Overview

overview

8

Static

static

3

2026-08-05...d_.exe

windows10-2004-x64

8

2026-08-05...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_7d39775ea5dfc02d1362d0f6f33bdebb_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 13.5MB
  • Sample260805-wswrwsshla
  • SHA256 2983b1b1a8f100466591336fa50d0a02909fb0fe429f14951d8cbc4e865a990c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_7d39775ea5dfc02d1362d0f6f33bdebb_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_7d39775ea5dfc02d1362d0f6f33bdebb_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4480
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_7d39775ea5dfc02d1362d0f6f33bdebb_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-05_7d39775ea5dfc02d1362d0f6f33bdebb_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1112

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.5MB
        • SHA256 9ced50ec15acb8a3ced639a9cab953787564606acc170fbf84b27dc4f6e64c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 27.3MB
        • SHA256 1dbfce6397a338d99a8317a9b03d9dd358b6bf9dea7c09be43d21ed6261fb824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.5MB
        • SHA256 2983b1b1a8f100466591336fa50d0a02909fb0fe429f14951d8cbc4e865a990c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.6MB
        • SHA256 7423e16bf2042f303418a63e3f7721daca4292dc7405495b163521e7fd8a048e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 13.9MB
        • SHA256 ab9115c3613eeeb3822dc877332e4c32abab8b432391003d74af4ce85096e32a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.5MB
        • SHA256 1c49b6305397d064f6d6ecf5f34aeabc9de6faf4cfeee75177a9bd2d5f01c854
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.6MB
        • SHA256 bcd3f554593eb9724a3b64f9aa81019e4295b1611633c01d760095432cd9a46f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 27.1MB
        • SHA256 bf2865a019c8687f58b7e4ed509d37a98b277fb81df6a6fa7ae40013845b0620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 33.1MB
        • SHA256 b98149ae8a765fe2e54a5bc28f4d705f60596558de101708d28c5fd648cec912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 28.8MB
        • SHA256 cefda73c0c4d4b19938d574ca2c1f1e68ef96902068ea856b7ad9e32f79a4800
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 30.5MB
        • SHA256 9b6d4f67668abefac26e4061f6fe6844571be05af148ebde74fe5aac65e07ad0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 29.3MB
        • SHA256 f478a4e0e882c05f2db12065cf5d6cedf3fa608d1ac83cad0cef68acbdb84753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.7MB
        • SHA256 46f1025bd2d34adc1068cdfe0b318d405480e92bdeb88df8a8a532ba03a0c840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.9MB
        • SHA256 801e78b30e4036284331c4d8f191ab655760be7908b1fecff069d30f47cff58b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 30.1MB
        • SHA256 d41a82bb28dc014d60a6dae87c661f6647153767ae7be8a1a205fda656091cc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 27.1MB
        • SHA256 a3e789fc3e86427da12428b25c5846da2b6a05cd94d1e4bf16d7165a507b5a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 27.1MB
        • SHA256 6cdeb7bd4c79c2e835f158df6776958405c362647b3e4ce2be192f15d35672d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 27.1MB
        • SHA256 0a2d917320182b4c21106f356f82af7285eb4abd7a121e3f6793ef6351155e75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.1MB
        • SHA256 c1a60e018a81cb317b4e35e3288a384cd70b124a5499fd3ebab2d4db4d8a2289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.1MB
        • SHA256 220b02182bd5d1bc65478c6dc74d095c208f2a64b5b1647b67e1f051f3ec7e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 27.1MB
        • SHA256 d666ae72e8cc1d1ac4488c441602de346592e37520215cbc316093e1bf399d3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.8MB
        • SHA256 5621cf9f267a23b6c4911a72a35a823b8d30f91194d19857362d54073528782b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.1MB
        • SHA256 fd187673af3b87351ec1afe20174894b19f73fc3dab90598a8d252c18f75eeee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.1MB
        • SHA256 9cc1e882b4b79868b380d01f9396e5033f66ab8bcab0b2feee0b2c464521b236
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.1MB
        • SHA256 66b236cf38f65d90414ac34ceadfeea2d29f01690097d5eec67b63b843d812b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.2MB
        • SHA256 0a301ecc3af09e4e05940342c8d85b50612f98ae05a53729408ac476a09dd4d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.5MB
        • SHA256 6a83b7e7e61b02b83109bcd5c9f69ee88a3c8c54ef470ec99b95cf1eed85d950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.1MB
        • SHA256 645b90e49f544a1c37411b8b9dbe863bbcb99aa100e9e9a44f8f6378f52fa962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.1MB
        • SHA256 ca5edb815d779ec72fd1a0e71d94783b41eb65e6fe618c3bf22307518a5fbe72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.1MB
        • SHA256 ad13668ea471d0cb4b1a03589a8f701d17110f3905abfc466e8c73af8270970b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.1MB
        • SHA256 b9680c652b871603f4d766bf22c366d096a9e62eb1b4f5a900c78be34907ec70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.1MB
        • SHA256 e2857dfb7cf8a425665f08f4b95f36ec1ca23abcbd9b51422453d901dcafc1a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.1MB
        • SHA256 6519968996d47fbcdbe99d240402289927896fbc3b0adfba2e0d197cc5c43757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.1MB
        • SHA256 eadebba3ef6080df64b29ea48f96824ba53609525bb4d9ac70b4acd6ab01a91b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.1MB
        • SHA256 dd9810326183a2a3399d2d86ffb6ddf2c2ca06ec7dea628c2aff8ef455d8cefb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.1MB
        • SHA256 6f007511d047dac2b2ff139c048df646f39256444e5635dc071fd4ac5ac038d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.1MB
        • SHA256 0231629490d47009188fa4880420524dd6a63d6e9262f1a25434274605229cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.1MB
        • SHA256 f4d74c283c85c447664894cf89d9d8b735237a8c7035e038022a2ee5295cca5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.1MB
        • SHA256 5b128a8d107376d903175ad8a97762e63302567c0c8077caea444c6b2de26794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.1MB
        • SHA256 d644415af8084e6f9ec34be27d133d24a8458b53c1884623ad70eba28703c8b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.1MB
        • SHA256 be827b7dba2aa8e3cf7b125356bc86d7863f6cfa2433bf80560b1b102a29833b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.1MB
        • SHA256 f6b58fdbafb3c410e5e0ca2b364ae3641ab63d00be1fc2a139bafc78945a64e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.1MB
        • SHA256 e10ebd39fa0cda3bb37642d426f025ad700265e55fc751459fe55e5ef4a61a48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.1MB
        • SHA256 11d7411fc2c1400c9d0fe2650d5a33dd01de1f0b06719b2590a0cad290f81c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.1MB
        • SHA256 015b1223b2cac42b1228c27fc0d67beee3299e40961d871a4fce04928fba8564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.1MB
        • SHA256 a53b1887093487d73f11e3fa0e195f89caf0374ea1402b56f08e23e5f50fc507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.1MB
        • SHA256 2499e8ba016363fa814cb2213c1c4e3ce482f45da8ffcc2fcdb3e3b9d8abc4e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.1MB
        • SHA256 9c4c08a888bdd34232181d85de50ffe0f462f429d4454dfcf7043bd0d7cea370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.1MB
        • SHA256 c037c708530ab0e00d01efdd1f1fa6c7e81026c5e464bdab9be685f1e3c4e627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.1MB
        • SHA256 4783b801c0ae94d937bd2c33fca63d958b8e19ddabdc2c693badbce8be0b8eee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.1MB
        • SHA256 01436568f3aa461f1f48eae4ecb74736a09e969bc3c8ba3e891e3740398983c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.1MB
        • SHA256 5f84ccb730b69cb536b117a4af453bd4c9f71e9efd52ca26f99a1428d00ced8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.1MB
        • SHA256 8121f6d224b45100e9458ecf66c2d49db8f7d60bb035ad0cfadc6a2d970056b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.1MB
        • SHA256 d87c0b71456fe39a35cbe4ea5b59fa14381f67db9e3d41525e30c57ce9e25052
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 27.2MB
        • SHA256 6ec328695d4640223ebfa23b31644574e6269bae46f01a68fff392b67269655f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 27.1MB
        • SHA256 bfeaeb0050f14d8a0ec0e2a4d7761d06a8080e5bb1c8cded5468a7aca0ffcb62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 27.1MB
        • SHA256 63d3082a6e24656a30d4efabfea043ad61cf2811498469c7279b5f0e9a5c8ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 27.1MB
        • SHA256 2ddc6a51a540d5a72fc9182fa4ad839596dd36bf80a01e8ac3e64a7f19f5c632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download