Overview

overview

8

Static

static

3

2026-08-07...ry.exe

windows10-2004-x64

8

2026-08-07...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 00:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_efa9de96a1e76e4a607e30b9364a1cbe_amadey_elex_emotet_icedid_remcos_vidar_wannacry.exe
  • Size 6.8MB
  • Sample260808-art11sem5v
  • SHA256 c4e8b9560870f0e1b26de76790f7abaed59a4d85102a192f498c27e6360a684e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_efa9de96a1e76e4a607e30b9364a1cbe_amadey_elex_emotet_icedid_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_efa9de96a1e76e4a607e30b9364a1cbe_amadey_elex_emotet_icedid_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3840
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_efa9de96a1e76e4a607e30b9364a1cbe_amadey_elex_emotet_icedid_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_efa9de96a1e76e4a607e30b9364a1cbe_amadey_elex_emotet_icedid_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:52

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.8MB
        • SHA256 debf9701d0460f99cc0c3bd93e5763baa99ba27c65399810bef42ad86bf386e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.5MB
        • SHA256 2a104a6f85f157acd9eaeffae236ef4edcb0de779fd06a8782bf90b9e80f0b80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.7MB
        • SHA256 6ac80711ad859348928ba2ef832ca7dc4d8f0781292e2fa7be136c6e20fd9508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 6.8MB
        • SHA256 c4e8b9560870f0e1b26de76790f7abaed59a4d85102a192f498c27e6360a684e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.7MB
        • SHA256 da6fe0b70721fb459dedbbd6a55338c114ba6ccc0c5a6ed709cb0c4173166fdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.8MB
        • SHA256 7cdcabd39b8fcab008600de5e000b9f911a83b9dad54e2d1a9562837a4a06b87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.0MB
        • SHA256 e5f72e943aa9ff1e563963ba5316ae7f820de845ed3a9a215bd79d77e42da819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 9.0MB
        • SHA256 c5c1bf5a4a7e3b8b29734f0afe9174b6f8e067b581703341325631af1f9e5fcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 13.8MB
        • SHA256 0d12614006e73bea32de46845877dced33025b712f1da8bfcc77cd7cc6e65282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DebugWrite.asp
        • Path C:\Program Files\DebugWrite.asp
        • Size 13.9MB
        • SHA256 3c74e616410ef326b68b47052d30968f40bee4e9431fb968a2eda0017897cdfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.7MB
        • SHA256 d806c7de20b11ddc6da404bd94f71a01ca354248e29d348ac0b386b86d21943e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.4MB
        • SHA256 a8d051f4a1084891ad5ec061f486828380aca005c52f9b08dcc4b39e005d2880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 17.1MB
        • SHA256 7001f2b53804049b0042660db769fec7c0cfce540355f4309b44fa9bb08e9951
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.9MB
        • SHA256 d7ed006c367eca9d40d189f192a6c7f5995ff1414ead9f4ce168e80b6d4f7300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 15.3MB
        • SHA256 7bf82a0b983ea0258c1914804f218bc8365c2446db67adc55d8dabbaacc24b95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 15.5MB
        • SHA256 0607bd0520c738148167d7840dae84041f4a2c88d318907162e729237900f389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.7MB
        • SHA256 35d1ed44906a916880c5523a2243205e34e8887113b1acc7c16837c832a8c227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.1MB
        • SHA256 450e65803df43aa9d46aaba02c19e9bb9ef1d43918bb27670a1b7187cb2ce6fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.7MB
        • SHA256 f9a59fa73b02e253e6fd76aad3788c79c48ad058a8b9edb3fab73c0b714ce08f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.7MB
        • SHA256 b03d3d50ab8a8160e20a50165ca5f1f9217ee222890e939a7cabb49ccc3b4fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.7MB
        • SHA256 96950afb7ff9973d4e9f3b7251f4a51cba73ff7380e1ffc184264056abfdcea6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.7MB
        • SHA256 e8881a4d3d2068efd0f226dbb2d643da98944f4cf1aea6f82e375f579ccf6998
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.7MB
        • SHA256 6933004ffed6941b62334674a2779e409d8b3d9bc6557c09e7fa09f264808d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.7MB
        • SHA256 c8d134281fe5f116d82b5a60005d89c24608e35544b3175c8842bbd1839c697b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.7MB
        • SHA256 8704c85a3f4ceaf7b07badbc588be949847225b515b0656149d9fe886e1557e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.9MB
        • SHA256 aeaa68fd71f355d8f4b0259772a16ac284d8224a65b1cd6017eafa69cf96a17c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 13.7MB
        • SHA256 1f6180a65b3a78b99d963480dcc84df89055411b67a18434c4d48424a6a4de64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 13.7MB
        • SHA256 37fc50dfc74726f46fa9e45708cc6987a06272092f039bae7aacb3f15e0d5925
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 13.8MB
        • SHA256 b83f4bd1b1c85f0f8c2ba75fb319c9e876650029407a8b65ad636bd321d6acf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.7MB
        • SHA256 2e95f692966a932bee8992b9b46465523865b434df34673cee8d686f17d12acb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 13.7MB
        • SHA256 01e27bd773bc268c5254af56268496695d80ff868bb439452c940ddc69007917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 13.8MB
        • SHA256 72ba9e8bb485ad2ce581e1bb7c68b7e65d94638b93be4ec77ab034b21963eb98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.9MB
        • SHA256 088ff9518802ea49b96ff5907c8cae7c5bcfb9d4e46e5f4fa5a52928d3cf710e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 14.1MB
        • SHA256 a2a1f5d064f3aaa1a2be131290353e99a031ec9d777f1800ef7cc01c27042895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 13.7MB
        • SHA256 26adff71b14cc7a1324c97c59443e0cc305e48fa2017fb46706e86921aef110a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 13.7MB
        • SHA256 e4c5339800a2e2f170a11329d19a222f14aec2abe4e37194191e2f9466a57b21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 13.7MB
        • SHA256 f189a764ffbd0c1eff4108bc2ecf3968e9cc6510c4fd56c47f5dad092a0d039a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 13.7MB
        • SHA256 739cf37e237a3a98c639058f8fde612864697236e2c1f497b226f2c62bffbded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.7MB
        • SHA256 47f5b0edb59ef60d0c701898671ade119d1a9375963eaa4e1c49ea28411a66fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.7MB
        • SHA256 667578000b57298510569dd7eb471d014457800bbcdd7364e43e32a290651ae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.7MB
        • SHA256 380e570dad9179a47fb0df9e40fb14e8e3c874f0e5595a4c26da41b531face00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.7MB
        • SHA256 945808bb7653e6f31df205193aa4b0c4cf1a1e2cba12e6b9bc1ff0faa2119eaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 13.7MB
        • SHA256 d0aeb307a8e449e368a3e1b47f3d271aaccb72740d6a918fc73fcd65eeebc01d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 13.7MB
        • SHA256 89533a2259613a2cc9672d79654af5dcc9f199c9a654c688d70dae61aa650d09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 13.7MB
        • SHA256 851a10e4aa1af2a759b7afe6d4126eac0c923b94539b4658803bcd0cd0c08ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.7MB
        • SHA256 82e13cdafe40e247f1d032ccd5f4d9027db7833be804205a86fc490450136cb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.7MB
        • SHA256 ea9bb6557608195db2fdd2361b4e74d8644f0ba6bb4a0d5854a8a3dd340559a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.7MB
        • SHA256 9cf7a620c730f57b9eb9ad2605ace5253522af9794caf15e193fc87ae0950fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.7MB
        • SHA256 370c8e6826b79cdd9ac4cf0dee11d80720ccac508d69eb8b16711dce2c00b2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.7MB
        • SHA256 371ff3b93c7bda2db37ace048326206e52b62ffe9b78be54016120a6476bf7d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.7MB
        • SHA256 8b08222941c6fb2e9f573e008e6a97b3bcfd9caff89a839604add76071b72e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.7MB
        • SHA256 749ee2392224da14b68628381eb20a4662fd3bbe2e668b1fb0c407ed4337c532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 13.7MB
        • SHA256 20beb564788199ae3d59823d1693db2cf3c803e37441af710cf7e9ab9d659968
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.7MB
        • SHA256 90329b617f19aecb15d712e15888ffbcf05d46b00c96c8440be071e1bf17cc13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.7MB
        • SHA256 4753ca0202113cc2e99fa8b316c1c0347ee859d2264e06fa49c68ec9c315dd71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.7MB
        • SHA256 4702b39dfe74b0c25831ca1c2360a08b1186ef441272a4a87a5b5dcf3e52478a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.7MB
        • SHA256 fb37e6c4be6001d0fc63121e229fe726cd0b30c2fc5f70d81f9cf3d1497ba976
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 13.7MB
        • SHA256 fc0f3c0daa4b74240fd6fda01a9a92d6d20f010899a27a92e8d3dd5bdd194f4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 13.8MB
        • SHA256 e501f22046339f190aac50812cc4c95814a4b35c00ec7151d3e8bd3a587e2325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 13.7MB
        • SHA256 67df9cc16844ed3f26c4bc8b139347e504059a4da692bdc18951a203985f3252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.7MB
        • SHA256 95f43c7fd77fbe943e31fbdbd10792e427641bb9e8d525a16f572bffc6308c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.7MB
        • SHA256 6a516eb443c0eef00c45e9649eadc97b7ba9d3512b8602ea5b7e92c8d9d6ea97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download