Overview

overview

8

Static

static

3

2026-08-20...ry.exe

windows10-2004-x64

8

2026-08-20...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/08/2026, 08:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_b587e566858e67932ae37b67793a5534_amadey_elex_emotet_remcos_vidar_wannacry.exe
  • Size 3.2MB
  • Sample260820-jyflmssekh
  • SHA256 5e40b902da9a275a7a991395c45328ee52e138e1b85bf599c8c4c602164fd023
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_b587e566858e67932ae37b67793a5534_amadey_elex_emotet_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_b587e566858e67932ae37b67793a5534_amadey_elex_emotet_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3544
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_b587e566858e67932ae37b67793a5534_amadey_elex_emotet_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_b587e566858e67932ae37b67793a5534_amadey_elex_emotet_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3932

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 4.1MB
        • SHA256 156a27769cf6119d192477b543bf47f80f010361201d4a61435b5e06ebad18ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 3.9MB
        • SHA256 4812476a0ce253159f0268664c715f8935053fd776b63762de4760332ce7811f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.4MB
        • SHA256 770505eb0c52582338568e133f83b93ed829ae4c0a4534427f50ad521e51a9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 6.7MB
        • SHA256 fbed5298ed361fd8d16105361a8a12a50054cd510ee16f22a70028f34a6bf13a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 6.4MB
        • SHA256 3f6cfd62d669bccbe69c843dc8c3efde035107d3a2294d3f79d1e7904aeaf3fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 10.5MB
        • SHA256 cc0f3b93c61f05edab111ae062ab80ae0d3ce6439df2c3726ff92db84e021af8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 3.5MB
        • SHA256 a6fa55dff717c228b1141e27afe3e7a653bd4330f53624ed0cfca0e0bad15c0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 29.8MB
        • SHA256 25635eac08326d80f788908a66c4a138508694d6886dba9b7ae88c8b10a7ea3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.5MB
        • SHA256 1efd08b9dd22355f490a83179273e01db5b84b4f1d1797b0ed5a3e925ecf08b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 6.5MB
        • SHA256 323086e68e771692ad91fd248e5cb48eab90a5c64d568e037aacd1eed6b31134
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.4MB
        • SHA256 84b3ee616838adbf11c839aad80e0edec624f119e2a0a7f6fe59103e8eaed830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.1MB
        • SHA256 cc59d3406be448739075b5df95b6c545ce7cb39cfb903bf40def5141209fd2cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.8MB
        • SHA256 027e90a32f51efb174a13e0362168ebd32c09b4fa12dbf294f64e589bba97010
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 8.6MB
        • SHA256 ea7a70c0bbbeef430239545913dd1c2c74907972a3865579d50d755b26f1e041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.2MB
        • SHA256 8d805730dc77806958933f55310b0945e0da0d263cf7472ba005fa1bf29604c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.4MB
        • SHA256 6bb2f42d5bf2636ca4abec04d03a7ebd4d703c4cd8db21aab9f7cd93f729431e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.8MB
        • SHA256 50a96cc93b130a1bf06ce77c2831f86e24c438bd99c34d90aa7fd2a222ead07a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.4MB
        • SHA256 952a8ad3307b56cb7461497d067e85d90600fa943184c1daf89cb8fe3d3867b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.4MB
        • SHA256 71fc9173f1170521f6f3b94d1c9c3757f4799c033ceeeedd0f4d07d3e8465295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.4MB
        • SHA256 0117da405af42746c3f2375470fc18ca901ec0d70c8de30c7c60842ecc65a201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.4MB
        • SHA256 25412dc57b0bf5beff2de41ef89c22fe4e7cbe2ef35fb751c4b933cb8af6a37c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.4MB
        • SHA256 e15aed878d01faeed00d4db284b0cadb71798ee3f8782bb6301513a0ada95659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.4MB
        • SHA256 4f5051d28eb292fc22a29bcd5370e263c35b265e60f3b8435a7cca4b264b01c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 6.4MB
        • SHA256 1e19ca604a4735f42e10726d4c36e84f0af530e2ce38bef08f72019f470777f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 6.7MB
        • SHA256 8310c8f6054c60d6f63349d9d7570031d5a522cf754e1b388b63a574c11892eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 6.4MB
        • SHA256 1b453a897193e989574364fc9715efc5d9cc17a14cd13385fd691aff5c7c5090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 6.4MB
        • SHA256 7aa3c322ec67e9163efd87d7e6f420b595e5ebf7bfa30c4df9fdad2bdd8a97c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 6.5MB
        • SHA256 08e6119b948b7ea211300ddceecc8b738749c7919ca37c45e500cda15824d9ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 6.4MB
        • SHA256 a22f7a953c4123c7112eb26e5a94e848990af7d0c631c39257e22cb0310cac0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 6.4MB
        • SHA256 4966ce86d29c445425a94f437803b2942993a19ce38077c202937542733ec72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 6.5MB
        • SHA256 dd452b25c8de7edb9afaee7c41594ac520c8d4ea7ba2a75741f7f3880c22ff7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 6.7MB
        • SHA256 3959b0cdd2f6f4eb7f89346a6c3f3dfb5b113124c4894dc44c16802d34da59ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 6.8MB
        • SHA256 5d660b3b9df0ac6d5d3d7d8d37824ea6177ba1a230025e59dfb0f0b27efee64f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 6.4MB
        • SHA256 44e67ad2f4ded7a4ccada58411949ae1e848ac436e3f79cc05eda805c1ff8ac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 6.4MB
        • SHA256 6fdcb13de414037ac7137a11f060a9c51879aa80574585a3da31c832e83368df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 6.4MB
        • SHA256 2dafc0f04e68770495d540380befcd6eb7d9bdd1dd5dccc64952e6269e8da065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 6.4MB
        • SHA256 32f97fdc24dfce4d87597defdb39c938c21874b170db945b7f2847a1cc6fcbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 6.4MB
        • SHA256 b632cab7b5950a1802f4a995ad4ca9a1c5ccbfa2978a7a781eeeda99bd7782c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 6.4MB
        • SHA256 5f431c227d48470f6e93e336a3c5d58bb32b00c7b0b57087d50713ad6fa41356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 6.4MB
        • SHA256 e7d042563984864ffddd8717c43bf5a1742f4d41d17f6c3a1594c2d9f1707965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 6.4MB
        • SHA256 e0c6f2040451e87abc656f8bd36593c628c899c5f65efc00395d70494f83fb13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 6.4MB
        • SHA256 627cbea10d904096150124c234898746b710dd7c9ce1b97049c10b40e4a5425e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 6.4MB
        • SHA256 38ac5a2c5e213e66b6b9a53a868e3317a89cd02d7e43e8ef5018904be2b31af5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 6.4MB
        • SHA256 7dbd49143788899a6bc9df27d45a8a6af44b7069252d89ed6d993c4f43b256ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 6.4MB
        • SHA256 83f26f5e209049aeb62f6f4c70f692e9e8b11f3664f2ee6d442097fca8a73655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 6.4MB
        • SHA256 7d091ae4acf3973a71916a2481a365cc6c6fff8728368bafb421497d36986b3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 6.4MB
        • SHA256 6e0c16f6588bb1bcc828eb941d0643d5e5c6dba45f7003ce13f302e992af8f87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 6.4MB
        • SHA256 dabbe79a5cf56fbc00279087a8481d4aa8d8dfb42bb9d867b9e5591f8250a2e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 6.4MB
        • SHA256 460b6c5ffbd441ff9aac40a61071c1fa536120190dc58deb021050a304217e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 6.4MB
        • SHA256 7564d791bcd2f55775860e52cd0f2caee2f67de618f468049ef5a6d5bcc13e63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 6.4MB
        • SHA256 d184697ff523c1ef8335f40284c6c9b7f1957a111dd58be34d74a33a6255dade
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 6.4MB
        • SHA256 2fa932ce82e07c43886deeb366ea3cb8cb69a02798bcbaa189bfccb46becbc79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 6.4MB
        • SHA256 c01ef93212091784b8a41bd6dd43e105ee51f466d145a8ce6358c8190caeabda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 6.4MB
        • SHA256 ef7f55b8208deeb10c1c7514422156dcac42b40004536183296fffc9197b22a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 6.4MB
        • SHA256 1dc6ed785d85d4a68ceeacea63a082b517fbc41f1d6d87f5758af9dba72b45c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 6.4MB
        • SHA256 ad2be3f8ee2a9f769c6f452329339b1e8b8f113aa8c7fcea4a3d6e6533734971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 6.4MB
        • SHA256 8b15c3ba4fadf19b970f5551e858a0fa10e630ca5ea89ffb278797c9c2170890
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.5MB
        • SHA256 688df47d8d2063f327b2c30a8c116097360042ab6587350bd519b58ae1223b23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.4MB
        • SHA256 0d2fe0a2548baf4bbf5c3ac9434613646558a8b5ab6e28862d3f6b38142ccc81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.4MB
        • SHA256 a1ed4b94fc75a450938c267028b82d939ccc93444ad881a14f080aeb35de1645
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.4MB
        • SHA256 a9ab2df275325832e15eddc3bd30935cb583adc079f68d59a1a2162d6f5468e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 3.2MB
        • SHA256 5e40b902da9a275a7a991395c45328ee52e138e1b85bf599c8c4c602164fd023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3544-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3544-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3932-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3932-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download