stormser | fbec33dd5e4a9cc5b4dd11120c882874269cbe95bf266019ef742d1c929fd5be

Analysis

max time kernel
149s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe
Size 64KB
Sample260419-rexd2scv9p
SHA256 fbec33dd5e4a9cc5b4dd11120c882874269cbe95bf266019ef742d1c929fd5be
MD5 a58d1f38c8b34bc016e67d1b85dac541
SHA1 e378505bf66d2773e72a1382ef0b372089aebaac
SHA512 54c91bf90a43848c076cb96650aef6d37ffa933dbe6902cc5e280061868942c6615534ea984e3a24234a6741a7f34fbcf79b8480887bd448a3ec14a717ec5f6a
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroM4/CFsrdn0A9lsy4:vvw9816vhKQLroM4/wQH9lsl
TLSH
T13B535C834BEE98F2F7D21131046D8AB98277ADC4961EBEAF7F50CE55007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral1/files/0x000800000002425e-2.dat	family_stormser
behavioral1/files/0x000800000002425f-7.dat	family_stormser
behavioral1/files/0x000700000002426c-8.dat	family_stormser
behavioral1/files/0x000900000002425f-14.dat	family_stormser
behavioral1/files/0x000700000001e120-18.dat	family_stormser
behavioral1/files/0x000200000001e721-22.dat	family_stormser
behavioral1/files/0x0003000000000703-26.dat	family_stormser
behavioral1/files/0x0004000000000705-30.dat	family_stormser
behavioral1/files/0x0004000000000703-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}	{783B7455-DCE4-4178-81D8-CD58C607935D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}	{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0745390B-F9B6-4701-813B-5F8803D74ACE}	{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0745390B-F9B6-4701-813B-5F8803D74ACE}\stubpath = "C:\\Windows\\{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe"	{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}	{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}\stubpath = "C:\\Windows\\{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe"	{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}\stubpath = "C:\\Windows\\{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe"	2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{783B7455-DCE4-4178-81D8-CD58C607935D}	{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}\stubpath = "C:\\Windows\\{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe"	{783B7455-DCE4-4178-81D8-CD58C607935D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}\stubpath = "C:\\Windows\\{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe"	{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB7FE5AF-D4BF-4420-A999-AB6ADBDA7088}	{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}\stubpath = "C:\\Windows\\{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe"	{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}\stubpath = "C:\\Windows\\{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe"	{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB7FE5AF-D4BF-4420-A999-AB6ADBDA7088}\stubpath = "C:\\Windows\\{CB7FE5AF-D4BF-4420-A999-AB6ADBDA7088}.exe"	{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}	2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{783B7455-DCE4-4178-81D8-CD58C607935D}\stubpath = "C:\\Windows\\{783B7455-DCE4-4178-81D8-CD58C607935D}.exe"	{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}	{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}	{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe

Executes dropped EXE 9 IoCs

pid	Process
2688	{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe
4376	{783B7455-DCE4-4178-81D8-CD58C607935D}.exe
4664	{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe
4092	{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe
3628	{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe
428	{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe
1324	{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe
752	{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe
2284	{CB7FE5AF-D4BF-4420-A999-AB6ADBDA7088}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{CB7FE5AF-D4BF-4420-A999-AB6ADBDA7088}.exe	{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe
File created	C:\Windows\{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe	{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe
File created	C:\Windows\{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe	{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe
File created	C:\Windows\{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe	2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe
File created	C:\Windows\{783B7455-DCE4-4178-81D8-CD58C607935D}.exe	{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe
File created	C:\Windows\{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe	{783B7455-DCE4-4178-81D8-CD58C607935D}.exe
File created	C:\Windows\{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe	{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe
File created	C:\Windows\{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe	{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe
File created	C:\Windows\{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe	{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CB7FE5AF-D4BF-4420-A999-AB6ADBDA7088}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{783B7455-DCE4-4178-81D8-CD58C607935D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2812	2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2688	{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe
Token: SeIncBasePriorityPrivilege	4376	{783B7455-DCE4-4178-81D8-CD58C607935D}.exe
Token: SeIncBasePriorityPrivilege	4664	{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe
Token: SeIncBasePriorityPrivilege	4092	{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe
Token: SeIncBasePriorityPrivilege	3628	{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe
Token: SeIncBasePriorityPrivilege	428	{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe
Token: SeIncBasePriorityPrivilege	1324	{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe
Token: SeIncBasePriorityPrivilege	752	{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2688	2812	2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe	84
PID 2812 wrote to memory of 460	2812	2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe	85
PID 2688 wrote to memory of 4376	2688	{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe	86
PID 2688 wrote to memory of 4852	2688	{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe	87
PID 4376 wrote to memory of 4664	4376	{783B7455-DCE4-4178-81D8-CD58C607935D}.exe	90
PID 4376 wrote to memory of 3716	4376	{783B7455-DCE4-4178-81D8-CD58C607935D}.exe	91
PID 4664 wrote to memory of 4092	4664	{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe	92
PID 4664 wrote to memory of 2088	4664	{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe	93
PID 4092 wrote to memory of 3628	4092	{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe	94
PID 4092 wrote to memory of 4412	4092	{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe	95
PID 3628 wrote to memory of 428	3628	{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe	99
PID 3628 wrote to memory of 2188	3628	{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe	100
PID 428 wrote to memory of 1324	428	{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe	104
PID 428 wrote to memory of 3060	428	{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe	105
PID 1324 wrote to memory of 752	1324	{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe	107
PID 1324 wrote to memory of 2384	1324	{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe	108
PID 752 wrote to memory of 2284	752	{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe	109
PID 752 wrote to memory of 360	752	{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe
  C:\Windows\{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\{783B7455-DCE4-4178-81D8-CD58C607935D}.exe
    C:\Windows\{783B7455-DCE4-4178-81D8-CD58C607935D}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe
      C:\Windows\{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4664
    - - C:\Windows\{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe
        
        C:\Windows\{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4092
      - C:\Windows\{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe
        
        C:\Windows\{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe
        
        C:\Windows\{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Windows\{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe
        
        C:\Windows\{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe
        
        C:\Windows\{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\{CB7FE5AF-D4BF-4420-A999-AB6ADBDA7088}.exe
        
        C:\Windows\{CB7FE5AF-D4BF-4420-A999-AB6ADBDA7088}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D69C0~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79EDF~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{07453~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4FBF0~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D4DE8~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{84E46~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{783B7~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{9190C~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe

Path C:\Windows\{0745390B-F9B6-4701-813B-5F8803D74ACE}.exe
Size 64KB
SHA256 db82517fa1c2123ecaf95fd7608964260edf80110d4573b8142274a8430a5a84
MD5 0499b61a295d7b3c54cff2ca84fe241a
SHA1 530a9f663400c35b883f130b6f165fc8a2d407b9
SHA512 e90ae7962bbc1c37f4cfc8842b6c4c7b332271af778a62b40d4b82d8e88e8afad3c7adca139c025d03d5184e73dd2dd76361049a98030383e02152504d1c41ee
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLron4/CFsrdn0A9lsy4:vvw9816vhKQLron4/wQH9lsl
TLSH
T1B0535C834BEE98F2F7D20131056D8A798277ADC4961EBE9F7F90CE54017B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe

Path C:\Windows\{4FBF0EAA-61B8-40ff-AA51-D29BA4707BF1}.exe
Size 64KB
SHA256 5eaf0b1f5672d03d7fb42e892114554cbcebc5c6e0fb9ce115ae9cbb54286ce6
MD5 38ba971632b43fc04dbff4378db702d3
SHA1 1811d991745c63464a7d9c7acb9cf1a009203472
SHA512 aab97e740603ad7dcebd9188f7e2bea8510ad59b75212fddd9423efdf9f200dbf8575a949c23984a597ea22b4c0c107887b881570aab4835ce9340e8e83ce10b
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrod4/CFsrdn0A9lsy4:vvw9816vhKQLrod4/wQH9lsl
TLSH
T1D3535C834BEE98F2F7D21131046D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{783B7455-DCE4-4178-81D8-CD58C607935D}.exe

Path C:\Windows\{783B7455-DCE4-4178-81D8-CD58C607935D}.exe
Size 64KB
SHA256 0f82e50ce7221a33c1875f697668ec7f484bf5dbf011d4ab8bbc5c22b0f5e5c6
MD5 2a0b6457fc84446cc3b61ab5f4e32143
SHA1 56c10ad0c743c89f5adde14d358bf0513c756f6e
SHA512 d20040b61fe98597ef12c388c3846b5f9358d0eb576b5881e060c17e06d4b8bbe38970410cb8fafbdd1ed6a0a52514ea81566ebec4a9c2bb4d62faffc7cc08a3
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrot4/CFsrdn0A9lsy4:vvw9816vhKQLrot4/wQH9lsl
TLSH
T133535C834BEE98F2F7D20131046D8AB98277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe

Path C:\Windows\{79EDF8EF-5333-4d5b-915A-DBC8DD0E7B3A}.exe
Size 64KB
SHA256 7fb3a7a690dc71f31cf51186c7531010fe183ec7374d29bad16f1bdb96f7a86d
MD5 a0c4722f6e354945a7745cab337e9645
SHA1 ae88cf0bb12c32c00093a82796c4f5ffebdc1759
SHA512 62ac253a44a6caef5b54685eb860f0d92b1dc6c13f93fee260359c325b7b54ad5c7136cf311f88d69aa48be4a2a05f8d1a420f0b5e82ddffeef75abfd2c90b73
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrow4/CFsrdn0A9lsy4:vvw9816vhKQLrow4/wQH9lsl
TLSH
T100535C834BEE98F2F7D20131056D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe

Path C:\Windows\{84E461FF-7C2D-4b80-981A-1BE827C8F2D3}.exe
Size 64KB
SHA256 b606e66b78fc3e6954c276f14e414f63b544fc6ff5fbaf2ac43f137cd12e2134
MD5 3ba5cc38b2b7569d5c421b285c181c6f
SHA1 e73a28557775619658a44643759201697cf801e4
SHA512 234f9cc2f539c491724699bf38eb00ff3b76df898919015dbf70c562dcd6be1a3cc4580b63969168ba3970efe10432becb3da5ee6a64a585b4212156dd2941de
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrom4/CFsrdn0A9lsy4:vvw9816vhKQLrom4/wQH9lsl
TLSH
T164535C834BEE98F2F7D20131046D8AB98277ADC4961EBEAF7F50CE55007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe

Path C:\Windows\{9190CDEC-B4A9-4f3d-B4A6-12410145AA9A}.exe
Size 64KB
SHA256 513fb8c6a0feb0c3f7cc05610939c0f6dae995411d80217aea05cfe0d5348bc9
MD5 2b9c0d84911df38324eb0286c136c6b8
SHA1 ff0de7258f18c5c82ca77c8350d27f085f5c5ab4
SHA512 622a3d06180227f5b4f48ee2a4438fe4f27aef074ba3b41798e94a883af96301b3e75180634bc4db14a118484749fad981a9a1a23e579e7a419c76f3a5374c14
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrog4/CFsrdn0A9lsy4:vvw9816vhKQLrog4/wQH9lsl
TLSH
T138535D834BEE98F2F7D25131046D8A798277ADC4961EBEAF7F90CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CB7FE5AF-D4BF-4420-A999-AB6ADBDA7088}.exe

Path C:\Windows\{CB7FE5AF-D4BF-4420-A999-AB6ADBDA7088}.exe
Size 64KB
SHA256 d32e4344f27073ff62f007ddf9ba6d88f62e4f95e4abb7ceeeba7b2a11502ffa
MD5 a05623716a70b3f25bc28418c4b693c9
SHA1 b644de5d66f6236a40578ad2ae83adb4e1513dfa
SHA512 a5966ac7aec14d90208248b831c88b406e5dbb634899680f7a6b5bb6e7839679cad2a0adfbd7a820289d2e52f4c5ec41ac24bcca964d9bfa6b653c817906af3f
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroL4/CFsrdn0A9lsy4:vvw9816vhKQLroL4/wQH9lsl
TLSH
T1A0535C834BEE98F2F7D20131046D8A799277ADC4961EBE9F7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe

Path C:\Windows\{D4DE8F97-4EFE-47f3-BFC2-6BEDEED01850}.exe
Size 64KB
SHA256 87854dca85eff10d55d05602dda58c459cd8cd50878d7cd43b347dc61e9057e4
MD5 7598c90a8836fd92afa01b2a953395e4
SHA1 31fbb0e5b19d96397dc8b82fda734a95a82fc96d
SHA512 b9aa78742f9d845fdb454414249e9346d3263c0294fd36fae947249f71a2a7e54612e6684398f71f7c67094a877d7b76bb40498f3aff6f405495d0b13ad160bf
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrox4/CFsrdn0A9lsy4:vvw9816vhKQLrox4/wQH9lsl
TLSH
T1BA535C834BEE98F2F7920131056D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe

Path C:\Windows\{D69C0644-5731-4013-AA3B-ADE13D3DF4FE}.exe
Size 64KB
SHA256 ef90aa376216b98a029e8a162c1ef026e695924c246d87c3ba88a1f21bf805fa
MD5 547873f51b822c4571b7ae9e946b2f42
SHA1 9a85c2dd018ffd96a7e845fd0d0cdb42d0baaeb4
SHA512 1015774bb4f870b3112c275e0ac1efcb5148c8edd9a3539b916e723bd1c3eb12fae505399c2d711001affb1242dc25681b48f2699a1ee765302d0eef8581b62a
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro+o4/CFsrdn0A9lsy4:vvw9816vhKQLro14/wQH9lsl
TLSH
T1D6535C834BEE98F2F7D20131046D8A799277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads