stormser | db284251396dbf41692069ad92e8d10b34ec46d9c13ea84de3dde43b08675c0e

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_1c1001324d76dad3e2cc21ac841c6f1c_elex_wannacry.exe
Size 60KB
Sample260415-rt2bjshs8k
SHA256 db284251396dbf41692069ad92e8d10b34ec46d9c13ea84de3dde43b08675c0e
MD5 1c1001324d76dad3e2cc21ac841c6f1c
SHA1 5681b3f4379089d395d6f8c1171f6d10019261aa
SHA512 ae9ce0cb8be8c98cac3434d6ee75955852acdd2c1784d17abb3f25eb9e7fa3cbc308a3a390188ebb4d404887954bfb5a63843f28b3ef024166d153f8c21da068
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwyY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroI4/CFsrd
TLSH
T1295308835BDE5CF2F791123108798AB9927B99C4910EBEDFBB90CD150037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b39e-3.dat	family_stormser
behavioral2/files/0x001a00000002b39f-6.dat	family_stormser
behavioral2/files/0x001b00000002b39e-8.dat	family_stormser
behavioral2/files/0x001b00000002b39f-14.dat	family_stormser
behavioral2/files/0x001c00000002b39e-19.dat	family_stormser
behavioral2/files/0x001c00000002b39f-22.dat	family_stormser
behavioral2/files/0x001d00000002b39e-27.dat	family_stormser
behavioral2/files/0x0006000000024f41-29.dat	family_stormser
behavioral2/files/0x0003000000024f7f-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90A28E40-30B1-4f19-B767-0FEF5128929C}\stubpath = "C:\\Windows\\{90A28E40-30B1-4f19-B767-0FEF5128929C}.exe"	{4110F152-7832-409a-904B-32941C82F782}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}	2026-04-15_1c1001324d76dad3e2cc21ac841c6f1c_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9FAF639-0897-4339-9DFA-E488BF982E89}	{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9FAF639-0897-4339-9DFA-E488BF982E89}\stubpath = "C:\\Windows\\{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe"	{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}	{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{296DB255-606D-4493-BE57-8CDAD32D354E}\stubpath = "C:\\Windows\\{296DB255-606D-4493-BE57-8CDAD32D354E}.exe"	{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}	{296DB255-606D-4493-BE57-8CDAD32D354E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8F82F04-2648-424c-BB24-686B4FD121B6}\stubpath = "C:\\Windows\\{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe"	{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}	{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90A28E40-30B1-4f19-B767-0FEF5128929C}	{4110F152-7832-409a-904B-32941C82F782}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}\stubpath = "C:\\Windows\\{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe"	2026-04-15_1c1001324d76dad3e2cc21ac841c6f1c_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8F82F04-2648-424c-BB24-686B4FD121B6}	{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}\stubpath = "C:\\Windows\\{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe"	{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}\stubpath = "C:\\Windows\\{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe"	{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{296DB255-606D-4493-BE57-8CDAD32D354E}	{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}\stubpath = "C:\\Windows\\{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe"	{296DB255-606D-4493-BE57-8CDAD32D354E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4110F152-7832-409a-904B-32941C82F782}	{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4110F152-7832-409a-904B-32941C82F782}\stubpath = "C:\\Windows\\{4110F152-7832-409a-904B-32941C82F782}.exe"	{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe

Executes dropped EXE 9 IoCs

pid	Process
6072	{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe
4316	{296DB255-606D-4493-BE57-8CDAD32D354E}.exe
2992	{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe
6044	{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe
5984	{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe
3936	{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe
2856	{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe
5500	{4110F152-7832-409a-904B-32941C82F782}.exe
4632	{90A28E40-30B1-4f19-B767-0FEF5128929C}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{296DB255-606D-4493-BE57-8CDAD32D354E}.exe	{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe
File created	C:\Windows\{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe	{296DB255-606D-4493-BE57-8CDAD32D354E}.exe
File created	C:\Windows\{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe	{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe
File created	C:\Windows\{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe	{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe
File created	C:\Windows\{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe	{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe
File created	C:\Windows\{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe	{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe
File created	C:\Windows\{4110F152-7832-409a-904B-32941C82F782}.exe	{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe
File created	C:\Windows\{90A28E40-30B1-4f19-B767-0FEF5128929C}.exe	{4110F152-7832-409a-904B-32941C82F782}.exe
File created	C:\Windows\{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe	2026-04-15_1c1001324d76dad3e2cc21ac841c6f1c_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{296DB255-606D-4493-BE57-8CDAD32D354E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4110F152-7832-409a-904B-32941C82F782}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_1c1001324d76dad3e2cc21ac841c6f1c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{90A28E40-30B1-4f19-B767-0FEF5128929C}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5644	2026-04-15_1c1001324d76dad3e2cc21ac841c6f1c_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	6072	{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe
Token: SeIncBasePriorityPrivilege	4316	{296DB255-606D-4493-BE57-8CDAD32D354E}.exe
Token: SeIncBasePriorityPrivilege	2992	{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe
Token: SeIncBasePriorityPrivilege	6044	{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe
Token: SeIncBasePriorityPrivilege	5984	{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe
Token: SeIncBasePriorityPrivilege	3936	{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe
Token: SeIncBasePriorityPrivilege	2856	{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe
Token: SeIncBasePriorityPrivilege	5500	{4110F152-7832-409a-904B-32941C82F782}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 6072	5644	2026-04-15_1c1001324d76dad3e2cc21ac841c6f1c_elex_wannacry.exe	78
PID 5644 wrote to memory of 5000	5644	2026-04-15_1c1001324d76dad3e2cc21ac841c6f1c_elex_wannacry.exe	79
PID 6072 wrote to memory of 4316	6072	{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe	80
PID 6072 wrote to memory of 5356	6072	{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe	81
PID 4316 wrote to memory of 2992	4316	{296DB255-606D-4493-BE57-8CDAD32D354E}.exe	82
PID 4316 wrote to memory of 4996	4316	{296DB255-606D-4493-BE57-8CDAD32D354E}.exe	83
PID 2992 wrote to memory of 6044	2992	{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe	84
PID 2992 wrote to memory of 1460	2992	{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe	85
PID 6044 wrote to memory of 5984	6044	{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe	86
PID 6044 wrote to memory of 6008	6044	{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe	87
PID 5984 wrote to memory of 3936	5984	{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe	88
PID 5984 wrote to memory of 4232	5984	{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe	89
PID 3936 wrote to memory of 2856	3936	{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe	90
PID 3936 wrote to memory of 2136	3936	{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe	91
PID 2856 wrote to memory of 5500	2856	{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe	92
PID 2856 wrote to memory of 3856	2856	{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe	93
PID 5500 wrote to memory of 4632	5500	{4110F152-7832-409a-904B-32941C82F782}.exe	94
PID 5500 wrote to memory of 5460	5500	{4110F152-7832-409a-904B-32941C82F782}.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c1001324d76dad3e2cc21ac841c6f1c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c1001324d76dad3e2cc21ac841c6f1c_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Windows\{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe
  C:\Windows\{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Windows\{296DB255-606D-4493-BE57-8CDAD32D354E}.exe
    C:\Windows\{296DB255-606D-4493-BE57-8CDAD32D354E}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe
      C:\Windows\{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Windows\{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe
        
        C:\Windows\{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6044
      - C:\Windows\{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe
        
        C:\Windows\{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5984
        
        C:\Windows\{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe
        
        C:\Windows\{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe
        
        C:\Windows\{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\{4110F152-7832-409a-904B-32941C82F782}.exe
        
        C:\Windows\{4110F152-7832-409a-904B-32941C82F782}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5500
        
        C:\Windows\{90A28E40-30B1-4f19-B767-0FEF5128929C}.exe
        
        C:\Windows\{90A28E40-30B1-4f19-B767-0FEF5128929C}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4110F~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8F8F5~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7C7A7~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D9FAF~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B8F82~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{72C2A~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{296DB~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{72AD7~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{296DB255-606D-4493-BE57-8CDAD32D354E}.exe

Path C:\Windows\{296DB255-606D-4493-BE57-8CDAD32D354E}.exe
Size 60KB
SHA256 a323f23d1aa7a477394aae655dd74d67c6ec1aad992b6bf5040e09659b24e873
MD5 6677e6b5a99df85a859672dfbe9fbcc9
SHA1 f5cc719b5410292edb1aec1211a2e8b886b0c9bb
SHA512 b4d6058dcb37712803ffa8b32e65fddbc5c47d820243251d8d7f6e2557788d65410af712d6efbe64702abefe4b0ecdc2b204e64249a96196319da8ef2536803a
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwEZY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro+4/CFsrd
TLSH
T12F5308834BDE9CF2F691123108798AB9927B99D4910EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4110F152-7832-409a-904B-32941C82F782}.exe

Path C:\Windows\{4110F152-7832-409a-904B-32941C82F782}.exe
Size 60KB
SHA256 2371f06eb3db86d814fb0d1e1757e760ce1e37b0f1ed6ffb9ed282c85befb4cc
MD5 7c38e9620891e0e6b217f1fd873754bc
SHA1 4af5175f5ad218b0a355c8e5100c748cca7bef86
SHA512 b94920d2e99d7cf2a01ccec12d9ab2b2a0f04811b59c135f1d89f12624e53edd1fdc1855feca072c46fa9c8ece5138ee62e05daa2a077907dcfe71591bc9cc0f
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwOY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro04/CFsrd
TLSH
T1B053F8834BDE9CF2F691117108794AB9927B99D4950EBE9FBB90CD150037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe

Path C:\Windows\{72AD75F3-6B03-4aa1-9DBA-F5C6040AABEA}.exe
Size 60KB
SHA256 c279e012d53b15abacb220b225a25ad5b9edcce103cfb9af05ce9007281ac9fb
MD5 aff5b0fab4f48d085906675e07e12347
SHA1 11cc63c270269bbf83862a7d38b4fe513ed64653
SHA512 511c42b8df051959e4de910d24ddf1c4fa2bcadb7ec185b2434fb9231e3b13e6d9baf668b6c55ebf99831d4465e2a52a267ab3cf803de7fd78ce376420c01098
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw9Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrov4/CFsrd
TLSH
T1375308834BEE5CF2F6911231087D8AB9927B99C4950EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe

Path C:\Windows\{72C2A650-1AD7-45dd-8EF2-2E972F8BF567}.exe
Size 60KB
SHA256 c5253bedea63ece1f125adfc414b6576f767de4d2fc4efe7d120145911fa70ac
MD5 12226116ffeaca83f209fece2fc7cf5c
SHA1 559fd878fba5ef2df4ed6501933acdeff809f1fc
SHA512 bc0c23424cb58db052d616f34445127966181c114e763c727cb500556ab53cf8ff72903196422284d7a3c14610c0b1192834aae52082d0442111a05add29092d
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw0Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroC4/CFsrd
TLSH
T1D45308834BDE5CF2F691113108798AB9927B99C4950EBEEFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe

Path C:\Windows\{7C7A7127-272D-4fa5-A47F-83DEFD376A6B}.exe
Size 60KB
SHA256 383571ec423ee0bf0f4443454c93cb76fdd7d236ad47e7bec9a571f12512a5f7
MD5 4eb11f91d683e2d527af095be0de7b0e
SHA1 8c01fe0926dad3706e10041b26eb9ec1a83ca9e4
SHA512 7f115f5a937e68a3320892d532b367ed0df78eb15e56c91ea49806db808a87819b916a46754a5370ab12293c06e9acb844309829ccff2701a06a1fef301316f6
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwfY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroR4/CFsrd
TLSH
T1B75308834BDE9CF2F791117108794AB9927B99C4910EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe

Path C:\Windows\{8F8F53AC-6742-4fe5-84D5-64FF3CAE3E49}.exe
Size 60KB
SHA256 5b8f2aefd09530256ef2a63a691504cef932c7dee6d6ab27490b64a04ed09291
MD5 e85ebae0dd0511fdf9c3daa387a994a0
SHA1 ef4d040ca0297e70ad2e4e2661ee7b2f8aa8dbbd
SHA512 3fd41ecc6052ea788e7922bd98c848e1c68064fd2f610ba3c62e29018b1f361fc30ae57cf039bd571a36f94e3ef414be489661c1bbcb82fbcc782aad8930d84b
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwL5Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroLL4/CFsrd
TLSH
T1E55308834BEE5CF2F791127108798AB9927B99C4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{90A28E40-30B1-4f19-B767-0FEF5128929C}.exe

Path C:\Windows\{90A28E40-30B1-4f19-B767-0FEF5128929C}.exe
Size 60KB
SHA256 1d25aa3a6815589e7c55d34d123e6c8767a25c46ce22e78eabbbfdae44e03629
MD5 370c235df94d176bf4b5f4422de60f7c
SHA1 1d83f45cd51fa29bdf27ad8f22af89f4da596a1c
SHA512 c0ca21843a73a839eb216743d8127d789992f91fb797e0884299d4c68fa70637340e082769b2b4602348183bd270abc6b6eaca91e4d7f2bc7581f13920ee108d
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw/Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrox4/CFsrd
TLSH
T1A553F8834BEE5CF2F691117108798AB9927B99C4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe

Path C:\Windows\{B8F82F04-2648-424c-BB24-686B4FD121B6}.exe
Size 60KB
SHA256 8d3da2511babb4735c55674a8b1e8dc28c9972758de003f6bef1378902416059
MD5 538e09dcb68a472fc2492a599ad8fc84
SHA1 db227289ff3281338d3aba810206ff978b121045
SHA512 2108d861d9cb71d2257aa795c721acd79400e1c759f9f1bae63bf8b81cbe5219fedc5de99115d2ff77edb615784fc4b45b070ff472e589897be3656e955e61ef
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwtY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro/4/CFsrd
TLSH
T1055309834BDE5CF2F791113108798AB9927B99C4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe

Path C:\Windows\{D9FAF639-0897-4339-9DFA-E488BF982E89}.exe
Size 60KB
SHA256 b5bd6ffbdf294c45d513c003c667a511cc9a7cb83d49ab00eef7919f9f96a049
MD5 3e5e0d34db2ab3ada350e313373827bc
SHA1 c789d0c81f2e2c82de2130f949aa726b9c8bf152
SHA512 35dbc7c5bf52a9f8f24fa919a194a594b26533025cab9ba340f62f54a7b92cd045581abeb158620cc18335a8c2512fdc31109ae354b4f0af71e444feeb016e4c
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwPF5Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroNL4/CFsrd
TLSH
T16A5309834BDE5CF2F791113108794AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads