef5e6ee7b2045d8545fcd3b721f00b9a0629b847cb326beefcf1722d6933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 10.6MB
        • SHA256 310ef48278277eedc923fb3222890d79845193ae6d972dc8e8b951d2e7fcaa24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 10.6MB
        • SHA256 65193ade91c7b987996f6ecdbc3af6fcd4b33295b579bfb403ed54fd706b38f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 10.6MB
        • SHA256 7d7d8fd6c78f442f8569ac8a058912925fccda6b4d0bc9227f437f5267db6758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 10.6MB
        • SHA256 6b914dae4c120f24fc64c5d133b24e97e2a3c47b0c0b56aa971d73c39bb1e4fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 10.6MB
        • SHA256 6ce1a582d99725366fb38e31b67ad5689535038c60d7cedbf52afcec47d73ced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 10.6MB
        • SHA256 92ebb84cb992f11ae290c19b80776edd43b2f35cbb96b6afebc11a777c651753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 10.6MB
        • SHA256 2c5eaf3db53f36fe1286585e1523fa3b8d22f334fedab8642855f0e5c347c480
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 10.6MB
        • SHA256 549e0d2b5a13ed6a645e8f848f21c356acff60567d4641ec180a26e4d1a82f40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 10.6MB
        • SHA256 082765d5e17b4921e56976742f1acd10d7b77bf2ac5f683ee827df52a1d808cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 10.6MB
        • SHA256 b2aea166654968f9db89cf5e1b7eccba12d40f54c84888e4be83cbcbc64dee1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 10.6MB
        • SHA256 49f641bc035a40d5fe27d91445935450948eb9aa6ae3e8e3ea30622bcd2e3d68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 10.6MB
        • SHA256 76bb957280330c42e11a730f2fedd3cf0c9ef7f428def1fc25805d4b9a349d00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 10.6MB
        • SHA256 623076c767492c8188e8779fb8cbdd90a5c381c4eeda228bd193e571e1247d66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 10.8MB
        • SHA256 3b47501d19554cf9a37095aebaa1984e5a2ea8984f8a7c6e9ea7ee8f092991c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.7MB
        • SHA256 404fc644593b761a56c42fbcd97e7438efde3558b470800d3a97c81af250d0be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.7MB
        • SHA256 0cb9967daf63abcc5c9b359fe74046ef9b70fcef366d5dd09577a64543226c75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.7MB
        • SHA256 c323e3b572cce474e0cf1c1fbb027ea45b16881e15890b61d8f87b180de79c90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download