Overview

overview

8

Static

static

3

2026-08-21...ca.exe

windows10-2004-x64

8

2026-08-21...ca.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 13:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_dec1effc41e01b980ebff9893b9ddeaf_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
  • Size 10.0MB
  • Sample260821-qf33jsbe79
  • SHA256 bdb15251dcc3ad9caa2bad1be31c54773f095c9815db70a20f6fdc6bfac1f3e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_dec1effc41e01b980ebff9893b9ddeaf_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_dec1effc41e01b980ebff9893b9ddeaf_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:936
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_dec1effc41e01b980ebff9893b9ddeaf_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_dec1effc41e01b980ebff9893b9ddeaf_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1720

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.7MB
        • SHA256 5c806eaf8c49d9e87a6f525ee26596f1595175e77073d1313528fa8ac32cfefd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 20.1MB
        • SHA256 a28c9ff370b4a35d555f231ce80de0c6f0cfd2d0f1e6a8fdd213e6b7304dbac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 20.3MB
        • SHA256 b4169aca03670e915d834913bf9fa858ecb9c70ca84d1ed816747012845f47cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 20.1MB
        • SHA256 e4a01d8408e3be807dd99dc9dbb35a0947812dd3b203bf991ee62a627da80a44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 24.1MB
        • SHA256 0cf3779ce229bc558beb3251817ed4d1af172635cf1a81ff1481da6c321f7a09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 20.4MB
        • SHA256 d346233076f0f3610ac6f1885225c204f1b18700c844d1ebcb57c578fc96fa44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.5MB
        • SHA256 bf1ddb0d4ec9672c2ad5f6d4e00a0645236220bcd5321e6bd9e8a2fe0e3a68a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.2MB
        • SHA256 ea014c33c0b8dc558e768f6f26bea1e97770dded74d2b5e4df38b45357f7a974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 20.1MB
        • SHA256 5eeb13d6fd6b4b8d117d116a44ea8c60dec3c73e6bd7d578e8757a68e4da44d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.1MB
        • SHA256 6b811009c0bf5a8576ed7deaedbdb6bbda5d5b502aa0fe9eb92d5f9c18994b73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.8MB
        • SHA256 526e2cf6f551b888855615acd1b5a65fb262f258aef283157bd4b7291a603c02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.5MB
        • SHA256 d613cbb6844b7e36d617c997704d6bb6f0b5ed5ad6cd6314c5a6bca385970dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 22.3MB
        • SHA256 7084c6fffeb831dc38e6831c1d695d6ed81788fe0aa99d9a76576b92548e619d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 21.7MB
        • SHA256 bbfb314e54c1b38d6bc5ccfd6aa04954a75ca0c8a4be322a903b1572a3628b7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.9MB
        • SHA256 86f87f819a864d1a3f35368b732b9197c55438a6c89be033a5da5c2a6e8e0ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 23.1MB
        • SHA256 41ff0dae4cb798536b4dcfe909cbf64f694c9c9c8396233f6fc07e223319134e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 21.5MB
        • SHA256 9326ab907eac88a5c70b64bdf468facb33eba6ec3bbbbcf4e1237fa6a306c252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.1MB
        • SHA256 b883abaebe2f3013b32735f930a91014522fc0110ed79db5f958d723b554e779
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 20.1MB
        • SHA256 ff9133ca6e500d2dcb8aeec2d48b427a3270684d2c388e4f17092a6536d4905e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 20.1MB
        • SHA256 6a7f66fe2af2ea438dea019efdf0d446fa7bf0a234df81ed1ee20a209adc5859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.1MB
        • SHA256 6187d47415e1698a79ac0facd397c99158fa45c055a1b4fcb195c78a5c4a415d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.1MB
        • SHA256 678c2ad8400a7326ba783f87087365e09af7116a641cbdcd16c68de87b3bc3f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 20.1MB
        • SHA256 482937b771663dd217fb1bfbf200b6f841633fc4c680e5a4c16fdaa40df6b4da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 20.1MB
        • SHA256 ec7b02776fd9b6c87910e03bdebebae08ffab8eb211324146947d9eba2aa67ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 20.3MB
        • SHA256 ca282c2e477a1dfa83e425243a8385cdfbf3ee0e47a181c83070c1ca333379d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 20.1MB
        • SHA256 ae237237b0c166471a89f409aa23b85282d31edc7748f924b0cbe579d808794f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.1MB
        • SHA256 3cbfdec5c150cb2f9bf92d2372878e8c38672fb80086423ad67ccdb33bf8e548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.2MB
        • SHA256 679a4042f6d43dcc44d47456fa1dfb76c5ff6a67ba487b6d5654f23648c822e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 20.1MB
        • SHA256 c253e54f62661634c8ae69cfa0eeba35508f579543f0057337641279246cadb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 20.1MB
        • SHA256 542179051be9ce80c9a9e37eb92da1634535b488105bc2d499194b39c05cf5ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 20.2MB
        • SHA256 b9189d0011e747cf438a309979e540b2830ecf0a611075d602091b59a85e1a1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 20.3MB
        • SHA256 532ff556842afd81b0d2762019f94bb1f029b5a25cb55a4cae73a796103dcfc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 20.5MB
        • SHA256 0bce00fdc440d722fd123e328b8adfb4459b20c1b84a56b269a9d13aa0582986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.1MB
        • SHA256 999a34b20bfd6e669914677905c6132aafe49a179d9783007b3d3dcb5199179b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.1MB
        • SHA256 b392eb4f48a7f640edc75f58e6f357d0f6d4308de9c2e5b9f667963b4d12efcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 20.1MB
        • SHA256 de72af51d23dc66f3057a64877a301c28666957da338830133166014c0d7da8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 20.1MB
        • SHA256 8f27d85e47d9c364fc54ade6fe1a4ee8cbb35471312c15b9b8720b1b9d583ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.1MB
        • SHA256 1e8c73edcfa0ac48f4db47b6821955dc87751d70de32be0afe0f8f195e0c026c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.1MB
        • SHA256 f0da7fe3f9bc7861cf8e756952230a10c3dbd2e92ecb99bc7e358446f131bed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 20.1MB
        • SHA256 eaca32a3cf0eee2e52f885af21656d61c0c387f460ade9c6a68d9b69e225f29c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 10.0MB
        • SHA256 d3377e40e41d3ebd34683b36ec97bff003f8fc057d585158ade8772dcbb6b65e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.1MB
        • SHA256 7f38609153fa8288f52e65398a48072e95ad2e327f5b02bf76830ed8b3a6367b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.1MB
        • SHA256 875af6a78032ed5d8a4725a6993114d8afe259b7533e4852cb20d9056bd8fe8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.1MB
        • SHA256 b71533a172033ea870d6c2e60f3beac98f5a0541cccaf1caaa5c3229548a4527
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.1MB
        • SHA256 e3727f485ce450bb94828b1b0c548691c0c6a143f9de2e4644fbb866fbfec098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.1MB
        • SHA256 1eadd491a6f40aae85a0ffaa24d6bf9ba8a2a9bc0d17265f53f1e65340b01d7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.1MB
        • SHA256 b6e9e104c80ff11e794c389ec09bfed34c799ea14b2302838d0d320fe5f3f42d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.1MB
        • SHA256 643d49d67b44d96da3112a64bca8cf403a9cb61b72af615207fdf116ecdabd3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.1MB
        • SHA256 784a6f3c9b5c143fdea411b6abb2dec61e0000bc4a434a3e7728151619139b11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 20.1MB
        • SHA256 4fb0be466f68f2902518e9c1fbaf10c95e36c65eb5523846cd59e8ba388eb1c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.1MB
        • SHA256 e49f64caa63d988a62260c48887e99c5f3f32084a72ac8e6da026cfee77caaa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.1MB
        • SHA256 3f832ee8c201e6beeb492a1a2f5bc06d12c65c2646d75b2afdc5c9f4c06ebd76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 20.1MB
        • SHA256 2d947b67cfb99b5df7c54f2056caad8b0f7b49349a0431bda6e6292972350416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.1MB
        • SHA256 ea2ef84c8a01f8dc52b2a9af7c446e8ca37d0a34839e545d9cc8001fd26e0201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.1MB
        • SHA256 af3538c1d29c521a552cd801328a546a867949490fa3bf9bd4589cdb425372d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 20.1MB
        • SHA256 a8ea6c10d370feb1eabb0788c1037b8955dad953acd6eb278bd432aefe673ea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.1MB
        • SHA256 a45c4077f26f5f714c22bdac4327d95efa6e4b593304cfb7dcba071b794755b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 20.1MB
        • SHA256 8079d3f55cebd23fb16b42eb19f7fc3d08181a3c7decba458aca43467fdb88cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 20.2MB
        • SHA256 b0082d3346841a4b1040119efb312301e23a2af7e472d695abb8f3e9f55d25aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.1MB
        • SHA256 58c0645a2f10bf7e63fdb02fba6ec6f229783d0b3a2c5c2965069c1be00c5a95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.1MB
        • SHA256 91fa6c2376fbb8e011e1ec8193ee49e34871a47a9a35e144fc3472d1ce5dac50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 20.1MB
        • SHA256 c528ca12179851f79def44f03c0f060c9562f8c0b2fe791164cc8301292eccad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/936-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/936-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1720-19-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download