Overview

overview

8

Static

static

3

2026-08-20...ed.exe

windows10-2004-x64

8

2026-08-20...ed.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 07:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_47050031cf7955886d983e8b2e016b66_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 14.6MB
  • Sample260820-h2lfmasarb
  • SHA256 dcd4e09e9e2676d89a2196d123adcc85e82daf3f2d1737df00602cb068aa1ecd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_47050031cf7955886d983e8b2e016b66_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_47050031cf7955886d983e8b2e016b66_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2884
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_47050031cf7955886d983e8b2e016b66_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_47050031cf7955886d983e8b2e016b66_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2768

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.8MB
        • SHA256 2155549713e121620a4d18324b62d6d70e72884ce9deb7fcb6ee939f4590c582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.2MB
        • SHA256 4e11fa1742e15a3cfae932c58e3b7c1faff251c615f13b648b8df6ccc67de734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.2MB
        • SHA256 c0e1135159a9603f1bdf0ca7f423fea27d474ae08422f0a3ace25c9d15aba8a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.6MB
        • SHA256 50259997681e4fbaa259b87f7bedd7e77d7865fce0157f6b995e6105160af7ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.7MB
        • SHA256 b08a316183d6a96a0f721213ec0c58a0698f93d4f2a6f61a5dfa7b9ffce8cf5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.2MB
        • SHA256 c52f2057eb87b76b93815373dd6e5c45b1170002b73646df1b218e31b6576bf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 35.2MB
        • SHA256 3f7360a951f06299ad4de4341296ddffd86dbaa37b4f754743ceead70b22c340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 256KB
        • SHA256 a88ab2eab13680012502e10692ec5c6fb70e333b6df630e671ad53aaa93b2f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.6MB
        • SHA256 a27bc19bd05d862df498522afce268f74f34acfe8303b17a4b8bb1edccbd4395
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.4MB
        • SHA256 8ac7f6eb3541b4644a2831ecc1a7ed5de2ade2e7a735bb294fb741951147fcbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.8MB
        • SHA256 ede02b5379d4d5b678acef17d4fd7620e1fd1c4543f44333371feafdd8144e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.0MB
        • SHA256 2a91fba89ad3f730d05b60e68b07a5256af521ef876efb6b3ea194ba6ffeb325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.2MB
        • SHA256 fa6226979f72d64586525ecef27f4344faa5287407b273c9ad66705c7dceb29c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.6MB
        • SHA256 736ba6807e0d0369661968db2fc8a3e9f4a1aac7accfcb3d17c93b3a59c8e674
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.2MB
        • SHA256 8545c3526c629ebcf74f102e5f6ac325242c90a7d04631b80f7043d3fa12a261
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.2MB
        • SHA256 e227c0823b0e64c4b3dfbea8b8491afb5ef2938e00b6db3ce5e489c245f94dd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.2MB
        • SHA256 975486ef312a8c28eebdb4f6ea84aedd5436117f0c3ab468e0564609941500a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.2MB
        • SHA256 7b41b17ad7378d4cac9ff5a26b8f921db04a4604960f8a003bb4f44b1428fed3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.2MB
        • SHA256 5b3aae67b59f7339a91cff62d47cefdb6a00a52ae8301c7486121f0bfb97624c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.2MB
        • SHA256 df7e80769757d56176c28b416c8b72e0ec9e4d7aff1117aaaee5c11ac00be684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.2MB
        • SHA256 745c990522d61d3aa18378469d00e95982b49e6ccd8cb83704fcb27faaf699c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.2MB
        • SHA256 ed2ef7ab9e201defc638b7ba9722c9374f7702495285ef8f3af54ed0cf78c46a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.3MB
        • SHA256 28e7fa302beef76d80d35a5d1f2793756be6a557092130ce1b0c9fccb6bbba17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.2MB
        • SHA256 456aac889f8ce715b326a20c4c8b40398694fc5743ed71ec81a97bafbf259ccd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.2MB
        • SHA256 881c2d6e137a1879e642c1dcddc33a839f621043eb90062f1159311711b32002
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.3MB
        • SHA256 2402093cc33d4f1fe6776f90a50731fdd34627bc5ba8f9cd11a79830aebb3a26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.4MB
        • SHA256 d49c9ec799218ba55da2da947e848cbc1cefc17e91f53e4145be3172b81eb446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.6MB
        • SHA256 b8c0dfdc54a7effbfa83a8c5611e14f0d9a57e7cf0c7891395f021def7155279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.2MB
        • SHA256 64ea6ec502118227654ace3ac24584d61a6e237155e97693bcd733dc650483bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.2MB
        • SHA256 2eafe1c6cdeccda8ec765fbbdc85af259c7f4e5c9debf6bcd538ab894fefc44b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.2MB
        • SHA256 558b376350a317cafc184c1f04f1b1c9a30b72b92c85bd4c0d84d9589e5b1496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.2MB
        • SHA256 919872c3a34f6f3f5646b96c0ee18f37671ef63793190816a29bd2bb93b66b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.2MB
        • SHA256 f179f712c411d6e4fdf27d365d14ed17eea5c3317f296bd77df4f06363e149c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.2MB
        • SHA256 274a0b28d44c7b91e3d5569aeec6180b83ba086707442fbaf71c19a60dab0b1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.2MB
        • SHA256 a6b357f4c0b9e04be62adec99bd8263f745fec856c14b6984c2e9ed3c3071729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.2MB
        • SHA256 c2aa04bbf40ad3b20db7af9cb957bf711eac989f9fd2b85893069752dc4990c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.2MB
        • SHA256 e97b0ebda00ef1b7fd86ec54877864c675d12445e69705fd4decd78fb4259f2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.2MB
        • SHA256 4adca9f77e603920e89e35d522c35e08022f97fa40aa6cc377409d3652e47698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.2MB
        • SHA256 84b5c11c4c39a682015cfe375a992986940cee0b33db6c35d783ba241764c0bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.2MB
        • SHA256 14e8fafb9ca0569726cdb04bbc69472a0ae51a117e37c4ba7e536842ea5b2f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.2MB
        • SHA256 9951e720b1bf8df6e007e349bdf7f9d505f5542eb72f207ca55e5916d7e4d99e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.2MB
        • SHA256 88c97208f6404102816491b9a5d16c326014c98c63dfea6a00911ce0e9c56c2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.2MB
        • SHA256 a3aba85b4d70c31d9f3591924833bec20c6409805943a0c35a3f0d70605865de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.2MB
        • SHA256 7c9940c0dc330d6e833d258cbd44355f84d1487c0db94c15ff6dabbb36132efe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.2MB
        • SHA256 023485aa044782be8b2fc9614e7976cb25170f5664d978efdad131f0a192215d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.2MB
        • SHA256 278112dc2e11d3223f0f4329eafacf3767621d47ce4d16e935f7218baec933f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.2MB
        • SHA256 a77fccec8c5692994d7eab0cb736cd8f44d41428c61c682a6c35bb7296b71cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.2MB
        • SHA256 50e249968964739daab8316b17d89e6a60e6fddb439260b2ea8f111e81f1475d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.2MB
        • SHA256 c74a9f752833a10b842329af7534ba3cea8e7226e2a485c9ab9f9e416a1e2e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.2MB
        • SHA256 5c40ca6d379362719f5bfa32741ecd85589e36faafee81260387581de7409a35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.2MB
        • SHA256 13c5c18608ebc6480a41112335c504ee270a72a936e220ae70cc0250e0917186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.2MB
        • SHA256 731698d755e2af0d2642124d1a6b804592612f551af9de475c22b90cc08d315e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.2MB
        • SHA256 550470d2c1edca2d8d348708c869abcaa180b699a9d70649c52877e1a79f7701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.2MB
        • SHA256 37237962bf3572ce1a947a220bd36bd6d9ea1a548b4c93599dd215ede8138b62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 29.2MB
        • SHA256 555247e671df3006c4d9c8cca4720d1a7961dfe1175239f3acfd76c8c8bcbb74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 29.2MB
        • SHA256 fad88a52b5714d5fc39a578c39cc9e5b0aaf4bcf0fb13581c313ca69ad1719c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 29.2MB
        • SHA256 7f42fb057980622fdb4d4f9831d83a393d2019adbb917c5b7d09ef7a0a828061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 29.3MB
        • SHA256 d5eee2f70f41309ff3279dcd6f091f785c41b7e3050cea7520323fe648d0edc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.6MB
        • SHA256 d88dcb8ae0974a2909a5e134b847db3f7c1b1a1fc36b130e8020b1c7dc925ba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 29.2MB
        • SHA256 6333fc36a7dfebd6b19e438f22c0a13e8d2e210fb80e36d8834c10b350bdd5b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2768-28-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2884-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2884-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download