Overview

overview

8

Static

static

3

2026-08-16...ry.exe

windows10-2004-x64

8

2026-08-16...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 02:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_9e01b570b42ebd633651e6ce8cb82871_amadey_cobalt-strike_elex_emotet_glassworm_remcos_vidar_wannacry.exe
  • Size 8.8MB
  • Sample260816-cf12asbm4v
  • SHA256 77572e2398ed81e96a1b451a57268d999e184b7197eb407117640c2c8fe2c967
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_9e01b570b42ebd633651e6ce8cb82871_amadey_cobalt-strike_elex_emotet_glassworm_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_9e01b570b42ebd633651e6ce8cb82871_amadey_cobalt-strike_elex_emotet_glassworm_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3428
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_9e01b570b42ebd633651e6ce8cb82871_amadey_cobalt-strike_elex_emotet_glassworm_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_9e01b570b42ebd633651e6ce8cb82871_amadey_cobalt-strike_elex_emotet_glassworm_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1760

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.9MB
        • SHA256 ad953988614c0113c90ecff006db60fc1e8b5db8b71b460d6d3bf3cd69fc7ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 8.9MB
        • SHA256 a6fc2e3c3da2bde507495251d43f726dd45529db9201b3d47e87405bf7ddc869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 21.8MB
        • SHA256 428ca1b7efc6bd0f784d6fdafbd70d12671d6a608d06081e1cc58117dab5bbd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 18.0MB
        • SHA256 fd0af182e078a6db2a981077c40ef1d0e32123d2c0c08e26134fbaeffcf61add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.2MB
        • SHA256 776d5e9194db8666620d24533ae60f4dc181180fc5c8d7e492afc5f061fd2721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 17.8MB
        • SHA256 0f0bd82d458bf26b32ed2112524289ab2efc0911a50cfe5ab905304f6d8165b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 23.7MB
        • SHA256 7ffb7c321bb06be997044949302ce49d5722eba6bdf8460a135b248cbcb9c51b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 19.4MB
        • SHA256 dc9a159f571fd51a3fa38d57181642e3e1b39f6ac171d63c8b942a15426e54f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.1MB
        • SHA256 339996c6d73ea1227eea76b8a5d228adbdbe761399ece67450ad654192c0d82c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 19.9MB
        • SHA256 4f64528ce76cce02d3a1cfca92e104b0b961f15139d92cc5cbec859c737f176a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 19.3MB
        • SHA256 987e0024752a0d855e3c7904477d31818951c9203d2657bc7df103510baf24c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 19.5MB
        • SHA256 74515ff1afc32cbe309ef62cbdc6e6e6d2a992d17d827880941d14d2ca1724c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 20.8MB
        • SHA256 e1264c732e7665e3711208efcecccdb024e99f4eccd17270c49d9766e839163d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 19.1MB
        • SHA256 04c3a3f5997a2576f5ea2a224d0dcd1a90eaebcfff91c3ff5e90594b596e4b59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 17.7MB
        • SHA256 82c456573d8e70de2f2c2036f8ced2bc0956fa0c2c2f07d6a16c764ede641d38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 17.7MB
        • SHA256 96f315438d7f807260c213abe20db2f117a82dcbb40ac2f2c6b8a217eee14540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 17.7MB
        • SHA256 7b32a080672e56252759120747b6354930f26b3088dc03494374337b82240f75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 17.7MB
        • SHA256 dd16ba3b7168549bf5f858ab42b7e17cf66c527ee3e530671d238a735be077ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.0MB
        • SHA256 cb4e784e5c84609441ba89b416986f8fe5d47aa54ff5428a4f4e39ba7366153c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 17.7MB
        • SHA256 a3e69d33da7ea99360214b2f47fa10fcf1ca4a9b5b507ed9a980360c9142ff41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 17.7MB
        • SHA256 0aa983685c5acc0479f4c65b365073513ab6ebdb0db7236ba301b738427ed6ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 17.8MB
        • SHA256 fce1ea442cb975a0a40a51c1d8c0ee6122a2b3f4e8fe1223096c9f6a5405474b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 17.7MB
        • SHA256 0865f1f27a93a64d43f867352febf782b10d2fa3b36f7e043879e420576adfb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 17.7MB
        • SHA256 7d32c28755bc56b6a176457228cdf51cb2e2cb752f3cb16a02a2939292aeb698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.8MB
        • SHA256 69a0f643e3605690884cfa9952ca6d6fcf1407777a6b4a4f3e5c9cc1e019f0bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 18.0MB
        • SHA256 dd0a8b84836423bd9d0a47bafa930e8f9cbb9ea23d686c95bd394d474570c516
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 18.1MB
        • SHA256 f5ea4c91a1cd555e4bc39f0f6f3ec987748b1fafc2192161bc83e305810dae79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 17.7MB
        • SHA256 2ea5ba495e859e547b74e4f9ba3d822304a376d0c3779743fba9607394ef5164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 17.7MB
        • SHA256 96a42e7189b548c03ddc4b4bc4c7343ecdd62c8e3c8360a2f47b072856a7cd65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 17.7MB
        • SHA256 984e2f637324a5fe796b6b202c8889af7eacdebb6fde05de8ac749d0e787f877
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.7MB
        • SHA256 98e272c2b570893fe6952ca31153a822f791d113fd9d13f58ba49118f18b4c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 17.7MB
        • SHA256 3c08e500e188db398bcae15ecd67d47e6ca08a40c3402db8f6c0a12c58c8d72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 17.7MB
        • SHA256 b838dfc1556a3e75c6c6dea8ec411280c2bc4c5664dab24218964014c1cb62bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 17.7MB
        • SHA256 405f1091c3fab6c576891794cefab50fb4ed8d29c2a1c1096d946be17d534e05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 17.7MB
        • SHA256 ee5b777a781661edd442f9ef39ffb81a474c4fceaafe5b92b59e39ea461b7bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 17.7MB
        • SHA256 aa0acd82c0e013714e8b876cec1b8a1221485bdabb45abf95189ca3bd1e572c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 17.7MB
        • SHA256 22fd2cfb74877a7198fad4a8abf71077591d5b74fcbf616f9ab870bd9c9b6608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 17.7MB
        • SHA256 db8b2ee7890473d3fbb72ed3c9faced280a78523f20f3167e68e1bc1659cecde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 17.7MB
        • SHA256 038fbac4415c60cf86594da3f22b0908ba2413c062bf35f48b7bc8b00c2de6e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 17.7MB
        • SHA256 c84aaf2cd040cdc872c38167c84fbbe573cb8c8b50c45b45aff51bbb362e149f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 17.7MB
        • SHA256 64557b32960aad36e5d8f09fa69cf81040ada489a896e7531ad8cbafbe141cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 17.7MB
        • SHA256 6a8bff2e87337c8b061e109898f05af017e277b95aa6ae97da6a67042a4b54b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 17.7MB
        • SHA256 b252caaa5049f5e9b92b751debddb5a7b482269a104f429a5749e7daa4685643
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.7MB
        • SHA256 d2f8ff00771863159bd41278711028a40f037481fc8a2c0f05ebf4e3af8f55b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.7MB
        • SHA256 a21ad706200f103a72cc051fd50905e01636d6f18c66edc0a6f45cb053d96795
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 17.7MB
        • SHA256 30f976278250768962e594c97b0eb7c6aff8e689ad584904954f99782bb407dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.7MB
        • SHA256 cce0aa8954523ee92e8c33a19e99875def7997fe3c1d7cb134f919d0539dfb56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 17.7MB
        • SHA256 b5580cc036a916ef779db0696906b3d0548c1996e0eda42c3586be4849414b4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.7MB
        • SHA256 05b34d79a9f235fd99d67706490bafbe48331fa5f755012554d9a10aca49f25c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.7MB
        • SHA256 421ff336bc860919cd6df602e7b22fd204706942c3a9bd23c267a1b50cf21693
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 17.7MB
        • SHA256 0f96b8ba839b87b4f8d5ed28c9e75b24df00194ee25f34c72ee07d39513b3d70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 17.7MB
        • SHA256 47a0b9074d33f77653c01f7287a15d00b3db68d910b4d9aff31b9d20a2ec095e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 17.7MB
        • SHA256 331be4e42c71835bd04a24fee477bba1c5a9996dd6b1af883c3c45490bda4d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 17.7MB
        • SHA256 9f6043619b3dcb2060542fb622eb8745c61e4c488ababd2cf04a3e25914c5d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 17.8MB
        • SHA256 0734aa61efaa9473a529229c970287001857aa2f30c4c0a0397a52748a7687fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 17.7MB
        • SHA256 262349c61b3b38e5e687a4d351148629300ae33997cbf27e2baab0838276f750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 17.7MB
        • SHA256 99e44eb6ca7fecaa42ac2f39cd16866fee90ce229baa1c2133f88951aca76f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 17.7MB
        • SHA256 6d77f0f0ee30fdb50ac9e85f8087b5b2f4faddfab28e978914ae8162bb50fb9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1760-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3428-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3428-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download