Overview

overview

8

Static

static

3

2026-08-07...ry.exe

windows10-2004-x64

8

2026-08-07...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 00:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_ec53d3d8f5c773d289e2405131948dc6_amadey_elex_emotet_icedid_remcos_vidar_wannacry.exe
  • Size 6.2MB
  • Sample260808-ar928sem6y
  • SHA256 f95e00d1e5226e1fdf4af35c8dbc281a99b29f094230f522db0136d2ba96ddae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_ec53d3d8f5c773d289e2405131948dc6_amadey_elex_emotet_icedid_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_ec53d3d8f5c773d289e2405131948dc6_amadey_elex_emotet_icedid_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2032
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_ec53d3d8f5c773d289e2405131948dc6_amadey_elex_emotet_icedid_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_ec53d3d8f5c773d289e2405131948dc6_amadey_elex_emotet_icedid_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4228

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 6.4MB
        • SHA256 259911ea5e6853767d8f7a8909a3943b94522bab0c6f87a328c6ea8130024cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 12.4MB
        • SHA256 342fc3cb96d7802048851bac20d1c9be6c182d530855ee557beda1e722825c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.4MB
        • SHA256 f39a5fd14c7463a8b480b747d16d7081c821a654370c36c9012ef29f6ebcfdd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.7MB
        • SHA256 2a4bc0ecffd9e3cd323ac95cadd7a757beacb705465ac2ffe45390489806d0da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.3MB
        • SHA256 db28ee5efe8ad95fa5223f8988ee817e14c764f9e9f041517627eb1714455e83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 6.3MB
        • SHA256 c82c3d5c886310f49d6289a6fb003c50de5e8234b1ded185a629a36ba8b1f02a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 18.4MB
        • SHA256 d156b712840d95824e13a80474ac414035c73d706bdf8ecb557a9a9cb416b326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.1MB
        • SHA256 5efa7ae8281a2e7c25cd3ea115289d2531370252761b5d391c9ba838dcf83b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.8MB
        • SHA256 df12d32ba91c8075658f70368e05e24bd996b7e504f4e760b18d835023c6b227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.6MB
        • SHA256 d6b5c5b6ddabab440db680a149957d3327268ba1732730e2c5bab55b59511620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.0MB
        • SHA256 85ffc4915ea2d0648f168ede2771cef4ce586c073208dd3646613aa379a05f56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 64KB
        • SHA256 561e710c0f12a9ecf3c544ad6eaf227983f3f3f2dcce0bb2f803afccc641ad14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.4MB
        • SHA256 c05bc133b48e5f148b872ea0b0d618fb12e5fa24d402e79a23520dbc673bda75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.8MB
        • SHA256 5dff4b9c5392bde483d14006107e359c47b4d8d0009596777494640e4d4e88e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.4MB
        • SHA256 57ae336d1fe7b7bc9ed3d1fb1c62e12b3ebca7eb92869dec834258b0c3739cd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.4MB
        • SHA256 234232af613321a174a81fad30305169c20ef5f69b56b82c0c388bf2e7c4dd36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.4MB
        • SHA256 97d4545c16adcd3f2baf058998696e0f3d87ff4c142c4f663ed87575539a6223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.4MB
        • SHA256 4e0d813bcf4058843b2d58d732952978ad5ba12bdb74675d350bf00f92dfcf3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.4MB
        • SHA256 83bbc59ab05ff23592cba6f03319aeaba6ca75cc34c8aec14fc79452e0031d2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.4MB
        • SHA256 70cacfd0549a16b5c2bb88041a6206cd481a3a2b97c41ce4aae6670eed2c9529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.6MB
        • SHA256 d90c4338846a0a128d86cb9259fd605ea90cfc74c24f3391df86f3b28652ccbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.4MB
        • SHA256 a84a05e65c29cb3b728b7a16245a7b62ecdab595197b19ec46608b8899741714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.4MB
        • SHA256 985fec7acccb952182ab4da13408ee0b025ebe8d3d5b36326ef7e6e3eaa25a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.5MB
        • SHA256 889674007e08bf6fba7f8fd72404e08d3d04d0a6a03e7af285d0a80d1e1b0f39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.4MB
        • SHA256 916cf14e785f056eb3a0ff7bba2170b190968e883e7655495044d3c99244dfed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.4MB
        • SHA256 f47d4eaa0450988fd83e8322d18ca0c966c4fb9994dc6dd725bd07c2da5c4921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.5MB
        • SHA256 33ac8fa2664121f38db5ab8d71880309818e812b09c85e163ef40d5cf527e378
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.6MB
        • SHA256 80c9b02a0b9f15e9a70b943abca167aa1cef28e809648885e21d453955e2d909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.8MB
        • SHA256 739ec7524c380285e9cd54ecaeeb4ec847466eb919d9ea5ca5f6d8f9cd5dd3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.4MB
        • SHA256 4f739e46c113315c6a0bd4e388938c521150ce5c0a61f97f1f1fb8743d311615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.4MB
        • SHA256 68666485f8acccbc2503781e27fd5b2593fc4bdef8b4446d75bf30d86f6eef69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.4MB
        • SHA256 3e27d171d4c634615f66c6edfbe37980f37e7106db1bbbf766c8395323c36f4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.4MB
        • SHA256 315b51f7577d536ad8c28e4b197bb0342bffa6ea02435ce860ec4e49f05d8d86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.4MB
        • SHA256 6aefdd28f5d80003db5eb10decd04291d9d43617d98f8cf808632ef8e201c759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.4MB
        • SHA256 77db970d4a44a7d8f6fc0f491d4647fe75747ee38a67f4b71d39bf57b4308d04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.4MB
        • SHA256 116430f27287d9204818cc398ee6c51641e7d31a9bb2437f54c278c87cdafffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.4MB
        • SHA256 c8411bed690286ae62e0ca5857ca39c5b5445be74c261a10622a4640cb83d6c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.4MB
        • SHA256 b9abe5ec3a7e31e1c584a913b8d7736e9269e086c05f5c73868189418284f2f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.4MB
        • SHA256 65a76d8ad78ae15ff8c2e561acd271bf6a17a8be1f6bae91eb28225938eafd7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.4MB
        • SHA256 842829b05462a3381484498edee6e5015ec8af7e10cf265ff44fbd3ecc99b3dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.4MB
        • SHA256 36a32616b20fe87a5356955a0b0c530d395d6bb95aa4a788fe2288bf952ae476
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.4MB
        • SHA256 f1f969e452990ef7a6bc82f489c5e84eeaa0848b22cc3e93acf3e94dc0622cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.4MB
        • SHA256 0f695527e7fa8293f1056db7fc8ab19cd6bc980c40626c4687552a3692b6f1a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.4MB
        • SHA256 33facaebf0141aa7624760f235b2395887d1e0d68d47d9c2373e9d34fac09ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.4MB
        • SHA256 7a71eb1b0635a0753d3bc8b0f49af59d025439e3999747abf6336fc7c3cab689
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.4MB
        • SHA256 ebf6a6e90f7bd3c195a87a90928d508842e74bfdd4f1fc1fde68969c072665b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.4MB
        • SHA256 b53b514de9f9ba16483eb09fb0c11cddc1ad7935d826350dc0f777b116dcb6d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.4MB
        • SHA256 23587eb6505707bbd1d5b7e468cf9f8124548d1ef88a3d97890dbc903165fdda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.4MB
        • SHA256 48b2d1e2011a9dabae79cf696236b859105886bf93f430b3cc7da05f2ae8b9ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.4MB
        • SHA256 ea1a9118656b5fab4f11e7cc71f06bb7ba28dc5ca32f745794ab412be0978617
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.4MB
        • SHA256 9953fdbcecd3bbb95783e3ac293992dda9441fef988ed3b8a928f270e843fb10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.4MB
        • SHA256 8f23ed49081820542abefc3751c77b7a095ca33d0ed9736677b5aa0cb39a1d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.4MB
        • SHA256 d5a159db873e3d79c844358f229d0e08dbaeb85a1e7e6204d71fc165a0cf8def
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.4MB
        • SHA256 09ea67cdbb3c5f7942be07b2c1c3607af9e50edb2c4a9fa2f39d96502bd9b824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.4MB
        • SHA256 26751605c24abe1c9c157bdf536e1e26616356f7dbecf6e6ba7987e435bdeaf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.4MB
        • SHA256 e798e2e9ac78ead9ed1116ed10059f012ae0c881c04f5244e156793ab2bda519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 12.4MB
        • SHA256 cb2dfd7bd5c61796a179c71c22c878d395102ddd02de4c7817cb9f6f1040ea71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 12.4MB
        • SHA256 158fd4855f58c6ac8c033428e0d732d63c2a0346718a1e88ea12f507482f4181
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 12.5MB
        • SHA256 682207fca7c1597fd6c50903b81a5d09959bdbe11708b90772a9785e4bb628c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.5MB
        • SHA256 082955dc745db54524a5d963a223db05c1a81c1b7d01d8a43eace6ad4e458359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.4MB
        • SHA256 38280bef117b68372f0f5cad32c60e9aa1f570391eb68ee542b1c30e289df457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.4MB
        • SHA256 76036d04b2f8d6c2c82692e0f78723a57c5566d7f68493db6010aaf56afa36f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.4MB
        • SHA256 6a03b814f22bc8eb7c15fe16d1c1974a6182f60c65c9f3bc74e10679e959a71f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download