Overview

overview

8

Static

static

3

2026-08-21..._i.exe

windows10-2004-x64

8

2026-08-21..._i.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 07:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_b67c71b9528276d46100e481b9d23105_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
  • Size 34.9MB
  • Sample260822-ja3fhaee53
  • SHA256 ba07e84a8dacdc4234febf42465c4eaa7305334d4e8499008c987d7b0501dfdd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_b67c71b9528276d46100e481b9d23105_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b67c71b9528276d46100e481b9d23105_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4236
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_b67c71b9528276d46100e481b9d23105_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_b67c71b9528276d46100e481b9d23105_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3672

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 34.9MB
        • SHA256 ba07e84a8dacdc4234febf42465c4eaa7305334d4e8499008c987d7b0501dfdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.2MB
        • SHA256 cbd1b701e06dc82904aaf245854c9aa1a2b978c8797debaebf1b6e6b032a5ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 69.8MB
        • SHA256 442552adbbd8d03ee4e8935aa152ad49109a0c670d88b4b533465a5a32ff5f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 73.9MB
        • SHA256 db79f4b0302ebc023a2071905b114c1185e6279b29bd2857f27befaf88573a0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 70.1MB
        • SHA256 223b07753ffc523317a690873f7f6dd62f5c1f13525915fea18e39fdd189a739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.0MB
        • SHA256 296436de47c9b3ffdfaf4ea9a33df58e18dd7d029ff738a689174805f2d0a26b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 69.9MB
        • SHA256 6b42c32e326af70254e25e3684f1355fa08403fcd7be4e1354b4c86211654e7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 75.8MB
        • SHA256 39e07c3224982808f0abefe6b06f17d1bd94e6869993d5cc2d7d9c02bb70a743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 71.5MB
        • SHA256 643f6c6726b02425c8e9a022445db5228c0570ccec2aa6fb500f99b3e103ba4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 73.2MB
        • SHA256 ae184d8a9e71c75fe36afe9a69e50e54b29d8e88cbf8591fbe7834142a2db740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 72.1MB
        • SHA256 477205260983008ce748596ffb3efa5a3171c628d440554542b339484a066810
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 71.4MB
        • SHA256 9d0c280a4d4d476aa2187bed845fb5c09e8335511b92639d3c36ff520ec03ab8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 71.6MB
        • SHA256 01e2d54e814dd7b249ded544a810cc3dd76d250ec3c2a86a2760e0ee7d312844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 72.9MB
        • SHA256 354dd8f1ee1cc5e2f47b7931f66a048ebf391dc66744226024e47741cfae3da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 71.2MB
        • SHA256 b2904921bcc37838747c896d0a7c0c01145e696b008f104bce7fbebd7c6ef72f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 69.8MB
        • SHA256 d6de4725183235c9b4c930ae235af3bf10d88e607c3049ab239b9bb00eada20b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 69.8MB
        • SHA256 a70d4539716ae94b5195cb3cd134ead90cf21e257cccd7f21e99a866c750fa86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 69.8MB
        • SHA256 a8215d408c4252225fddf6b3a025d4ddf282aedc912b62bd608b5419a11d493f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 69.8MB
        • SHA256 41f64e9617867bdcd2fcc05ef9669e6ad1c2a1cd4d6e579bc987e0c512893a26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 69.8MB
        • SHA256 b3e7e314887047216ecc9caaa373156c729a6d3c1d3a8cfcf4431aff6bf6f01f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 69.8MB
        • SHA256 da269feae84f90e959790b0814d32c2151bf03f599137dd7d290cf2d007a7e00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 69.8MB
        • SHA256 ceeaf326b42aa312ae681e20a3bdf65d9faf9201370294f43aa1a859a231e6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 69.8MB
        • SHA256 9a7adc9ce6e2efc06577d4254f8d0f6804cc24a592c3c8364327b65c841f1f1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 69.8MB
        • SHA256 69497b21d38fc20ed2c8302c341f006a2bb8a5814f22fc3dcc16385b5216d8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 69.9MB
        • SHA256 a1ec95dfce01649d1116ce0794566c6486380d626110c817d8e545f34848900e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 69.8MB
        • SHA256 cdd1834ff180a6cb263bdd08a0d7bce375790d6575357d82431547b399da8bd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 69.8MB
        • SHA256 a635a17ba28d029f67a60c3144d84f8071c41203cad0305d4169345a7a1cca91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 69.8MB
        • SHA256 3d030c063b15449a53dbc0a6b6f85bf707d5d7bc1b96c9c120966a6c2a863b1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download