Overview

overview

8

Static

static

3

2026-08-07...ry.exe

windows10-2004-x64

8

2026-08-07...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 00:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_d0493751b6e56d6a01466b0f5a4ea2eb_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 13.7MB
  • Sample260808-azbveawflh
  • SHA256 3fb49d99cc44b122acbf36b95ce3cc8773073458d92b10805b0c451ebfc3cb2f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_d0493751b6e56d6a01466b0f5a4ea2eb_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_d0493751b6e56d6a01466b0f5a4ea2eb_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2320
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_d0493751b6e56d6a01466b0f5a4ea2eb_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_d0493751b6e56d6a01466b0f5a4ea2eb_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.9MB
        • SHA256 faab3cec7a882a0466d4150ee0985fa4679146265d5df2a89f6f5fe1a77966bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 27.4MB
        • SHA256 904b450ca0c50d12834c40a1260a5d0d8c2c2d3a1d5e6e581e351ba3b46d9230
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 31.4MB
        • SHA256 0ba7c3853a47240de432d78a3c7746b73fb340883ad9e4dc1e8e06c5fa74c6de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 27.7MB
        • SHA256 981c59f8b0b34716b2ba6fefc76a0ce6333e43677fd7dbe5ccf51ad194d562cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 37.1MB
        • SHA256 6f170027ae4a39b2da70cbe7d08f9c588a5884e7100a58f8dabddb343eb29180
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.8MB
        • SHA256 c858ff9583e3104e8a0bed6a7ab43dc978cc7ee3425a91555107872a163a7e0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.9MB
        • SHA256 f8d632475441d3219a15c1f4a35428e7a74cde3c4ac171278487f202a4442670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 29.2MB
        • SHA256 264d6180cbe4dea45539bbd01f460ef63eb467df40e0b80ad102f7f4055cda41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.7MB
        • SHA256 dce09babd74e82bb9ec5634f88c31ac3cc0a0c11625d1197baf1805b9d0ef783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.7MB
        • SHA256 8ad406487c9a88f843c035ac03903d27e61fb63ff89adce8688db42a1d30dfe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.4MB
        • SHA256 8dcac61a02a36b2cd435d608796761c2d3322d1eec31cfd88430b003a63f23de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.3MB
        • SHA256 47ac53fd003d0e3ad507adbe726e7c1f35b767eb2030f32578b0ee65b1b174d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 27.3MB
        • SHA256 21d560b8352e6e5217ff8f34baebe56a454ab76a12c61b886f038f6f704c0061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.3MB
        • SHA256 6ec24e4f7690d85cbff3c93aef5b0b7311984c9f1733cf1728c4bdb3a35697fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 896KB
        • SHA256 df736024c74bccf99f7936a1717cfab4b30603a45808e1350f496fde75af355b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.3MB
        • SHA256 c23c7c821a5ab143093fb7655c08ad156d908d079704d8d382d9a675328ceaab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 27.5MB
        • SHA256 0d15f8c7840db42d58455a71be3a2e7851392bcfce14b2e2a88c34a33d307b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.3MB
        • SHA256 a665a050fa845cff8981f27559abc3038665c6e8a50c0cc193d7121ace3811a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.3MB
        • SHA256 f473d27aaf1ae53427d21683cdef838f5626ca466a9aa2cb9ef087a002b6730b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.5MB
        • SHA256 e193d0d77bb7c3ec4dc8483ec0dab492c126983bb24cd2dd39b6cff9ce834d9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.3MB
        • SHA256 da38f0fdfa43d54c3377881cd9593beda301298934e5a3bb28a67b712dbc2d1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.3MB
        • SHA256 07440c56f83bb819e2c01cf0a345a40c0cf8501aa1055c78b833f8e7ed2aec3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.3MB
        • SHA256 e9a803b58e30128b2e6f16ab0f3130977b16e92d55bfd27c724536cf1710b4c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.3MB
        • SHA256 41fe3fc769033258b553e96edffc1572255cefe9b0ab97fae61ce0d372b9b053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.3MB
        • SHA256 1585a24fbd2c22292dee5ee03a5536ef7b5bb79d037e5e06b434767e64f3aeb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.3MB
        • SHA256 0222ba6b44c828f6eeb9eb9cfa2aa33bfd665ceb1b6a756682c265b520f4d7af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.3MB
        • SHA256 bc7926a2c24e3591e322be6587b947ab5b74c031b03a4937b51e6b287b9fff5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.3MB
        • SHA256 03199f83bd8f018861c822836d652cd73cd4a93a064eb7653aa740f49d1a6e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.7MB
        • SHA256 fc43fd881a1d958a78e7eca5a50f28e62897f5d4ec4657193e220cb0b10f76cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.3MB
        • SHA256 9c2228eb7ef53308a46c9e509aae7d2df75487233068f69e4bd6c26549c404df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.3MB
        • SHA256 256de0f70683643f6c0e32f6bfadd71dbd8ab198eb284699d4ea842aafb288d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.3MB
        • SHA256 2fa811a4d86190f62798daa0c50b914df2d5fd616bd70918b3f6eb320f1069ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.3MB
        • SHA256 d758005db79fe2e838ab5ee1889925e65e026bd81acb6f0a9158b41206cd3e55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.3MB
        • SHA256 10c4bbe7e360bf1ee9b044d8ae8af8b0d9cba4373b68145c81a9d6be3634a473
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 64KB
        • SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.3MB
        • SHA256 6b2ea08f00b150d0d784ef3d617ffa2ae4d0f2a9f3c1fe156b0f2334106b79a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.3MB
        • SHA256 46f29421255166f1219e5592f97e801b3bc80e6e5658ea450b4a79e02a98d755
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.3MB
        • SHA256 539f4690f744d13c37b1fa3137dba204303a67a4b43fe2bc97a4ee8b10748694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.3MB
        • SHA256 e8ce7cfd5e578832b0ba3b53befdfdb0cb9e3840a5889376b0782844e5676cd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.3MB
        • SHA256 c96402609c59b90e9c7df5de7f9aa661d0564929d66c6981e4abbb709a33e6e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.3MB
        • SHA256 67e21095a9ef168924d8137947496ea8ba25ebf3b2ae27079eb8c9bad850dfe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.3MB
        • SHA256 675d9f78455e0099a2170c9bdbacd6118597249de9bce889ee5c882c280de0dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 27.3MB
        • SHA256 a4988cf00a4c6dd1022b583de910848a306d01cc1452cdafd664a36b8b167090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 27.5MB
        • SHA256 a9d954679e6283cd72494476102fc43e35547d53249b6441ba9c2b178c4644d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 27.5MB
        • SHA256 35e86ec82aa57c6c5aafd4d46857d32e9fd053afc4bfcbc37c27f0b390b55c10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 27.4MB
        • SHA256 784379235f9a7d1c84e8b664d7a87e546269d45b4606ce31ed6048ff3f129f20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2320-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2320-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4132-19-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download