Overview

overview

8

Static

static

3

2026-08-14...ry.exe

windows10-2004-x64

8

2026-08-14...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/08/2026, 19:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_05e0210e72959c9f1d5ffa0e7bb3d87a_amadey_elex_emotet_glassworm_remcos_vidar_wannacry.exe
  • Size 6.5MB
  • Sample260814-yleadazhld
  • SHA256 4efbce411f25c20cdedbfc3d542d20e271cb898b73e1bf32a52ccfd3fbd5ab96
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_05e0210e72959c9f1d5ffa0e7bb3d87a_amadey_elex_emotet_glassworm_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_05e0210e72959c9f1d5ffa0e7bb3d87a_amadey_elex_emotet_glassworm_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3624
  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_05e0210e72959c9f1d5ffa0e7bb3d87a_amadey_elex_emotet_glassworm_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-14_05e0210e72959c9f1d5ffa0e7bb3d87a_amadey_elex_emotet_glassworm_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3024

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.2MB
        • SHA256 01a9c9d64390767338e7fc9e7924cec207e980aaf28c5a2032c91f7810a93ee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.0MB
        • SHA256 5a82fe7cf691ff6ba05c31aac76691be82cd4633ed3c5f6c1ccb796b34c8abb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 6.8MB
        • SHA256 4374868f118e5ed7714c63e3a07c050c46872cdbe181792770a235cec6c2bdb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.1MB
        • SHA256 9062c24b9eeb9f5f7322f283aa7181b8912a19ac062cfad5d6b0151c6d8fa0fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.1MB
        • SHA256 04fb94510cb9b0c8362d5f1095282201c3d225884ed991222f66ffff03aa3ce5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 13.4MB
        • SHA256 27dbb32ede3d8d94fe9a5d73640a0fd147f7aa86b520587db1962ac4db68c7ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.2MB
        • SHA256 a6b43b527c0f63cd639ba8db7042561bc8d5851deb5266942bbc4ff293849416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 13.1MB
        • SHA256 ff2fa671d3c721958833040e195e4746326f7da5aa9e8f02155d14471e2bb730
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.1MB
        • SHA256 f439aad6dae243fa0ff74ef882f208d1e8eee707371325ba6148ac336b347ec5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.7MB
        • SHA256 2fe9cc7a19703fc0804cebceb2afea81fa1d106c10e7d80b7d1425f5c6ac2d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.5MB
        • SHA256 cad28f2e833cc6fb016cfcee3d079819c7d72ce15cc667183b586b50b2c81e89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.3MB
        • SHA256 ef424e47259d4407759fbb1b61426b7d6b431a046f9e08834edefb104bfee506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.7MB
        • SHA256 32b6c78371342694578618a1f66b6f16887f86786d78644d1e0b51a10779bbbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.9MB
        • SHA256 017dd6435210ae9c0989e1e99398044a1b671cfdc2900b64f1c477b39e7536e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.1MB
        • SHA256 ef0ad5e6f2ccddd3349fb4aff891654dec325812e5de8fec14bfe7ae433541ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 14.5MB
        • SHA256 923a92bbba2e4a3986e3048de401d8d8c9092cb653e85b35b2794401e2a3cde8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.1MB
        • SHA256 3f0f7604f16a29d3eb6517743cda9c6e26d255257246682d5a2329b9a603e11a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.1MB
        • SHA256 eb6f3a8605620685110b6495dad0b695b182322e77ea50e9d5461be725007cb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.1MB
        • SHA256 c7498f909ed19f0c08df72c33834e1cdd62538ce8a6dd8437402ca49401962a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.1MB
        • SHA256 b102c1347bbbccfa60e5af5f7bd9ed4cb7bae1dd53c5bfef99d4a0a7b2302071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.1MB
        • SHA256 f8948ddd455402f351e92457d535a5adccc00d8b6749ee9ca36f0ff63eb9dde1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.1MB
        • SHA256 d9347a302bec3208ebc44ee28de3ccdfeb506ddf66b7e200ac40518b18e61dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.1MB
        • SHA256 bdfa806849ec921f90e2a9728f478ca76a3378f455e0b78cf248ffea45ea5ab9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.3MB
        • SHA256 9f876730b70b3aca8ec0687aad70da27c5709a1a609894b3dc4619136a208608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 13.1MB
        • SHA256 1d31863a65a9def62451690cb84176350b71824e43f7ab7cd3586979373b2358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 13.1MB
        • SHA256 171084adc65dcc58c375e68a788e245cab7bca3078b84ef11f00c1585e5e0e85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 13.2MB
        • SHA256 1760a941d2c8215e0fd04835f8ee154da39c8c0cce3e5f4aac1c6f0c56c280ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.1MB
        • SHA256 a87804b2682c61113816542496a0e965e4f9b729744f6cf82542f6f4460caeb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 13.1MB
        • SHA256 e96742dc6bb00aa66d185946c294c817d5971994b1892d2ff1d684293f9289f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 13.2MB
        • SHA256 121557f26f36d158a744cdd73190a1854c5e98d9d4457db5b54fad3e8a454cd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.3MB
        • SHA256 f92b5141cb168020c1805e050521b80500f994867f655ec3dc16eac696967c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 13.5MB
        • SHA256 6b021dc9af70a5d64b944189a4da21d487fba90e45e4f9d608574394d4ae38d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 13.1MB
        • SHA256 e9cb086853989c7a5d09ef6c61727ec9ab88d0b2f454eb6cd7e44919ab33fd11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 13.1MB
        • SHA256 9a5854f3f4112b21a07c98adfd74423af93b071f1a339d63ba530d82c9a8b276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 13.1MB
        • SHA256 ba83cfcc1a2ff83a81f4397224b8319b46a04a016bf881b15912e8111c9d7420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 13.1MB
        • SHA256 f459d61e79644eea3f582a46de1fee84a34e77f45b2d98891dedd07ad8b0119c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.1MB
        • SHA256 c25135edd211d58ed3632c32ba78c95e1a04e2a7f23551abc857673a8694e0f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.1MB
        • SHA256 e42b8d99c059f7bfe8a99ddbec4cfff61ffb4d5f5d006bce1277294e78bd9ed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.1MB
        • SHA256 17027033e222a6c96290d89d4f337ee5d123f51f7b189b88e31029620356ccc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.1MB
        • SHA256 4b08ece42ebda06c8422e443d22183b5497df38f93ce79875b30ac7e07b31f98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 13.1MB
        • SHA256 430e2dfc0cb9adb81a98690db1ea6cd7a43e7e8154b5c4786e18bde7f088c797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 13.1MB
        • SHA256 c8cf08b01162803630bdb427d2f41031cd403da7c3f6903588de445c69ca4409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 13.1MB
        • SHA256 c200cfd92e1bb169a0706ca59345f3f66f7f34ee66dbfce90cbbf0d1fe677a5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.1MB
        • SHA256 e228833e9a5ae688319a16a370e816016ca9d46c3b1cdb09fedda5788e9d60fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.1MB
        • SHA256 c287c2834f605f66226700cd8a64f45481d08a41013e1b4aac41f39261c762ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.1MB
        • SHA256 3522e24dd71acea968760c921e2a15765dff31ad596a3e20a8625162b47adcd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.1MB
        • SHA256 388da003feb2bb6db485cfa8c502783c639ceda1e001a035aaf1430f7d5a5566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.1MB
        • SHA256 09b0983d305427a540163ef29f791229c97b03f6141eee0f52bca44e488f4654
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.1MB
        • SHA256 861c2436264ca2fd228b0645d883b4ba29b7a1d6ccffcad3ac4d6594d36b0af5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.1MB
        • SHA256 a967c30735d9d945a8bfe9474d6c40071947e851ab7fd9bb684089924570cbc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 13.1MB
        • SHA256 e7f20fc7e4256251934410b77e65fe1fac63b4674a8f3c2b2acdf1fe4b6eee24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.1MB
        • SHA256 370493b05bc7c62024d822eb0f6ec549b654c9911d0541ce6a1a389c778c744e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.1MB
        • SHA256 998b7ef5736aff7ef20e0e7d9e474dad99306cccbdcf3565c5b683d461e23f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.1MB
        • SHA256 816d1f2d53f7cd82babded445dbcc4c4ecd5a7393f729857cd091d4ff06dc45d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.1MB
        • SHA256 ef43600fd613f49ec6f950bcf53499bc13b5abc2ed099e318c5296898a51d5dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 13.1MB
        • SHA256 798a59a5da3d9094cc82a9f63cc0754c756ef430b0a233f307c36ad5dd5394a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 13.1MB
        • SHA256 f755b428cd736831e5adb773805bed2da04f4f137977c5f05631a59c6140a4a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 13.1MB
        • SHA256 c4005b7ab84b985ada7ecf38b465e659131ce2177791cdb9bc1e98f07e6af8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 13.2MB
        • SHA256 f1c763c34fafcbc060e506ab5df061c844fe3ffb3ea180bdd5e7bddf65bcc31a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.6MB
        • SHA256 1d2ff57384b091e786c242a0c8c00c496fbb91ffcdc44cff65cf26bf59ac49c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.1MB
        • SHA256 b93a53395f1a57df08ef40f36a88e4affe329089878b980a2f33d658f203e514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.1MB
        • SHA256 771ce160af7f9a87aae5083ba6feb9d430506cef6325e52b94054a8b0d3ce1a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3024-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3624-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3624-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download