Overview

overview

8

Static

static

3

2026-08-20...ry.exe

windows10-2004-x64

8

2026-08-20...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 02:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_92d6b1751a2547992503a543a6df979a_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
  • Size 8.8MB
  • Sample260820-cvz3jsdn5t
  • SHA256 df6bb28d872ad3bc48e473e9eb26828d21559f2978523f2b78003a410f9face4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_92d6b1751a2547992503a543a6df979a_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_92d6b1751a2547992503a543a6df979a_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4424
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_92d6b1751a2547992503a543a6df979a_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_92d6b1751a2547992503a543a6df979a_amadey_cobalt-strike_elex_emotet_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5836

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.4MB
        • SHA256 dda0bc5ab200667894678c98a53f530b2f1bb60fb9b8e4926f751dd2e2f529ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.8MB
        • SHA256 65a00100d015e123ec2a88452c347faf7b64e412a9a2ef7c80d75ca397f4ba59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 17.8MB
        • SHA256 4716be175c4a6a8930bbb3013160ee86a1d47c0a85a1bf1aa622dfdbc0d43281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 21.6MB
        • SHA256 c1d962121a3f48287a2cab3819fad17c004c8148bc72c96407f6b05d1645d133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 17.9MB
        • SHA256 5d0c7bac88c0932f4e49f40e28a92d83bbca928926e87efde80e2e73ec2c2d86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.0MB
        • SHA256 7d260223d5ca79d865a54171115310ee4fe1e35abca822dd89c2259f23d4b344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.6MB
        • SHA256 804fdc64e2d885c05db9ff0376902ef69297546db0ffcda64a1f56b612f7bd73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 17.6MB
        • SHA256 83c50a9838f572def68d0b75e88f670e812d75df1e0e41326f5f05d173651bd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 23.6MB
        • SHA256 66caf4d55bf35b5d1f91ff409eed63163440617865fd61e39dd67aa7d300f6a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 19.2MB
        • SHA256 1884d446ccb01c423a068233325795fe79428001a5109ec96cb2b5beef017dbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.0MB
        • SHA256 893237fb293a633d34e4ab8629eabd168cee40827faeb513ee89fca80346ad10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 19.8MB
        • SHA256 9add996f81c90397d52dde57d479ae24b8f47a1e6a4a1ff0882a59449bdeca0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 19.1MB
        • SHA256 fefc2a2efacb8de92d7a721b68141640057f2de7b83c979ecdbe71a2903ea3c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 19.4MB
        • SHA256 7f01069da0045c35218ff4be5f56c84f2d8ded4037a73d43449e5ebee51a0ce1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 18.9MB
        • SHA256 926dacfcd711ea6d483a06ef08b5cf09ddc8b29fe8d1e9e181f83adfe0091831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 17.5MB
        • SHA256 a9773e4146f70296ae6e899ff4c0df5d10be542673c700a050fedaf34b7bc7ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 17.5MB
        • SHA256 64525a8356bbfea3621a6497f43dcfe973f43021fbbd6fa824f14b510bce9dba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 17.5MB
        • SHA256 c3b8b1415ff49485f7f92b0af2f45a0cd04907cbc7586c7eea5141e587ef2f19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 17.5MB
        • SHA256 c82387c04e5daf7613bebd1c6e8bcdc296e064bc5594b3e545042570a9f37d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 17.5MB
        • SHA256 9d6651705d7f32fde4d433028b2f033f1c21eab48af2b6796dee66a86ec3d846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 17.5MB
        • SHA256 a4a1effdcb2ada0334e49a5b31dbb295772394710f6bb24a58dd40b203d7f8ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 17.5MB
        • SHA256 d1cdab1ea2cfb459d1c9270e159e9b1052be8a29cef587957c95ee0003ad3fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 17.8MB
        • SHA256 4d23a9399a4034c58b6fe1c09c6a27cf70377bcdecd0b1c93d33ebcb89c003ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 17.5MB
        • SHA256 3274a36f269bbbeebc0c1fd12e053944b75308a92fc8a17fe19154bd417e781f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 17.5MB
        • SHA256 c8d528ef433399cd9ab573d871d2ea41bcf601a066d8d49072e95fb635178ac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 17.7MB
        • SHA256 ae34f5aa67602965aaea006278a0d06471418d19eb55696f754a261566dba1ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 17.5MB
        • SHA256 f4a84ae4f3a6b5cb202856ae5ba2e26ef93a6fa3ba255bf7b9daa25142015edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 17.5MB
        • SHA256 0f9cbb5ffaafc816e81ad1ce06547fb90c995f63e16e33e8f4a8fa049ada20ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.7MB
        • SHA256 ff2c416f67eca15281de33076cd7b8f9f5252c0e2f2eff25e4a8e003e3b7161c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 17.8MB
        • SHA256 b57b7fb619a4aef560bc6a3001522fd86cd0202d8f53e46131a176ef46bc5df8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 18.0MB
        • SHA256 c61f58a4c654e7ea17db2a6c3b68f0ccb3d41ff362ce59447ed517b45b4622c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 17.5MB
        • SHA256 b1adcf8569684e6e8c5d43b922d792fa11e60f95725c65be9786f6987bf5dd4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 17.5MB
        • SHA256 c03683eadbabeba897c006ea88238fbb977f30356ce28ad99b8f62e1fa5b6454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 17.5MB
        • SHA256 57c1160d556ffea72a8d26e03d7c04c6b1d1db3ea62d5f7f0f499be2a40df0c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.5MB
        • SHA256 23c2fba81ae0bc2ea7942f51d04b88987089d5a30feca15fa7ec99fc8f426ac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 17.5MB
        • SHA256 87ab667f5e21c204c4d1caad90735e58a545edd6fcd6e0269cee010f647dd263
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 17.5MB
        • SHA256 b20719dd7b5febd7c2f29b9c1fa6e3f162a779b39ea18b61100797912cee72cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 17.5MB
        • SHA256 a1f1119788976965cdd9dbe070bf95f45541e6058372ca91316ce92be50c9839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 17.5MB
        • SHA256 117b881d4bb9ca6ce0ea2ad7312cf7f67f168900d748a011102134e4bac639e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 17.5MB
        • SHA256 c9d8b71f584a4886f84f5599575a3d657be61928fe4c317e9d35fba801f4c41f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 17.5MB
        • SHA256 13da52a93dbc2927edceec131d75c6e3d674c9feee060262cfcc046b5d5bb28c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 17.5MB
        • SHA256 fb9f39735cb62f96716e19e9bc0ff847a06ad73412868a37fd54c3fff8d347b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 17.5MB
        • SHA256 80548ce4ea984c8411e78d09d66fc0376a00e70dd25fea044a9977f615dfa2d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 17.5MB
        • SHA256 4d6774a5246426ad443b94076936c218b75c53ffb466b99418ccc256abb16d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 17.5MB
        • SHA256 8436b7c17c954d73478b8bdd13c806d5215f0643f8895566ba8513925d5a49f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 17.5MB
        • SHA256 51b4098036216a3ab57b35ba409f06af20fea926b0214ee42a73878178e066bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 17.5MB
        • SHA256 67691f586f537763bf3a4d71ebbafb11e1d299cb5f84e76d87057f2f66cae65d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 17.5MB
        • SHA256 b254312a4bc2497a3a074d593d30f515d273328f83414f7f0fed06c8234b0471
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.5MB
        • SHA256 c9f5457f94477096ab551693d83e4848fe4e664923a1d221c6c998fdff98a460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.5MB
        • SHA256 542f48ed36ffcdc446bca2080bd7f39c97d6769bfab4ea8d6894967200ece42c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 17.5MB
        • SHA256 1a537b11aff9cbb7b371fed50794e7cdb43e024ba8995b024285de7f735b9b2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.5MB
        • SHA256 b33458904d6bcb14d5c2e3eb173647021f4ff7d16e2bfad1903203872074afa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 17.5MB
        • SHA256 08d0145d07b5856eba4ed334a9735ed4744631aa03f0340f0b368a41c946c554
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.5MB
        • SHA256 38868776944451eddb0b2451ee5c696f8f7d5e06781a3abd5fc1a0195fd0ada5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.5MB
        • SHA256 03f5a0dc3b56ed04e0845240260c559fb8b202eb542eeac37f42dd3469f747e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.5MB
        • SHA256 11cc994c1489d676f75dd95ed3d2301df24305eb11ba50c04b6391025c0c2b8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 17.5MB
        • SHA256 6cd227bbe40b858734a6b07b6e277313448f1c196f430afb6441e81728216003
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 17.6MB
        • SHA256 d370f57ab4de4a595c20d48bb4f58820844304880c2b2a32df9028661a7b12d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 17.6MB
        • SHA256 fa31deb82f5c8325b8124ed6fe68efbd38aee837e8093b245093921ae1025fb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 17.6MB
        • SHA256 35798fb1de41b161061b5b6a5796b6c790de94fab21c2c048e8b421c8508e9ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 17.6MB
        • SHA256 f71106042b164ae84aa23f7b14ce452d0706292374758b61b76bb350ef30a9ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4424-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4424-33-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5836-62-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download