Overview

overview

8

Static

static

3

2026-08-06...ed.exe

windows10-2004-x64

8

2026-08-06...ed.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 00:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_602563419ac0f18b44101372ffdfcb34_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 15.2MB
  • Sample260807-a3eqgavapf
  • SHA256 2e380bf6d62ca4c0cad02bc190a7546ccd4f87192395c40ebe9417987f225245
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_602563419ac0f18b44101372ffdfcb34_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_602563419ac0f18b44101372ffdfcb34_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5424
  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_602563419ac0f18b44101372ffdfcb34_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-06_602563419ac0f18b44101372ffdfcb34_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5704

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 30.9MB
        • SHA256 f9c7636b09058e6c3186b92b99ce0f1a9144d5b51acf674a4880a753c2751bbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 31.3MB
        • SHA256 0f468be3600ab8c7f5d131e33d9d81a929bdd029284783af8a48e1a70b52b4fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 31.1MB
        • SHA256 7da6ad4815393af1c20d3c83201028da0608fc61ebf0bf9a9b1ce5c1d7be8094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 30.4MB
        • SHA256 eb15240becd77aaf2d11913985326810da5f72ca8a951647830a94fafb0bb01f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.7MB
        • SHA256 86e5c647ade34a3b42f9bf2e17a2bec8a0284bb590666f149f614fbd03572a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.5MB
        • SHA256 a7276e95742bfea4521a458487ee1c9187345df967305afbfef0f027b4e0d0c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.5MB
        • SHA256 d711a7d2a07f1ba5a77d8283b2107bbc14e8a08a84ca6e134aedd65de70402c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.8MB
        • SHA256 339e768923a772b597550aeedf0fdeda229265bd66ebf93296d35e0ae18510fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.9MB
        • SHA256 1ec15fed8ce1ee7062a47298751962091c004b263603b11cdea40dac7d17c325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.5MB
        • SHA256 006a61191d2b611f44bf90387e7afae08644441a1c90bc11d6349ad44bb2a7a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.5MB
        • SHA256 ad260e32735b9de1e22ab3e820c34eba7e5d6f0d23e9321c8f3c38df2faa276e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.5MB
        • SHA256 6dcfb7c8802eaa84a9d61a7cc94c69d9022798e15d49c6448b444b72b5714152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.1MB
        • SHA256 cc3a7ac51d8da15e6b4addd682923862db8b7a5877c8391b07806eaa6a876ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.9MB
        • SHA256 2ebe8c18fb12890ac5c123f1d0822880706e62b432042cd3b59261509e60aed3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.7MB
        • SHA256 a2d6988a832cae6f121f376bd60830f94b2d326daa6de70f8d5d682b4085cecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.0MB
        • SHA256 6f034db0415fe149b13752ff9a839c365fe9205a60ee20dbe83c54c10552206c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.3MB
        • SHA256 4f12b8927557f1e0a521d953c8759f196ce66abe5212d70137c9ff1b6be01177
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.5MB
        • SHA256 f07f0df09ada061722f870cbc0ec27a9946d44899d6496b789a1f2991d183211
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.8MB
        • SHA256 23d1c6544f936722f0fb114da9e0d7996b8107712d465300dc7d3cf11a91698a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.4MB
        • SHA256 897d426e522dc37d4af1e6c29fb6904efe0f3d780709b79d085b7a511d468200
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.4MB
        • SHA256 d4bcc3bba2b7bd7effcc4d206b33aa1bfc366c8118608324a080373b05e49146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.4MB
        • SHA256 daa722f717ad2eb7d65211e4ae157f29a568e4b7e75f72094fb737366cb48304
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.4MB
        • SHA256 46407bde544972c2df7e9edbf9987354fae31ff2dfd53cd49ab918fa99aeb03f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.4MB
        • SHA256 d1f2c8c413a21e7115212ae99c6b3d02f0dc83e3a0a75b4853eea4efb5dd3831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.4MB
        • SHA256 de4d58ca06a49809b7c279107de474545e37f58d86aada23f765816cca19c107
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.4MB
        • SHA256 10b2abd80c39001105bad7fd4f4147414c4b862e952b9672e5abec4856b391e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.7MB
        • SHA256 9cc21a3679d0f42cd3afecc5f9fc9958479007baa370bb39f14ecb1332a520de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.4MB
        • SHA256 2e76ff30f7bb495709dd3bcd52be871357160094105eb89343825bd0b0609ba0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.4MB
        • SHA256 bdb7233616162c504cb7b5ce1c16b7bc88b2607449b9a82fcaa5cb184a247058
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.6MB
        • SHA256 8b0cfd4cb0f8f6ae50adc15892e4fe3d613bcc344103cc1defa63935c1e37f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.4MB
        • SHA256 d6b65f435d717985f758d174435b845ebb6a300aa03ac03a0b308e3279f60d6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.4MB
        • SHA256 9832ad90792d61bde5da5a60b62fb859741cfb6f0cedc2363532c834f272c09d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.6MB
        • SHA256 494296b4a48b42bbe1a9bdeb199939c5f96af8e787319529fd27d570848dece4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.7MB
        • SHA256 67b09e5511f0343249905589918ac5e8dc95a01d476f9f70beb818081b1069da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.9MB
        • SHA256 18fe744319a28ec2a79ca20f18e709e4c84ed39dfc893bc5d616794c01434eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.4MB
        • SHA256 c99a041efc0abee3876ed9cb16905109e671c5cea92743b6b70b5ab00a9cd52a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.4MB
        • SHA256 ad1034aa7838914cff1619ba54dd9c969ab23511c04b815bbc6e0a1d0d0e9632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.4MB
        • SHA256 22be1f6ee5063381c86ee6950530fa727d78409da2fedb7ea128ec9ea94c06ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.4MB
        • SHA256 3685afb548dd4cd0fc809da2fb0d0dfe3f78fcd0a212e489bd4cfeeba553da58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.4MB
        • SHA256 3079a294aaffede7926099886c6b5cae225a7eca7bc8c089c0e01815bc35b45e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.4MB
        • SHA256 c18f5e320ab08fd13969d88eb6cd5ae357f4ac7629acc14e10bb9e506615f9e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.4MB
        • SHA256 cf15901767a18df9229633f408c5543011501be26ab23f9067c081ee696ffebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.4MB
        • SHA256 5de8c5e255928b15c5f662bc6428a7813a70464e8eff182581b659fce5d369cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.4MB
        • SHA256 b172195ee4aeeeac6964ce801e2bc76dd642cba543088049edc7de4b4e93608b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.4MB
        • SHA256 82e16b58265f034ac11f4fe7c57c72d894efadf99989469c51da8ca57264b071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.4MB
        • SHA256 909e53a8475e414c13ad36910208bb6c91180d272457d905179a83fdd4d852f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.4MB
        • SHA256 a6f85428629dc091b685c08bed5e9ccf3ee81c0538340fabac64c467091fe3c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.4MB
        • SHA256 6a2502ed4d4fe329c452c36cf8e26aa1ec79d7e4566e697b5d586b3c5dd53104
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.4MB
        • SHA256 40ccb75c3233127f6fb151d745c31f69cffdf47bbe80b10dfd3bc77ca46c4e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.4MB
        • SHA256 aa595bae8d8ba586ce818fbb7288c30a9447434639914be7994056f75ea1c095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.4MB
        • SHA256 186ce572beb40321ca99db4fc87a2f1c086a979e79d6ae7fef7f9e9a2570d096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.4MB
        • SHA256 6455d7026f8e941a44521f84743a7c202940ab5320dde922090831552efda38c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.4MB
        • SHA256 1cadfbd23479441aa492661451e7bd76c81f69ae47471cf737de58632a27fbca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.4MB
        • SHA256 09eed8442701580ea42bfbd79fd076757bbe80363be9ba95c65e5efc46e058ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.4MB
        • SHA256 089fa3c97d2771992c024f336127a98883c6aecf45263cf288e6751901928b06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.4MB
        • SHA256 1eb86f10f88b17487d26bcad89c426d3564ff88d540ab4e63533cf9ffb765298
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.4MB
        • SHA256 eac956b4fe67d09366fe500cdce7316f00dbb97c6ce28a3c871e776c1a2d0e08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.4MB
        • SHA256 13d1bff96f04e3b22f5c4f879546dcf6d2e41e52106b7dcace682c65dc67d193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.4MB
        • SHA256 463133c3378d395823f8d46e2e3758a75f622e80eb186ccb83ba1f32b1659934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 30.5MB
        • SHA256 7c8b33a261d823d57e358c8e751e0ab23fdf662ff6835e857a55cf663d569e14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.5MB
        • SHA256 86b0b668da11155805d7a847e48a9daff0a2744f7ebf8d3e8e194589cb9be534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.5MB
        • SHA256 e4bee70e9621b21bf46c521811a6c1d70fb27449c26d5423317d64aca9f77d6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.5MB
        • SHA256 1acf6f218163c7ba64ffe6a0a073b06749a39e112bcbb7724765f9e804200fe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5424-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5424-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5704-23-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download