stormser | 3b2a7cdde1e99d45b28cd831d1010a5d52208885fc05ebffd4f342a2032057a3

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_c912c70392d96f5742fddcdb2e57b5ed_elex_goldeneye_wannacry.exe
Size 372KB
Sample260419-lbtabscs31
SHA256 3b2a7cdde1e99d45b28cd831d1010a5d52208885fc05ebffd4f342a2032057a3
MD5 c912c70392d96f5742fddcdb2e57b5ed
SHA1 7d441ec059421dfb382706feb2905f44b2dbb0a4
SHA512 ac00e94ebdfab19f0518f45a97aa2e95d25e13f111616c04e83b5f322af98c462055e4ba1c7c57ca146ca5589125432e6c5bb966250b371d5aab65f1090e065e
SSDEEP 3072:CEGh0oAmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGvl/Oe2MUVg3vTeKcAEciTBqr3
TLSH
T1E9846E2067F6E698F5F30FB8ADB581409D7BBE916D31D61D22A8000E8D71A90DE71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x001b00000002b247-2.dat	family_stormser
behavioral2/files/0x001b00000002b31e-6.dat	family_stormser
behavioral2/files/0x001c00000002b247-10.dat	family_stormser
behavioral2/files/0x001c00000002b31e-14.dat	family_stormser
behavioral2/files/0x001d00000002b247-18.dat	family_stormser
behavioral2/files/0x001d00000002b31e-22.dat	family_stormser
behavioral2/files/0x0003000000024fa0-26.dat	family_stormser
behavioral2/files/0x0003000000024fa1-31.dat	family_stormser
behavioral2/files/0x0004000000024fa0-34.dat	family_stormser

Auto-generated rule 9 IoCs

resource	yara_rule
behavioral2/files/0x001b00000002b247-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001b00000002b31e-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001c00000002b247-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001c00000002b31e-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001d00000002b247-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001d00000002b31e-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000024fa0-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000024fa1-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000024fa0-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17408349-05D3-4863-B50C-022B1EE23D24}	{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D0A8CEA-D047-4d2f-8D44-065CEE069915}	{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D07C2808-1B76-41af-8AB1-A652633FB01E}\stubpath = "C:\\Windows\\{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe"	{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F877418E-2E5C-4cc1-A3DE-3383A187C269}	{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F877418E-2E5C-4cc1-A3DE-3383A187C269}\stubpath = "C:\\Windows\\{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe"	{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}	{BF35E298-C742-4609-82D9-6E12603D2122}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}	{17408349-05D3-4863-B50C-022B1EE23D24}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5048EB1-7E36-476b-BDE8-079F1F376EC9}\stubpath = "C:\\Windows\\{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe"	{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D07C2808-1B76-41af-8AB1-A652633FB01E}	{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4AF3A1D9-E4E7-4b2a-BBDF-EE5E3BD11DA6}	{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF35E298-C742-4609-82D9-6E12603D2122}	2026-04-19_c912c70392d96f5742fddcdb2e57b5ed_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D0A8CEA-D047-4d2f-8D44-065CEE069915}\stubpath = "C:\\Windows\\{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe"	{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF35E298-C742-4609-82D9-6E12603D2122}\stubpath = "C:\\Windows\\{BF35E298-C742-4609-82D9-6E12603D2122}.exe"	2026-04-19_c912c70392d96f5742fddcdb2e57b5ed_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}\stubpath = "C:\\Windows\\{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe"	{BF35E298-C742-4609-82D9-6E12603D2122}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17408349-05D3-4863-B50C-022B1EE23D24}\stubpath = "C:\\Windows\\{17408349-05D3-4863-B50C-022B1EE23D24}.exe"	{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}\stubpath = "C:\\Windows\\{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe"	{17408349-05D3-4863-B50C-022B1EE23D24}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5048EB1-7E36-476b-BDE8-079F1F376EC9}	{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4AF3A1D9-E4E7-4b2a-BBDF-EE5E3BD11DA6}\stubpath = "C:\\Windows\\{4AF3A1D9-E4E7-4b2a-BBDF-EE5E3BD11DA6}.exe"	{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe

Executes dropped EXE 9 IoCs

pid	Process
1908	{BF35E298-C742-4609-82D9-6E12603D2122}.exe
4992	{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe
2644	{17408349-05D3-4863-B50C-022B1EE23D24}.exe
5036	{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe
3152	{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe
784	{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe
2936	{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe
2968	{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe
2624	{4AF3A1D9-E4E7-4b2a-BBDF-EE5E3BD11DA6}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe	{BF35E298-C742-4609-82D9-6E12603D2122}.exe
File created	C:\Windows\{17408349-05D3-4863-B50C-022B1EE23D24}.exe	{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe
File created	C:\Windows\{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe	{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe
File created	C:\Windows\{BF35E298-C742-4609-82D9-6E12603D2122}.exe	2026-04-19_c912c70392d96f5742fddcdb2e57b5ed_elex_goldeneye_wannacry.exe
File created	C:\Windows\{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe	{17408349-05D3-4863-B50C-022B1EE23D24}.exe
File created	C:\Windows\{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe	{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe
File created	C:\Windows\{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe	{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe
File created	C:\Windows\{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe	{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe
File created	C:\Windows\{4AF3A1D9-E4E7-4b2a-BBDF-EE5E3BD11DA6}.exe	{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BF35E298-C742-4609-82D9-6E12603D2122}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4AF3A1D9-E4E7-4b2a-BBDF-EE5E3BD11DA6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_c912c70392d96f5742fddcdb2e57b5ed_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{17408349-05D3-4863-B50C-022B1EE23D24}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1052	2026-04-19_c912c70392d96f5742fddcdb2e57b5ed_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	1908	{BF35E298-C742-4609-82D9-6E12603D2122}.exe
Token: SeIncBasePriorityPrivilege	4992	{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe
Token: SeIncBasePriorityPrivilege	2644	{17408349-05D3-4863-B50C-022B1EE23D24}.exe
Token: SeIncBasePriorityPrivilege	5036	{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe
Token: SeIncBasePriorityPrivilege	3152	{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe
Token: SeIncBasePriorityPrivilege	784	{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe
Token: SeIncBasePriorityPrivilege	2936	{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe
Token: SeIncBasePriorityPrivilege	2968	{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1908	1052	2026-04-19_c912c70392d96f5742fddcdb2e57b5ed_elex_goldeneye_wannacry.exe	80
PID 1052 wrote to memory of 4712	1052	2026-04-19_c912c70392d96f5742fddcdb2e57b5ed_elex_goldeneye_wannacry.exe	81
PID 1908 wrote to memory of 4992	1908	{BF35E298-C742-4609-82D9-6E12603D2122}.exe	82
PID 1908 wrote to memory of 2976	1908	{BF35E298-C742-4609-82D9-6E12603D2122}.exe	83
PID 4992 wrote to memory of 2644	4992	{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe	84
PID 4992 wrote to memory of 2836	4992	{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe	85
PID 2644 wrote to memory of 5036	2644	{17408349-05D3-4863-B50C-022B1EE23D24}.exe	86
PID 2644 wrote to memory of 4600	2644	{17408349-05D3-4863-B50C-022B1EE23D24}.exe	87
PID 5036 wrote to memory of 3152	5036	{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe	88
PID 5036 wrote to memory of 2604	5036	{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe	89
PID 3152 wrote to memory of 784	3152	{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe	90
PID 3152 wrote to memory of 3216	3152	{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe	91
PID 784 wrote to memory of 2936	784	{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe	92
PID 784 wrote to memory of 996	784	{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe	93
PID 2936 wrote to memory of 2968	2936	{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe	94
PID 2936 wrote to memory of 3868	2936	{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe	95
PID 2968 wrote to memory of 2624	2968	{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe	96
PID 2968 wrote to memory of 2072	2968	{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-04-19_c912c70392d96f5742fddcdb2e57b5ed_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_c912c70392d96f5742fddcdb2e57b5ed_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\{BF35E298-C742-4609-82D9-6E12603D2122}.exe
  C:\Windows\{BF35E298-C742-4609-82D9-6E12603D2122}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe
    C:\Windows\{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\{17408349-05D3-4863-B50C-022B1EE23D24}.exe
      C:\Windows\{17408349-05D3-4863-B50C-022B1EE23D24}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Windows\{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe
        
        C:\Windows\{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5036
      - C:\Windows\{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe
        
        C:\Windows\{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe
        
        C:\Windows\{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:784
        
        C:\Windows\{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe
        
        C:\Windows\{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe
        
        C:\Windows\{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\{4AF3A1D9-E4E7-4b2a-BBDF-EE5E3BD11DA6}.exe
        
        C:\Windows\{4AF3A1D9-E4E7-4b2a-BBDF-EE5E3BD11DA6}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F8774~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D07C2~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7D0A8~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D5048~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3216
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{279BB~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{17408~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{464F7~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{BF35E~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{17408349-05D3-4863-B50C-022B1EE23D24}.exe

Path C:\Windows\{17408349-05D3-4863-B50C-022B1EE23D24}.exe
Size 372KB
SHA256 420fea360441177031440f3f06655777789490ae781bdce12648d6c5c294c3a6
MD5 d66e6ea0c30d9eb2c0f9a5122df918ee
SHA1 469929a2cffd912f6c311b4ea224e388d96cd9eb
SHA512 9ece9ae09398e07f8292a94452c51e7b9bcbfc2773f0253254aceba3530dfe1ec99b08e3df32f10c871df12d4681b30f3f11e9e8ebd622d1bf308c8c82d49ff6
SSDEEP 3072:CEGh0oqmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGRl/Oe2MUVg3vTeKcAEciTBqr3
TLSH
T135846D2067F6E698F5F30FB8ADB581409D7BBE916D31D61D22A8000E8D71A90DE71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe

Path C:\Windows\{279BB1CC-4825-4ceb-92DD-EBB1D7D7A70D}.exe
Size 372KB
SHA256 ef134a291132635585ce3675da034d0bcafb41f16fc530e483eef0869040e912
MD5 8e4b39c1b87047b1048c65e364ad7978
SHA1 f6cce36f38f6f02da31bcb068e4d12ec8951d0c4
SHA512 f5f198846d348e0f5120af7b3030fa4de3b9e7dad4b6996a4dae7bc38aaebb9a270644b9cf9dab19626691138d129fba3b00d49e4341a5b223a161c2bb61913e
SSDEEP 3072:CEGh0oWmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGdl/Oe2MUVg3vTeKcAEciTBqr3
TLSH
T137846E2067F6E698F5F30FB8ADB581409D7BBE916D31D61D22A8000E8D71A90DE71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe

Path C:\Windows\{464F7CD8-48D0-4bd2-A83B-ACB376AD31EA}.exe
Size 372KB
SHA256 1fff810f42a28ddff35c4d060e54faadd9d416b40fed586b554b1baec168d1f3
MD5 a283295e63b3ef584a87d7c64d752862
SHA1 f58c96054643d8b9ce7e9206971eefc63e76b74e
SHA512 bb9523306c47c76343b8715cba94cfaeba37912d3415bb171ee35a52cc262d51ad1bb6f10cb3b2a258c0cc74086ce3de78cc95511522e1b70efe4b0fca20c8e3
SSDEEP 3072:CEGh0oUmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGPl/Oe2MUVg3vTeKcAEciTBqr3
TLSH
T1FF846E2067F6E698F5F30FB8ADB581409D7BBE916D31D61D22A8000E8D71A90DE71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4AF3A1D9-E4E7-4b2a-BBDF-EE5E3BD11DA6}.exe

Path C:\Windows\{4AF3A1D9-E4E7-4b2a-BBDF-EE5E3BD11DA6}.exe
Size 372KB
SHA256 770910914e55b0a5a225332a6ca0ffbd0a25e5eba256bd64e372fa2b80d1c463
MD5 a73ecd7f0dcc55d29736ebffc0834586
SHA1 17a3981d7158abe4e1db35b4c90a68bd4667c70d
SHA512 56678948fa2ca5a2a1ab0662158521c430348d2ea0ac3a2e07fd63dae1cda1f5c794cbdcf2ac411b4c57f70408f84a45aded7173aed621a6d09919b0cbf4d51f
SSDEEP 3072:CEGh0o4mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGnl/Oe2MUVg3vTeKcAEciTBqr3
TLSH
T1A4846E2067F6E698F5F30FB8ADB581409D7BBE916D31D61D22A8000E8D71A90DE71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe

Path C:\Windows\{7D0A8CEA-D047-4d2f-8D44-065CEE069915}.exe
Size 372KB
SHA256 5dc9713fc1078020e6facc92745ba05ec65f695f6cd4e193f4e33d5dd2d1eef5
MD5 907dbd261e83ee99b4dcd4805a7f8b3d
SHA1 6d7d1be0dde50c4ec0c11b1aca11d3a56f2a1154
SHA512 455a26c553f41364b3c30cecb6c2a27923cec56a48a66e0f5a149291a424906d6414a521dc2cb87198d4e173812cefd08029b30b470fd4ef507a0a33a91e1a90
SSDEEP 3072:CEGh0oDmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGIl/Oe2MUVg3vTeKcAEciTBqr3
TLSH
T11B846E2067F6E698F5F30FB8ADB581409D7BBE916D31D61D22A8000E8D71A90DE71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BF35E298-C742-4609-82D9-6E12603D2122}.exe

Path C:\Windows\{BF35E298-C742-4609-82D9-6E12603D2122}.exe
Size 372KB
SHA256 6085e145709fa1be1be8a8dfd2d572ed7602bfde2e1e1031479168061f66b04c
MD5 5e5fbe329c3f61d45744e1e23a8142b2
SHA1 5c5f3b456aae5c4a5b84bf45c81b706de96270af
SHA512 5d4cf49cc66e282d27f6233c8ee60347a97adb5961ed445cea3558fb0f85ea817d79611a2c8b2bc8fcc1647b5d1a8fdf216f1460d8b5c00d68ced300fa43df55
SSDEEP 3072:CEGh0oLmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGYl/Oe2MUVg3vTeKcAEciTBqr3
TLSH
T13F846E2067F6E698F5F30FB8ADB581409D7BBE916D31D61D22A8000E8D71A90DE71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe

Path C:\Windows\{D07C2808-1B76-41af-8AB1-A652633FB01E}.exe
Size 372KB
SHA256 1c816bf9faee47b98e61e1db9fd6c63b91c1e18e4ea21535c466dfd3b186c57f
MD5 6833a6771c42f78fbdfbdf117229ae22
SHA1 9f152cec6f0a09ef90524c48eca7b71d7073bf9c
SHA512 2df5417057db5d88dee265cd613effa7cea03d2aaa67fd8334454ed3258e3f34312144f5470f3364e10f9bf37e1a3e7ce1e62c9cc9c996d5f63795c82260ba9b
SSDEEP 3072:CEGh0ofmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGgl/Oe2MUVg3vTeKcAEciTBqr3
TLSH
T11D846E2067F6E698F5F30FB8ADB581409D7BBE916D31D61D22A8000E8D71A90DE71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe

Path C:\Windows\{D5048EB1-7E36-476b-BDE8-079F1F376EC9}.exe
Size 372KB
SHA256 fd3b4144f1d1e14ec237cbc67850089c13af5a5e87e14fe5e25dfd93fd827ea5
MD5 7f8797927c0393302e479de457f5feca
SHA1 75b5e0bd1ff868973a5ef97df32c04c92e8ad190
SHA512 d6dc773f85ec230ead9190374b4be68a225441fe5add952fe2b1ff535502efacb10f57dc2b44dc7176ed317201ef33c855f8962e5526aef528567ac58c2f8f4d
SSDEEP 3072:CEGh0oFmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGOl/Oe2MUVg3vTeKcAEciTBqr3
TLSH
T175846E2067F6E698F5F30FB8ADB581409D7BBE916D31D61D22A8000E8D71A90DE71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe

Path C:\Windows\{F877418E-2E5C-4cc1-A3DE-3383A187C269}.exe
Size 372KB
SHA256 e0ac28ef9525c655792244968af056b63c9ed6ff4c8d63aefb136fc150d631dc
MD5 a3ec621a4bf10ff059517f7fb0c55af6
SHA1 d38058aa9d407738c5807f2901c88bbb68ce5a5c
SHA512 3728d078ff13f1dfda1561f10c35c7ac610d3543459bd8d5d2e3fc7be8a633129513ee4c6247a0a167f521294fe0eae0268f6766005eadb015702be9ae4f8753
SSDEEP 3072:CEGh0owmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGvl/Oe2MUVg3vTeKcAEciTBqr3
TLSH
T18E846E2067F6E698F5F30FB8ADB581409D7BBE916D31D61D22A8000E8D71A90DE71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads