f3428b0390d3592f02631cb980512dbd328743fb90eac6100980398174301a22

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe
Size 3.5MB
Sample260419-p8dspaa16m
SHA256 f3428b0390d3592f02631cb980512dbd328743fb90eac6100980398174301a22
MD5 f1c71d87fd855b3e65f0c3f3e729a584
SHA1 7be540dad5df60784054f6ba7a5f4060d2b25ad3
SHA512 821ef95b646dca74108429bd74e4b58db8aa09fe44296ee7029339866f04ae6ccfad22c7234bf7310ad0432ad8940b89fb972e3f56751ab7778d89735fa6ec50
SSDEEP 24576:jbCj2sObHtqQ4QIYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W+bCj2sObHtQ:jbCjPKNqQIFIbBMy+bCjPKNqQIr
TLSH
T1B206C0C6F3EA40E6DC023FF5582567C79B34473647384059BBAA3D458F234A9C12ABB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3224	winmgr21.exe
3364	winmgr21.exe
2292	winmgr21.exe
5836	winmgr21.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr21.exe"	2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr21.exe"	winmgr21.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00090000000243a4-6.dat	autoit_exe
behavioral1/files/0x00070000000243a5-8.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3224 set thread context of 3764	3224	winmgr21.exe	86
PID 3764 set thread context of 5932	3764	RegAsm.exe	91

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe:Zone.Identifier:$DATA	2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe
File created	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe:Zone.Identifier:$DATA	2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4444	schtasks.exe
5364	schtasks.exe
4392	schtasks.exe
6088	schtasks.exe
5732	schtasks.exe
5340	schtasks.exe
4840	schtasks.exe
3476	schtasks.exe
4636	schtasks.exe
4268	schtasks.exe
1940	schtasks.exe
4916	schtasks.exe
2464	schtasks.exe
2436	schtasks.exe
2168	schtasks.exe
5272	schtasks.exe
2484	schtasks.exe
1588	schtasks.exe
5124	schtasks.exe
4284	schtasks.exe
4952	schtasks.exe
4176	schtasks.exe
5592	schtasks.exe
4172	schtasks.exe
2096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2848	2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe
2848	2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3364	winmgr21.exe
3364	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
2292	winmgr21.exe
2292	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe
3224	winmgr21.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
2848	2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe
3224	winmgr21.exe
3364	winmgr21.exe
2292	winmgr21.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3764	RegAsm.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3224	2848	2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe	85
PID 3224 wrote to memory of 3764	3224	winmgr21.exe	86
PID 3224 wrote to memory of 3764	3224	winmgr21.exe	86
PID 3224 wrote to memory of 3764	3224	winmgr21.exe	86
PID 3224 wrote to memory of 4952	3224	winmgr21.exe	87
PID 3764 wrote to memory of 5932	3764	RegAsm.exe	91
PID 3764 wrote to memory of 5932	3764	RegAsm.exe	91
PID 3764 wrote to memory of 5932	3764	RegAsm.exe	91
PID 3764 wrote to memory of 5932	3764	RegAsm.exe	91
PID 3764 wrote to memory of 5932	3764	RegAsm.exe	91
PID 3764 wrote to memory of 5932	3764	RegAsm.exe	91
PID 3224 wrote to memory of 2464	3224	winmgr21.exe	94
PID 3224 wrote to memory of 4636	3224	winmgr21.exe	96
PID 3224 wrote to memory of 2436	3224	winmgr21.exe	102
PID 3224 wrote to memory of 4268	3224	winmgr21.exe	106
PID 3224 wrote to memory of 4176	3224	winmgr21.exe	108
PID 3224 wrote to memory of 5592	3224	winmgr21.exe	110
PID 3224 wrote to memory of 6088	3224	winmgr21.exe	112
PID 3224 wrote to memory of 2168	3224	winmgr21.exe	114
PID 3224 wrote to memory of 5272	3224	winmgr21.exe	116
PID 3224 wrote to memory of 5732	3224	winmgr21.exe	118
PID 3224 wrote to memory of 1940	3224	winmgr21.exe	120
PID 3224 wrote to memory of 5340	3224	winmgr21.exe	123
PID 3224 wrote to memory of 2484	3224	winmgr21.exe	125
PID 3224 wrote to memory of 4172	3224	winmgr21.exe	127
PID 3224 wrote to memory of 1588	3224	winmgr21.exe	129
PID 3224 wrote to memory of 2096	3224	winmgr21.exe	131
PID 3224 wrote to memory of 5124	3224	winmgr21.exe	133
PID 3224 wrote to memory of 4840	3224	winmgr21.exe	135
PID 3224 wrote to memory of 3476	3224	winmgr21.exe	137
PID 3224 wrote to memory of 4284	3224	winmgr21.exe	139
PID 3224 wrote to memory of 4444	3224	winmgr21.exe	141
PID 3224 wrote to memory of 5364	3224	winmgr21.exe	143
PID 3224 wrote to memory of 4392	3224	winmgr21.exe	145
PID 3224 wrote to memory of 4916	3224	winmgr21.exe	148

C:\Users\Admin\AppData\Local\Temp\2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe"
1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2848
- C:\ProgramData\winmgr21.exe
  C:\ProgramData\winmgr21.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /stext C:\ProgramData\Mails.txt
      4⤵
      PID:5932
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4952
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2464
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4636
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2436
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4268
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4176
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5592
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6088
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2168
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5272
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5732
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1940
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5340
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2484
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4172
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1588
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5124
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3476
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4284
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4444
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5364
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4392
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4916

C:\ProgramData\winmgr21.exe
C:\ProgramData\winmgr21.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3364

C:\ProgramData\winmgr21.exe
C:\ProgramData\winmgr21.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2292

C:\ProgramData\winmgr21.exe
C:\ProgramData\winmgr21.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winmgr21.exe

Path C:\ProgramData\winmgr21.exe
Size 3.5MB
SHA256 c24a96b37893318d4c1c040a441582e27c72bfc7e662054c62246f30c65556d9
MD5 c11434d5e6b5ea57e32c19cd34df4f72
SHA1 a735dc9082fbe788ca04d8133b263c397613a0af
SHA512 9c32e5744b9c982da4ee1f0aa3c45827e4391db55222adb6d03b381477d53d5a83103d850672d4cea1db9a35b40b975b28e16e5e10c79ecd7a5f461a0c5e9bfd
SSDEEP 24576:jbCj2sObHtqQ4QIYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W+bCj2sObHtk:jbCjPKNqQIFIbBMy+bCjPKNqQIl
TLSH
T11F06C0C6F3EA40E6DC023FF5582567C79B34473647384059BBAA3D458F234A9C12ABB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-19_f1c71d87fd855b3e65f0c3f3e729a584_elex_stop.exe
Size 3.5MB
SHA256 f3428b0390d3592f02631cb980512dbd328743fb90eac6100980398174301a22
MD5 f1c71d87fd855b3e65f0c3f3e729a584
SHA1 7be540dad5df60784054f6ba7a5f4060d2b25ad3
SHA512 821ef95b646dca74108429bd74e4b58db8aa09fe44296ee7029339866f04ae6ccfad22c7234bf7310ad0432ad8940b89fb972e3f56751ab7778d89735fa6ec50
SSDEEP 24576:jbCj2sObHtqQ4QIYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W+bCj2sObHtQ:jbCjPKNqQIFIbBMy+bCjPKNqQIr
TLSH
T1B206C0C6F3EA40E6DC023FF5582567C79B34473647384059BBAA3D458F234A9C12ABB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2292-36-0x0000000001950000-0x0000000001BD1000-memory.dmp

Download

memory/2292-38-0x0000000001950000-0x0000000001BD1000-memory.dmp

Download

memory/2848-0-0x0000000001D60000-0x0000000001FE1000-memory.dmp

Download

memory/2848-10-0x0000000001D60000-0x0000000001FE1000-memory.dmp

Download

memory/3224-11-0x00000000017A0000-0x0000000001A21000-memory.dmp

Download

memory/3364-20-0x0000000001720000-0x00000000019A1000-memory.dmp

Download

memory/3364-22-0x0000000001720000-0x00000000019A1000-memory.dmp

Download

memory/3764-14-0x0000000000350000-0x00000000003FA000-memory.dmp

Download

memory/3764-19-0x00000000009F0000-0x0000000000C71000-memory.dmp

Download

memory/5932-15-0x0000000000400000-0x0000000000420000-memory.dmp

Download