Overview

overview

8

Static

static

3

2026-08-16...ry.exe

windows10-2004-x64

8

2026-08-16...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 04:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_654302ce77f7f604502637d55c762cda_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
  • Size 9.2MB
  • Sample260816-e157vscr8t
  • SHA256 f20d5e16c24e1df223e3652211f8bde5b6755c183703721bf334ddaf57808388
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_654302ce77f7f604502637d55c762cda_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_654302ce77f7f604502637d55c762cda_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5884
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_654302ce77f7f604502637d55c762cda_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_654302ce77f7f604502637d55c762cda_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:956

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 9.2MB
        • SHA256 77d96bdd51ca9fc2af0f2298d4ab802f0628fc8cf0c24f6611ea73f1463484c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 9.5MB
        • SHA256 201bfb5e52d881aff09892e9ef5f879f59fc5502b4dd086b0e53d1e9664a7b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 9.2MB
        • SHA256 f20d5e16c24e1df223e3652211f8bde5b6755c183703721bf334ddaf57808388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 9.6MB
        • SHA256 e45ab757cd218c8f80f0cd4fb0e8c1d37301ff19313ec91ceb64229ce39480bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.3MB
        • SHA256 9598fba63c756a01066420e5420d0a69962363af2251e1d471456d99d0feed59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 18.5MB
        • SHA256 a9a939289e7d6296194488fcd3408bf00efa4e400602f3dfca68f87a8b4446e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 24.5MB
        • SHA256 b58dc00aa99cd87f66b9390e07cf5f216d45be4931179c4323b261294e1efc3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.1MB
        • SHA256 46aa23cad5a9575419d9aa7f3fdf154c94d586491ea84acc79c9b3264368fa58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.9MB
        • SHA256 77ebf92df0ce18c34f6400861d9caf7cb79262a3a5c915b73c75e6a66e58b9e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 20.7MB
        • SHA256 a89315ae60fa2f49003715868c57d3610f5aca2f3db20339e9cd9d5fc3fbc673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.0MB
        • SHA256 cedb54753f3e4265bdef23c35e0c76ad64e57646c3a722313ac71c84ce27990b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.3MB
        • SHA256 dc83f3ff92c41ec484bab78bfcb8ea25e2b7cf14845f0df87a55a43211087c67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 21.5MB
        • SHA256 0ebc4c08e34b304e7056268c3a111694344e7dba88170146a5135b3a35e45023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 19.8MB
        • SHA256 fd26ba8f2f54bf389c42d6e18033c48d14bf740d38820cb10997156e0fe6182a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.4MB
        • SHA256 8b7189be59b02841c49d3705ff8e5638a1fe3faedb7b4d924946c7801bea9157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 18.4MB
        • SHA256 5ca2c97453cff40f03440714f485b427fd3df61d26133451425d5f597816be7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 18.4MB
        • SHA256 9d3f31c0b44a1eb9484bd8220c0bb1617d9b0dada8c188c76fd1f6cc56ecd164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 18.5MB
        • SHA256 12311ba9205eb2c3db770af5af68da31b20995ddd12f77925a2e2831b7b91741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 18.4MB
        • SHA256 0952f575a723c49c197687a1cc88d3d98221ae20f022cd17355e3cf2c03e4156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 18.4MB
        • SHA256 a48ab62a8402cc74bac0d6ff2e60fa9bb865a86ca5857ca46d387326f8361728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.4MB
        • SHA256 11840c9fdd4460891c50a0d431b992a4b7fea45febb52c46a47175f222258552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.7MB
        • SHA256 53a5a28f7c451d19197a2161ddd50d82d11b5b14aae5cdb89ae0664b9b655c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 18.4MB
        • SHA256 93721f9f9f48417972d40a3348f41293a91dae111f1a29a788050ce3d2a4c37c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.4MB
        • SHA256 e2b5cc2fb290ab09dea2a00fa7ccaea379adb5c1eb63472c52b24cb0eb75d296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 18.6MB
        • SHA256 3763a442bd5d8540ea1cf1ae3a462a4267302d7fcbce68cab2338209a4ddc704
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.4MB
        • SHA256 94c279dc993328a97972f4efacf7a832583fbd79f50ce4d947e5e8141d7f2de0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 18.4MB
        • SHA256 59680ecedc8229e103c4b4fa0fb39dbf9abad933c5286bd789b48e5a7743ae8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 18.6MB
        • SHA256 9b5009ea9d59ba78435c2d6f9f43ea892a34f7e458799b0a4c5878dc8dc9a2b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 18.7MB
        • SHA256 d3dcbf5b6c740e8072dc66033ef23ed1cfd78ea882f14aea476c6fde0b4e0ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 18.9MB
        • SHA256 ebd191a1c6ec71b864a28ea2b9d5e0b0c24fe49066db398de3a247733bedd25e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 18.4MB
        • SHA256 61bd17a298c822313a6aa7c454e668d3f1e35ad84c8b465eba3aaae6f8c959ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.4MB
        • SHA256 0e9d920fa460b8f124d62071188efb153db0996e9630335ea37a8580296b8812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.4MB
        • SHA256 37d5e98790bab98f592bb8eff485bda21b9220a0dd6fe0fa044e51c48b084520
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.4MB
        • SHA256 fc1e98b4073892fa8b6f9a9ce873957dec40f7fca10377de04b4aaefa2289381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.4MB
        • SHA256 6400d2a4a909f783f9cf3f668c00487c22fba1768dfcc78c674dead74e3c268d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 18.4MB
        • SHA256 56c1855b6a746ffc057ca97616c7468f3d88b6c9932b659273877e5105ec33a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.4MB
        • SHA256 651aa40c2383349d9dc8ab8d944a1ea0e88e52199989e95bd4e97ee7f9a7342c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 18.4MB
        • SHA256 8033497eee5079c7966a251a48e593c32dbb1fea566ad25b82300bc723ac745e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.4MB
        • SHA256 27676215508b2add94cbcae3184d8767a9caeaaea3e299c86eb6d32d0036e886
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 18.4MB
        • SHA256 2ac17dc856612529bb9633d8303a564c3fe9bf9ade492ef8cdf496d3cc38f771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.4MB
        • SHA256 31bcc7708aa237623f191f6a00a3d0791065426069837ffe149d4302962e5419
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.4MB
        • SHA256 5a5bc834a5f5c98453bf0ed877c081b2fd78dac23144df1dd128229c84c9a1d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.4MB
        • SHA256 6eabcf9c30e21d653323aa905e2fde4db15a0f6a79a40aaf17b75b14ea628496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.4MB
        • SHA256 7f145b4c8096a967df8826634c97eb7379abe8c063c71cd96864680caa5365a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.4MB
        • SHA256 250f69377f838681c7c7435cdfe4dc8eb7136a2a5e2238445a659e547b9f2c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.4MB
        • SHA256 38cb3df3f23c80e9e7d1c6ffe3cb05deae7fd21c80b69d0f8668fb51434685d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.4MB
        • SHA256 bd48629df6a96d23cc48db867e47b7bbe3592084e88e1f70582842672b782fac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.4MB
        • SHA256 46f3b669f5c182f8128f887b935fe162580cee9a16bfbaadc3384dc1534a18c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 18.4MB
        • SHA256 c8024d32b5e274b1400f8b1a82299d068969e34088aee676e91ab717072c17d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.4MB
        • SHA256 66bd1b92ccdf85a83d8587402ecf1c2b8686129eba72bd387c21b2c9456f7696
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.4MB
        • SHA256 231c9f8e1b9059bc2a291d1ff8ed2246413bc99a27b6affd04ad60935b05e62d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.4MB
        • SHA256 d3b48e29c368ec87285724fca5e63489ae5c2cfdadb394725495171abf3c5e1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.4MB
        • SHA256 b9c0ba798229e4da2ad9950326d7acc60a04d1feb32dcf501c2438707ca1c1db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.4MB
        • SHA256 8d658f560fbd12ea377199ace6a12bf78e1bbe000e5777808e7c700778628bb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.4MB
        • SHA256 b4cb9e459b5c55b71420e44b82076e6f3d3a8e61141fae3fb82c1ce4a3020cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.4MB
        • SHA256 0f768e74ad006c2150cd59324829bff18e38b03690e69b756beeee90d2daf870
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 18.4MB
        • SHA256 06abfeade3909cc3df11fae7fa3c5373061a5d6ca9e33cb7d7e1511765e855d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.4MB
        • SHA256 5138bd614a7725fd0b2f414e026e92ec2f17d8c04b2f2d7a8dd89cda65eab869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 18.4MB
        • SHA256 6d002a6d845a23a7f07c767c60430aef4347cbce8dd28b39f16c5948d86cf254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 18.5MB
        • SHA256 597a88e01f770a9c6ead08f7d86de680376a7828af274ebcacb31c29b8aacc95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 9.3MB
        • SHA256 ba9577392552e0f9d7133a9e48d29fb4dff6a2af0a9ab968f7f7b0aaf4f01f56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/956-9-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5884-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5884-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download