stormser | b8d6bf0aeb97c6070f4dcd1a7c01b6fc26ce60d645b46b26f3555145fc89dc26

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_3ad87adfcd6cf90b182708e186f99a10_elex_wannacry.exe
Size 64KB
Sample260417-s5v5caev61
SHA256 b8d6bf0aeb97c6070f4dcd1a7c01b6fc26ce60d645b46b26f3555145fc89dc26
MD5 3ad87adfcd6cf90b182708e186f99a10
SHA1 454fe4f05d7438d414444c1cb590422f1a189992
SHA512 fe82343f045117a1a2509eed001726231f614847e89065ffa61e6dc96f640b8deecd888918e567a3012415b908fbae7a31defa0111c6f8e4aa063ce58fccc4e4
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroh4/CFsrdn0A9lsy4:vvw9816vhKQLroh4/wQH9lsl
TLSH
T1A1535C834BEE98F2F7D21131046D8A798277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b3f8-2.dat	family_stormser
behavioral2/files/0x001a00000002b3f9-6.dat	family_stormser
behavioral2/files/0x001b00000002b3f8-8.dat	family_stormser
behavioral2/files/0x001b00000002b3f9-14.dat	family_stormser
behavioral2/files/0x001c00000002b3f8-19.dat	family_stormser
behavioral2/files/0x001c00000002b3f9-22.dat	family_stormser
behavioral2/files/0x0004000000024fa6-27.dat	family_stormser
behavioral2/files/0x000500000002501f-30.dat	family_stormser
behavioral2/files/0x0005000000024fa6-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C66016CB-3498-4806-9AD6-D90D9EF42B00}\stubpath = "C:\\Windows\\{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe"	{792B1EEB-FC58-4370-990D-E5720604D657}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAE8187B-F429-4313-B231-0147FA597BBB}	{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}	{AAE8187B-F429-4313-B231-0147FA597BBB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}\stubpath = "C:\\Windows\\{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe"	{AAE8187B-F429-4313-B231-0147FA597BBB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}	2026-04-17_3ad87adfcd6cf90b182708e186f99a10_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}\stubpath = "C:\\Windows\\{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe"	2026-04-17_3ad87adfcd6cf90b182708e186f99a10_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}	{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}\stubpath = "C:\\Windows\\{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe"	{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C66016CB-3498-4806-9AD6-D90D9EF42B00}	{792B1EEB-FC58-4370-990D-E5720604D657}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C200689-0EF4-40d7-8096-EB6429B0E583}\stubpath = "C:\\Windows\\{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe"	{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4FA49EE-C5BB-4cc1-9A73-9AD3A232E464}\stubpath = "C:\\Windows\\{D4FA49EE-C5BB-4cc1-9A73-9AD3A232E464}.exe"	{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}\stubpath = "C:\\Windows\\{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe"	{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}	{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{792B1EEB-FC58-4370-990D-E5720604D657}	{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{792B1EEB-FC58-4370-990D-E5720604D657}\stubpath = "C:\\Windows\\{792B1EEB-FC58-4370-990D-E5720604D657}.exe"	{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAE8187B-F429-4313-B231-0147FA597BBB}\stubpath = "C:\\Windows\\{AAE8187B-F429-4313-B231-0147FA597BBB}.exe"	{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4FA49EE-C5BB-4cc1-9A73-9AD3A232E464}	{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C200689-0EF4-40d7-8096-EB6429B0E583}	{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe

Executes dropped EXE 9 IoCs

pid	Process
5964	{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe
4912	{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe
4928	{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe
4092	{792B1EEB-FC58-4370-990D-E5720604D657}.exe
3680	{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe
5676	{AAE8187B-F429-4313-B231-0147FA597BBB}.exe
5252	{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe
1228	{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe
3080	{D4FA49EE-C5BB-4cc1-9A73-9AD3A232E464}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe	2026-04-17_3ad87adfcd6cf90b182708e186f99a10_elex_wannacry.exe
File created	C:\Windows\{792B1EEB-FC58-4370-990D-E5720604D657}.exe	{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe
File created	C:\Windows\{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe	{792B1EEB-FC58-4370-990D-E5720604D657}.exe
File created	C:\Windows\{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe	{AAE8187B-F429-4313-B231-0147FA597BBB}.exe
File created	C:\Windows\{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe	{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe
File created	C:\Windows\{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe	{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe
File created	C:\Windows\{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe	{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe
File created	C:\Windows\{AAE8187B-F429-4313-B231-0147FA597BBB}.exe	{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe
File created	C:\Windows\{D4FA49EE-C5BB-4cc1-9A73-9AD3A232E464}.exe	{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_3ad87adfcd6cf90b182708e186f99a10_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AAE8187B-F429-4313-B231-0147FA597BBB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D4FA49EE-C5BB-4cc1-9A73-9AD3A232E464}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{792B1EEB-FC58-4370-990D-E5720604D657}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4168	2026-04-17_3ad87adfcd6cf90b182708e186f99a10_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	5964	{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe
Token: SeIncBasePriorityPrivilege	4912	{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe
Token: SeIncBasePriorityPrivilege	4928	{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe
Token: SeIncBasePriorityPrivilege	4092	{792B1EEB-FC58-4370-990D-E5720604D657}.exe
Token: SeIncBasePriorityPrivilege	3680	{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe
Token: SeIncBasePriorityPrivilege	5676	{AAE8187B-F429-4313-B231-0147FA597BBB}.exe
Token: SeIncBasePriorityPrivilege	5252	{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe
Token: SeIncBasePriorityPrivilege	1228	{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 5964	4168	2026-04-17_3ad87adfcd6cf90b182708e186f99a10_elex_wannacry.exe	79
PID 4168 wrote to memory of 5040	4168	2026-04-17_3ad87adfcd6cf90b182708e186f99a10_elex_wannacry.exe	80
PID 5964 wrote to memory of 4912	5964	{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe	81
PID 5964 wrote to memory of 5064	5964	{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe	82
PID 4912 wrote to memory of 4928	4912	{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe	83
PID 4912 wrote to memory of 5036	4912	{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe	84
PID 4928 wrote to memory of 4092	4928	{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe	85
PID 4928 wrote to memory of 3036	4928	{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe	86
PID 4092 wrote to memory of 3680	4092	{792B1EEB-FC58-4370-990D-E5720604D657}.exe	87
PID 4092 wrote to memory of 436	4092	{792B1EEB-FC58-4370-990D-E5720604D657}.exe	88
PID 3680 wrote to memory of 5676	3680	{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe	89
PID 3680 wrote to memory of 5840	3680	{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe	90
PID 5676 wrote to memory of 5252	5676	{AAE8187B-F429-4313-B231-0147FA597BBB}.exe	91
PID 5676 wrote to memory of 5280	5676	{AAE8187B-F429-4313-B231-0147FA597BBB}.exe	92
PID 5252 wrote to memory of 1228	5252	{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe	93
PID 5252 wrote to memory of 3308	5252	{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe	94
PID 1228 wrote to memory of 3080	1228	{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe	95
PID 1228 wrote to memory of 4040	1228	{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-04-17_3ad87adfcd6cf90b182708e186f99a10_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_3ad87adfcd6cf90b182708e186f99a10_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe
  C:\Windows\{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Windows\{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe
    C:\Windows\{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe
      C:\Windows\{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Windows\{792B1EEB-FC58-4370-990D-E5720604D657}.exe
        
        C:\Windows\{792B1EEB-FC58-4370-990D-E5720604D657}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4092
      - C:\Windows\{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe
        
        C:\Windows\{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\{AAE8187B-F429-4313-B231-0147FA597BBB}.exe
        
        C:\Windows\{AAE8187B-F429-4313-B231-0147FA597BBB}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5676
        
        C:\Windows\{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe
        
        C:\Windows\{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5252
        
        C:\Windows\{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe
        
        C:\Windows\{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\{D4FA49EE-C5BB-4cc1-9A73-9AD3A232E464}.exe
        
        C:\Windows\{D4FA49EE-C5BB-4cc1-9A73-9AD3A232E464}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4C200~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1EE15~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AAE81~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6601~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{792B1~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:436
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8B6D9~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{3B1FF~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B0F22~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe

Path C:\Windows\{1EE158C9-DEC8-4357-B6AC-2C6C8F7EC36A}.exe
Size 64KB
SHA256 687566a45b6b94e104602ed683b52c11f5a9a474c03980cdf71cdf3cf2a0b597
MD5 7692f480c60555b345685acb7cc3180d
SHA1 9c5fdad08e21668bbd01a4069f1a79c556a993a4
SHA512 4cc4bdaab8694ee71846fb1d41a3483d31bda095c85da7b45d4145517d3984be02e44a237e11598caedf53292e0e4bf715ee86b9f27eef55b8ff1bbfa7ee89ee
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroZ4/CFsrdn0A9lsy4:vvw9816vhKQLroZ4/wQH9lsl
TLSH
T1DB535C834BEE98F2F7D20131056D8A798277ADC4961EBEAF7F90CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe

Path C:\Windows\{3B1FF13C-BA82-4647-8898-5C3CE88F15F5}.exe
Size 64KB
SHA256 06d6fcff472c0d7f9cf4aa998f4833fc4f86ef80713238d31c3f6747a59b600d
MD5 432f8891fb944a08688ebc3615add3b6
SHA1 d601eac2da3bfeff85e5aaa5d567734e92a07a4a
SHA512 05f55f500cf3e774d0e30ced81c75a0fb4879e1f28f7403a3c3a415f96e9a3890d1b60a90e25c89c51f8f6c47b3f65abba03505514605e140ba48858c0c99482
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroc4/CFsrdn0A9lsy4:vvw9816vhKQLroc4/wQH9lsl
TLSH
T106535C834BEE98F2F7920131056D8AB98277ADC4961EBEAF7F50CE54007B191D83A147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe

Path C:\Windows\{4C200689-0EF4-40d7-8096-EB6429B0E583}.exe
Size 64KB
SHA256 287419ab225e8bea638ad64e738b86927ee956c49badecd1e4888e96a8841109
MD5 b21515fa54aa168fde4eca7d02eaee97
SHA1 4d3b507af1ff7bc42de0e9fbb53624e3583d1a8a
SHA512 daaf7d3924b12d3eeb571cd73d839940f224277f4e93fcefa605da7ffdf1941b098d97641df9e793972b1b32edcf71d3b04f1f56e762cd74948e80ae9884ff67
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro+4/CFsrdn0A9lsy4:vvw9816vhKQLro+4/wQH9lsl
TLSH
T1FF535C834BEE98F2F7920131056D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{792B1EEB-FC58-4370-990D-E5720604D657}.exe

Path C:\Windows\{792B1EEB-FC58-4370-990D-E5720604D657}.exe
Size 64KB
SHA256 b137030dc6244d86b8cb6128eda17b4b5de557ea22c6bb9616cfd0afbbd1abd5
MD5 06558b11a6e3e98d32057c3fbed5f211
SHA1 63118999a16886afa134d125b621c97ac1b60f7f
SHA512 6d5f10113e6c6203424ec3cb0e8b50f19cb388815790ff467b300eb00bdfa704fe0b0b575ffc137c271109467822c1686e17b10d62aafe433dc666f166a23e92
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroe4/CFsrdn0A9lsy4:vvw9816vhKQLroe4/wQH9lsl
TLSH
T17F535C834BEE98F2F7D20131046D8AB98277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe

Path C:\Windows\{8B6D9B21-B93B-430b-93F3-FFD50E30EAE8}.exe
Size 64KB
SHA256 37c9df1b7e06e453fe13e2a42828e7bf84c263ddc454776e39fa29abc968503f
MD5 0162e9847665f8403246c0b6853f9dcf
SHA1 104a0b02d24044e22fbc15cb73c572d78eaea0df
SHA512 4a84ae7e69ac19abfc233c39240cf1bc297ffae79eab67beb244daa06eb56cfa1db8d4123d730dc77bd05c71e941de03c18921bd45df0735ea8429f01cb9f7bc
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroW4/CFsrdn0A9lsy4:vvw9816vhKQLroW4/wQH9lsl
TLSH
T1AB535C834BEE98F2F7D20131046D8AB98277ADC4961EBEAF7F50CE55007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{AAE8187B-F429-4313-B231-0147FA597BBB}.exe

Path C:\Windows\{AAE8187B-F429-4313-B231-0147FA597BBB}.exe
Size 64KB
SHA256 f8c5bf56143e24cfb2a8857744cbee1cb8c9b6f9430e30f2a716a7ffdc8d2435
MD5 a75dc659f064c6c941f17a9df532469f
SHA1 dfb29dc6cf9e727af08e48406318e807fe46765d
SHA512 2517c63ee72e7a9e2be6754fdb1b0d97714f8adae2d26ae348c72d28cf9589c11772f8099d2c90c39b4beb2c106bd1384ed17f5bea2f1d9d522768ecab52a131
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrob4/CFsrdn0A9lsy4:vvw9816vhKQLrob4/wQH9lsl
TLSH
T175535C834BEE98F2F7D20131046D8A798277ADC4961EBEAF7F90CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe

Path C:\Windows\{B0F227EA-16EC-4b2d-9E27-D0310B1C325B}.exe
Size 64KB
SHA256 be3497644cf6436b2d994e550d0ff0cb85b0ffc1ab485d600513b651999c4764
MD5 4ba58b92f02764e192bf3fc13e9903e3
SHA1 26039e0d01a70d5c07f29878db88f29ca37f72e6
SHA512 17053a601951639983e951f3c024198b9b2ddac30d45bd61cdef0ddaf003ca30131575c431344e5aa5858e8819fcc70a3eaf0817cf916012f4bf9e9f880cdc7b
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro3Z4/CFsrdn0A9lsy4:vvw9816vhKQLro3Z4/wQH9lsl
TLSH
T121535C834BEE98F2F7D20131056D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe

Path C:\Windows\{C66016CB-3498-4806-9AD6-D90D9EF42B00}.exe
Size 64KB
SHA256 7f8c10081d1d5f04c149391c6e93ecbcfb7678d81f63362508eaab051e8a0dce
MD5 f118ff8aab43c4284b8db5d178aaa018
SHA1 41a9c78b83a214a4822f2623c370098a7f2d51a2
SHA512 f2a9636c48804701e3f2a6edb11440c22063e8b47bc09f532fafd001d5ee0962597eb62ba40e5581d5268439a87b94234adb545b467657c490dbaa05a3218780
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroI4/CFsrdn0A9lsy4:vvw9816vhKQLroI4/wQH9lsl
TLSH
T1E3535C834BEE9CF2F7921131056D8A798277ADC4961EBEAF7F90CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D4FA49EE-C5BB-4cc1-9A73-9AD3A232E464}.exe

Path C:\Windows\{D4FA49EE-C5BB-4cc1-9A73-9AD3A232E464}.exe
Size 64KB
SHA256 35d4edca897029957b3d408c1a2fe3e0d75e548ed118f31d8a58ae9257d65af1
MD5 ae7724df389b56d839402efce3b579d8
SHA1 2b5b9a38dd43e46ecb05845c34f8ad87289bddb0
SHA512 de14882d8bdc4e9502b14bfe4e09f150e0210b7c6ab75863ea4b7544c1e9d3fc702463c565dd5b7d27aafa28cf73744a8e43db7551e3fd49060e0283e3f91fb3
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroP4/CFsrdn0A9lsy4:vvw9816vhKQLroP4/wQH9lsl
TLSH
T1F7535C834BEE98F2F7D24131046D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads