Overview

overview

8

Static

static

3

2026-08-16...ry.exe

windows10-2004-x64

8

2026-08-16...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    127s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 10:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_940d72bcafc2f4d68278835bb6f3f05a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_remcos_vidar_wannacry.exe
  • Size 25.8MB
  • Sample260816-mgqbashl41
  • SHA256 6280317012f23e8a47c5fd2f8db7892c1395630e31de4ad52a38cad85a48a5a8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_940d72bcafc2f4d68278835bb6f3f05a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_940d72bcafc2f4d68278835bb6f3f05a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1332
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_940d72bcafc2f4d68278835bb6f3f05a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_940d72bcafc2f4d68278835bb6f3f05a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:788

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 26.3MB
        • SHA256 06a82a6e08363fbf4d4afdf8aba839296811b0586bff9915e89c5edabb85efd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 26.7MB
        • SHA256 03067e94ea4cabad0f0ddedefc786d6f85d9d20f12d5e7e03cb0b9cab7a70820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 57.6MB
        • SHA256 65278c7f3f02e7daccc145647117d1f3c6e32fa55aaa0cc0ff307178beabf38c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 27.5MB
        • SHA256 4631f10716225ccb56f702a47a9636c7b76a29e30928eb91822fcfac8453bc05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 55.0MB
        • SHA256 620cbdd3f6604738a85280dcd390e3ee30845b5de6e1aa46c70087ef277f4a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 53.8MB
        • SHA256 75ce9508ad553ccdba26123b8111461756e389cc71da84cd0ee806086b3fb868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 53.1MB
        • SHA256 959c24713e5e4e3c85903871cb32e66eaae15e3d0c63cdf1442dfb8f894789f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 53.4MB
        • SHA256 a1a77d25a34cc006cd7aec29718b2f821d77bcf8a63b172c4bbeb81c950b84fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 54.6MB
        • SHA256 a3a413ccd6fd4c3aeafcee1ec73a9b99c4090f9f9b067323a63461f88fc5182d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 52.9MB
        • SHA256 713739b36aa18d12d27a3d60fc542027c63273df2648363bfb42a709e1143f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 51.5MB
        • SHA256 1c2a520d16abec922831ea44cdfaccfa686d01dc870e6c6582ead466ed83e7f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 51.5MB
        • SHA256 6bcf76f48e71ca16e7cc943c948ce9c75d28cdb7a7deebf65631bbe959dd9435
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 51.5MB
        • SHA256 075627be96e661a8ac481e2341dc916ae5f4785acd504f7cf43ced1e7226e47e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 51.6MB
        • SHA256 bd9f3b3f6bca214ecf5ce6e5eadcdb516e96650579aedd97d12680299cb111e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.2MB
        • SHA256 00de6ec24a28d7d09a9d2e0fc695c6224b21cb3c02c958b12f5d2eeafcb567a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.6MB
        • SHA256 6be8fa8a70fdca69a62d89587ce10e84b9576dc7cfa95bd35a96d5a80d69428c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.0MB
        • SHA256 caa38aa50504437a788ce2b7238cce6ffad64ede6a83d1dd2e552d9a356a03cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.6MB
        • SHA256 73f413dd8d7e5ba982821892bbce203abe975cb1745fd62b981ff7fa621e8788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 28.8MB
        • SHA256 08515d7a70d1b524293ad43f66af878e33c5409ffdb7a22cb80a608426cda4c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.5MB
        • SHA256 d519e2ef371483c882bfc0618215ae5ffb0a724a875b77b1412d3d9c10e2afda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.1MB
        • SHA256 83806419ceb3b6c85b2e00658a22d2c9fac0fcda63d11b78135e8fd46b1c0567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.8MB
        • SHA256 3d8e223badc5f70937910a27977f9bc3332db54c1c208551c35e3506e0875b43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.1MB
        • SHA256 58759b4c0afe42c73c4fd04aaefa49eb17c55a20a2ad92ccd49e0cbbd3e1250e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.3MB
        • SHA256 55db9a8b0aec76ae84871621200879628f75cfec82a96c141344adff1f1a701c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.4MB
        • SHA256 181c28804f691d9d396276f59de3c219456b9cdc6c0e1302bfc698084d67af84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.4MB
        • SHA256 ecf5a3ec2c66ad2fe1bf114981757cfc28d3227823e3dce612f2887d36cbaca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.3MB
        • SHA256 5d27397aad358693fbcc24733cec72ecd9bef0cc97069017a2d751cfd5f966f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.9MB
        • SHA256 1a406473917bd9e576f9fb7b7385e930f6c5c21ff0831f72284b1dce91888955
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.3MB
        • SHA256 62439dfbea017a099d156d9656df0492127a52234c183ceaa2c2eb4dede61c30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.9MB
        • SHA256 d84e4852af8333994e21a1a7d8560862c541c3be3ea3b36e13842279691a13cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.5MB
        • SHA256 f2ba428257bf270fdfc9750a2596755f40cd071d5f49ce3628f65d588686ba5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.1MB
        • SHA256 9df0fa295789d82fef15701dfa04d9752d6b9d33dc939780aecf8abd4e24e255
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.7MB
        • SHA256 9177a94a6846a21d07988009d7584898e53b05b09259bde0142f3f96b3d878a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.6MB
        • SHA256 5e99e0122b5f7cae885cf8e1791f87b388e013ef730e12858992400505997fcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.6MB
        • SHA256 29bb961f141c661982e064e7f3f164bb6b0a94e87146da97607f191514ce5b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.8MB
        • SHA256 79db9e767210b06120b8a78429c64a1fa478257feaa54b39ee44eceb4872edaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 21.2MB
        • SHA256 b706e0c48c9d56b62a77c8b354d8cdff304275dc6534b1a729fc73094dd0377f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.0MB
        • SHA256 aae913a406ba7d5a12edf8203fba927483763799fc041eab8947cee24afe6fc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 21.4MB
        • SHA256 0f0edc7dae8e72f17a232b67e4480f0ff39b19ef5d385ad6e37f11e57ecb291a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.4MB
        • SHA256 1cfbd7e36f8ddcb1fbdd3f11ff057760361e88d2a3dc2843764bf527f669d047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.7MB
        • SHA256 ec338a03fd967f8eb65889a38c271f56f9a6dc689411cd5ba4186619227a1a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.3MB
        • SHA256 8dd75311fbc1ddac964805746b660a98d8e423d4ca959b7ad5c5bf0859ccc6ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.8MB
        • SHA256 1c2f4c255bae560efe979725f77cc055af0243751b793e7aa3f994ad311d5a22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.9MB
        • SHA256 00986b6559a4c3d2da2908cf389fe8677a4a24da0ad585d11c35e65fe34d01c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.1MB
        • SHA256 18aee0680edf290a4bf32c59e18dbf51ac83a1ed82411f42475737412b2665c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.4MB
        • SHA256 a3321e0f37051d50834a949e252f31c5d50d0e53c9e91a6229f4567d58607647
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 18.6MB
        • SHA256 4dc6638df88c34ef8d0d9e81b74f751ed95f631ff2b11935f68bec8b072a04b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 20.7MB
        • SHA256 502bb9234fe3dd5c386a70539f4c8710760bfff9e47e67e9608d03c9e9525610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 19.8MB
        • SHA256 e7892f22da243923768ba77c202c1a1d1359b64c92b5852c1b7c08d370c0b54e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 18.0MB
        • SHA256 800ec739bfb2d0633611f4469babbbdc60c21cee794374a2478cb9c229b7acfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 19.1MB
        • SHA256 7bff461bfc8aa5fd01062b1ad47e018998cac9760c4d7ffb461a91da2b5a0383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 18.5MB
        • SHA256 7e456d727aab1c114f3eab19267a201a3ea20e06f95eeab824d38ced54a8997f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 18.6MB
        • SHA256 919524663ea716e57cf721efe8e74f127903e65f002a01920d478790881867cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 18.6MB
        • SHA256 5d585d38d8f44d0e60ac3f29a6d9c9e127dff4d99574a486f1dd7d4b95ef477e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 25.8MB
        • SHA256 7898deac15ff6ded64025d07e53586ec13948640868dff6a45904ed6d6a32821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 25.8MB
        • SHA256 6280317012f23e8a47c5fd2f8db7892c1395630e31de4ad52a38cad85a48a5a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/788-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/788-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1332-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1332-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download