Overview

overview

8

Static

static

3

2026-08-07...ry.exe

windows10-2004-x64

8

2026-08-07...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 01:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_2e3bd78480e93b77e53695381eff0917_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar_wannacry.exe
  • Size 6.3MB
  • Sample260808-b2qa9afn2z
  • SHA256 3348c1b476323b19e0191bf4a4e17e352d95f512b4a752fcfea5c93724fd790c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_2e3bd78480e93b77e53695381eff0917_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_2e3bd78480e93b77e53695381eff0917_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6128
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_2e3bd78480e93b77e53695381eff0917_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_2e3bd78480e93b77e53695381eff0917_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4976

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.8MB
        • SHA256 cbb7cd7d85cfb91719f88c953f932f682a374562c1948aed9bad80e84ecdd878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.2MB
        • SHA256 ae01f20a4aa27e05e055b1c9c2d446c48917244e4d230e5049fc9af08a0e7c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.0MB
        • SHA256 d5092230523b35df475d48291172844832ec4a1ec1595c23eb57bac9af98b72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.3MB
        • SHA256 7785853b2da5f1d7d49ab7fb152a386c86622cf55f2c61182ff7e9b8606cdb56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 6.3MB
        • SHA256 b911833c320f0b18c292b28e2df4a615a0ba86c38d9cb1f24ed1e64c53cf5cee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.6MB
        • SHA256 db9024a933a3c5e2aaa2a084f71ec9dbb464deb6d8fa56e526941266db85b45e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.6MB
        • SHA256 b0468413423b3b4bb8945f3de4abfd4863d8f5aa43266fbde60fcba112d0f6fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.6MB
        • SHA256 cb6d482a006be721eee30e68a2da23418e5e1753fef2aec96e878a0cddf71921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.6MB
        • SHA256 ff2c336647f333e164f04619fedf3e2a1f1e83952105caab7171340ab897f7fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.6MB
        • SHA256 81031c8f67229e6a49adc327b6d4a7e396df3a4211fc00d174d68c61943864df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.6MB
        • SHA256 2319f086a9c3e294fd03f9d006d95dbbad982dfb520411a9439d15459824ee14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.6MB
        • SHA256 f2cd543b5c2941930e630c20e7dd36c9d52017b4015544380eb6325e665d4150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.6MB
        • SHA256 b1e181a62da6067f8efe98250db0755d028937725e280cceb7b9033ee1e295f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.6MB
        • SHA256 cb2cab3b800675a718da89182b42cad51d667c8cc1d32bcb083a7bef2cdc0735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.6MB
        • SHA256 0ac3e5c76de372bbc9b6c22a4683fae5c6e96b4369781c21824ce9310682088e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.6MB
        • SHA256 913f7ace077497ba045531ba92a5f826fd5d625737908362ca7e9a3d6c726b47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.6MB
        • SHA256 79a1de2d0ae8377ae50f68f419a6cec2ef6d6bc0243961c3e32a1c21ea28e759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.6MB
        • SHA256 98754621a341120fe21428d4776381c4f5e7b4b0f1d9ea0ca1212b4e1832f5a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 6.3MB
        • SHA256 09cd7763288828c06586ccb3f00a5542c439f79ec1fcce31c2f71b61735f9f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.6MB
        • SHA256 6d48fefae20df0b583973a8456e5b8aa6cd6b301168971c3c5784c549e19f768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.6MB
        • SHA256 747f2c59960f23aaa4d22fc382419885675c36ec042ef7985fef32fb0ffe1913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 12.6MB
        • SHA256 e11eb057e606387bd5f65fb897c261a4c867ef2e39f249413d2c2e8e4675dc04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 12.6MB
        • SHA256 f165eab7b792d5fc7cd096b1bcf8e470058730c48b45be6126c1bf585dac0823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 12.8MB
        • SHA256 5df77cde805c6ef4e1597bfd836abacb20a62b93f28114ce795cdc6d5e204c9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 12.6MB
        • SHA256 861947373263b3dacfa4196e9a90d869a56ee2a9ae31ece762d4eab7dd6521b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 12.6MB
        • SHA256 cf9b67ccf30a630176eabb13694144785fa209717546e74743956f3682fad211
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 12.6MB
        • SHA256 3fed80820974c6af940193f9302d304f089f88ca55a6612074e2d807e5aed444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 12.6MB
        • SHA256 147fc4327935c1191d68978a66cd003ef2ca869c4833e1da4e7a4fe0013d80d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 12.6MB
        • SHA256 800f92750bcad19950200743f629ac38e7c7c03c57eee02e902c1843d13205cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 12.9MB
        • SHA256 fd9e1f0c897cd7292a24de0dadd334a8a88181c9e18148cc6e64230e5eeebf56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 6.4MB
        • SHA256 934675d100b67a62a00a803bdc4a181b16148d66ccab06ac992aafc65200ea6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 12.9MB
        • SHA256 74eabf64b727f7b84d0c1c1315b0b4b82d74056eef7cd703483a53a1782a15b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 13.0MB
        • SHA256 cb6368d02c33cd5dd27145d264312eeeb6276efb1f26ab311d4d167927868bcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 12.6MB
        • SHA256 d485601b80f3c3ce27ddba301c2d676d638ddb99ab3517f67d924fc234cac5ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 6.4MB
        • SHA256 9296606281cbbaf28d5c5867170224f3b9745ef0a0c99d85243206bd7d141fd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 12.6MB
        • SHA256 427ac506f50d6d9237b700614853df406b19656341b8734b623e0b8696eccd69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 12.6MB
        • SHA256 a92bf7432bede7caf8a9a50fdcc23e67b92f42978d9ea898ed8fc5b793e1e554
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 12.6MB
        • SHA256 a5643b5f93a314c276c820f926653d95b246a16c4db03d0c79ef213bf379ea81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 12.6MB
        • SHA256 81cb20dbec38575b004116c7549b29c183e7b930a4c40629116c068905371805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 12.6MB
        • SHA256 c765455de12810d94d1bb8a3b68500609c5fb780a7b65029669e30e0852ce38b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 12.6MB
        • SHA256 dffa3e2b429c3606456c7b02518a70a05a9c977f1b1253ca042d0597ce7f9f54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 12.6MB
        • SHA256 3929c3bf85b92478d41dfe45ce15427666e2225310673f63e954bc153c6071bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 12.6MB
        • SHA256 607d492dd9e7798e8aac017a9775bb51a885b2f2b3911f445e29858e8cd7f014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 12.6MB
        • SHA256 cc989eeba981a45f936e30bd852f65b01d45e52530810facac6f84a54a11db81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 6.3MB
        • SHA256 01a614bcf9aeee7aaf6d8e84526da65c25eb3d4d770b1e83914449f20b3af564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 12.7MB
        • SHA256 a8d2342aaa383397cdf092cb5472b1a5ecaace018f7b576f779a3fe9308ada4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 12.6MB
        • SHA256 0da744d6748189b9f8cc8dfc68aeb57a27bd9e949dd421624b7c68c276da6337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 12.8MB
        • SHA256 4b4d6badd46c8ee5852f7612bac281f929b8d25f14ca100b33be6d0846ed890f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 12.6MB
        • SHA256 6a4d109aa8e92b17ffaf2ff3bd6357b17b864977d156bd3da4ecb46bae66f1ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 12.6MB
        • SHA256 0e9af9a6892515c370a46daa028f4c615dce5d2db47232e72dcf464932303088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 12.6MB
        • SHA256 406c48c7e4049549a415901b95c9b248e4aa999bab09e893900c013ba5d87eae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 12.9MB
        • SHA256 179d6248c9e42461d799e01fd8e3a82d8e13b747aed810a3b86375e8af77cad3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 6.4MB
        • SHA256 c3f50500308662fd17360669df5ab94e4c34b2f14a3b36e938fbee1958861511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 12.9MB
        • SHA256 a3b451369b27b15c3f36560fdcbba4a70bc0c583ad232835b021afb48757d1e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 13.0MB
        • SHA256 19516128b2c253de03ce069d1bf5054ee21c6cb8130e4d99d534efe6af8f6298
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 12.6MB
        • SHA256 5c4bda6683323494cb90d9858a0c90fb803fd995caaa63252d23085897842186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 12.7MB
        • SHA256 2b56b926999d13aff2632c1d261b373bdc43efd51cee0c8774f214826f241408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 12.6MB
        • SHA256 e07950b574af8a3e8a38007499481d5fefb3a5340f6c8abfa888de0e3d1d5d97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 12.6MB
        • SHA256 ce5c420c107435006fbedb2ee1d72e561056f620714485e3f1182ee8aca204b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 12.6MB
        • SHA256 43d3b0c9279db3fab4bd019968aba6c418648fb0e9448b0f6bf18853de654d65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 12.6MB
        • SHA256 f3c61b435d580b7a84c6b971cf99021f23d39790c8669141e23682a7c987baa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 12.6MB
        • SHA256 bf31fefea45a7e40383d05843eb5690ddfae944bbb31379f0476d19b2de57deb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 12.6MB
        • SHA256 48cf38c6252da25be8bdfb070687d366ec45c1db1898d875498fe509bb567553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 6.3MB
        • SHA256 3348c1b476323b19e0191bf4a4e17e352d95f512b4a752fcfea5c93724fd790c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download