Overview

overview

8

Static

static

3

2026-09-30...ry.exe

windows10-2004-x64

8

2026-09-30...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 08:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_b1c676893e68eddbb827d62b9d31628f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 8.8MB
  • Sample260930-kfcmpsseqb
  • SHA256 523f082b5b21e938aadeb7cda1420a13b592079777d47be716b0698a3d0ee444
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_b1c676893e68eddbb827d62b9d31628f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_b1c676893e68eddbb827d62b9d31628f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4552
  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_b1c676893e68eddbb827d62b9d31628f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-09-30_b1c676893e68eddbb827d62b9d31628f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4776

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 9.3MB
        • SHA256 3b74312e31c869100468a8b964c3c8b962dc90af568be9f0b7491b9f11f27698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.7MB
        • SHA256 b4b1029a84236dfc7ce63c55321973d50bebe9576106e460677666d490a96d82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 18.2MB
        • SHA256 03ce9a5bbf6efe345dc3ee20752d978e60104e569de3bce059cf9b43c0b5a78b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 17.5MB
        • SHA256 b67902d91cf06e3f3d361c3d7c3e35fdfc326c810c6130f8f2d88e8b1d871b0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 17.8MB
        • SHA256 02c27698aec8be87d6f268771386a457648a0ad9ff3f82e725db1549bb340d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 17.5MB
        • SHA256 6d435703bc8a6e5449b598774e8d6718a272f12860bf59ea3abba069e6a54264
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 21.6MB
        • SHA256 d13a26a7c74a04999c8592c4a01a7e2614b9e51ab327fa04b3c3f775fff9ccf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 17.9MB
        • SHA256 adf5e3f0e441abe0c4f312507dfc095d91488eba7f0d80d41b682211a7cf49ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.0MB
        • SHA256 6c332e52cb9f67f29e7cac36751c33bcbc6ab0d829079856a1577f68dd15d06a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.6MB
        • SHA256 9bddf36de229fd082d49fac6854387d1f0744720ff308ca1a705ed23d5fae4f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 17.6MB
        • SHA256 d03a95a724a0a3c72e9ac26d12382f5bfaa470645382ce8bed4901d8b3d01ff4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 23.6MB
        • SHA256 5c6992d571c3c387af95883ec3b075bda03e69a15a909a8e4433eafa91b5395c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 19.2MB
        • SHA256 026a4246af053d4e7580b40d44551c9204936c4561c296397bc0cbf536186e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.0MB
        • SHA256 6a9ea94f4fb49e508d237ced6f663cfb85c1b9ef5758eaf304d7536544b19d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 19.8MB
        • SHA256 c98b33f8f725edf10def414ccd9f2e94f182eedbf6ddd86c44cdb40abe3a1832
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 19.1MB
        • SHA256 f56b360a0a04a4c6f8f1dd04ff5a59278a3e2fb993ec214ddd1dc61405a5dceb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 19.4MB
        • SHA256 1e41642e18f0ab0a544aaf81e3573bfde5ab5d84eaa6daff879d3f046f6aa52e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 20.6MB
        • SHA256 03dda5d5f21054bfcea7dbe5e1d31ed78cf90da48a2c23ce4d38263fb6eee6b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 18.9MB
        • SHA256 7b254a6f4d171e49e8c4eb8488e4a45b13ea7e060c118cbda7bca4928d35d565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 17.5MB
        • SHA256 d6dc4c5c867eaeb67e436f67f72b07e9895cb9196578d0a6cf0ce14d7a6edb1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 17.5MB
        • SHA256 b691e82c0c4795c03f06f0c51b63f23189b6b36cc56741bac3bd71a16a7bf068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 17.5MB
        • SHA256 5c33d068d98f6f2636c693b7c9c2b10f0908112e12e0e69b8b1d6996f40c6d41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 17.5MB
        • SHA256 1a13dd3b6ee06b08f9aa15de4cc5cfe211156a9bef14a8ca15bc1b3b67a17277
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 17.5MB
        • SHA256 82e359e6267a219915ebcfd4ccb5c1c7503037d2657119e7d1d69bae09da0db5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 17.5MB
        • SHA256 3e16237e811f4a7e4eb3463023d50d96383b2318274b8f5a81a6021bcf56d3f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.8MB
        • SHA256 771fd9c32809652a488e8d08a29874d7ee0b0b548aaedfd3a08e7e83956a7f4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 17.8MB
        • SHA256 543dfbda12a8bdd97d38437f198ad1115bc5def7b16ce320f659c3b7f240cffd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 17.5MB
        • SHA256 7329f822176e4adf29874d79e444918ee263329923bee2b56e20ff237d41a2d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 17.5MB
        • SHA256 d0c29eb1fd23ec1f3ae50bf4f7caafc8e7fc561150a85310eca9bc54e65b5aa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 17.7MB
        • SHA256 e59490b47141033ccbe6bdd283b0e1bf0411720a7cc9989a162903302175c589
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 17.5MB
        • SHA256 d6c0430918d68229f89d22d45c0f01fb56f189b3e628020b7e2b56b09ddfd571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 17.5MB
        • SHA256 16c99b74fb80232be3f9cfe741b7a1bb5493e1ae66ec0137c7d9083762304b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.7MB
        • SHA256 c00c1ec7fcab649b4ee597df4b653da06e2d4e5b7e07158ac7f8ec875381ed57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 17.8MB
        • SHA256 772dbd2c80e0e6e4533c3feead11720be098fbc25b637a488abc75e0e172714f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 18.0MB
        • SHA256 92951eb9c759ec82d08cf72fe96d662ac0ffef1654aec86c4a40dff9696bb7f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 17.5MB
        • SHA256 28458360011adffcf2fb2d547710110bcf77bf653e9f368bbc50d8afd2f55673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 17.5MB
        • SHA256 f18391f938fe01a8f2166fb387194cbfad282e55a190e5d0104883f3fe7030c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 17.5MB
        • SHA256 ebba479c40b78e157724bf95dab909bf4c090c39c17ba9a66cd4d18603b2c011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.5MB
        • SHA256 f3a5e42eeb77539a87504a676bc82cdbcbe9a1819ae12515d3804a013a2e1933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 17.5MB
        • SHA256 e3e61b48e00358fda5b5d35bece9835adb17ec6ac887945564681e4d241ffe7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 17.5MB
        • SHA256 4f6918a823877c8efadc545d9141a51ed710aa1b3f3ec779b713871389a6f5a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 17.5MB
        • SHA256 f8a5d2b9dfc94592520cc37db0c12db3f5a152f29216d396fcd65bb21ef2cc86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 17.5MB
        • SHA256 f4b0abaa484b75ea158e6ca3fe5245f9433d425a3996a591bc00980ec8de8b8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 17.5MB
        • SHA256 873fa6fa0cdd66a1dd6d06df51741bd939389838aa756529b855506a4bb84d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 17.5MB
        • SHA256 0f5ac62446590e88816c726778a227e27395a9743baa129501a02bd1a8b6d7ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 17.5MB
        • SHA256 21dd5fbef9fdc03d36238d7865b1ecd78e93c86f05ca03b343f993a585f400d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 17.5MB
        • SHA256 a64c5734b516592d20c12cd3c02886e831beb88b7fa811ffd82198c23f6e3574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 17.5MB
        • SHA256 8051c718612f81bdf408d92c5571792fc4b1dbdb2222777e55b60a7206ed9328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 17.5MB
        • SHA256 82488227847492853db87a99544d362ec5a5a0a6a992bc520fcd12e4256384d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 17.5MB
        • SHA256 a9c0d5f96b0587a09bd5fc7ca976bc94a412093e79c8359cdd9968eada95294f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 17.5MB
        • SHA256 e4058ed4230209b937b8ed37842bd3ccef3ee2b422f5fb7392d7c45bd6870a03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 17.5MB
        • SHA256 0bccb59f245afc71902a99020cd5fd76441e8a946fe90050be828bbd138ebf2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.5MB
        • SHA256 8d355b7396b800e29c53482451a333fe2c7468dae4436f38b452c5b61ea16f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.5MB
        • SHA256 e9f58eca4d0cbf54e0d6e757d348a42017c0f6cdb08a7f72c96e5953a2926d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 17.5MB
        • SHA256 8f789754198770d40584cdbf31fe52f5cd93d96a06b70616b69b85e4cb27b86f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.5MB
        • SHA256 dcc01d448a8e45c484c37224992cc9845a5dc85aea25e51ea3f454ac5f11dad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 17.5MB
        • SHA256 31f2343890019c34eabf272f72a18b38bd7cabfeb05318bcd34b0b42bd34340f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 17.6MB
        • SHA256 717c791c799443dc289b37fab711a82ed5a6e2ddd83d03a7220e9622f16525ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 17.6MB
        • SHA256 208d5f363bcaa8227b0dd42dbfe15cfe5150d61bab16a6e41089fb7211af7511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 17.6MB
        • SHA256 a284438a3d4e76724ba584ee775cf42ec80a8aaa0a4d1fb3fe1d96555655e08e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 17.6MB
        • SHA256 d0a707986d0316a5cf84adf6a9e82ddaf4aea40e95d859213e6126c3354d5e4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 8.8MB
        • SHA256 523f082b5b21e938aadeb7cda1420a13b592079777d47be716b0698a3d0ee444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download