stormser | 39e5b7fd746bc19ef783f5c03c0d51431d275b4207200c00b124f89b4035b884

Analysis

max time kernel
107s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_6117ff33a18c48e49f8c929d77bcbc46_elex_wannacry.exe
Size 60KB
Sample260419-sr5fvsdx8k
SHA256 39e5b7fd746bc19ef783f5c03c0d51431d275b4207200c00b124f89b4035b884
MD5 6117ff33a18c48e49f8c929d77bcbc46
SHA1 b88df29d08c630f79db695e454bf8dd704a8c80b
SHA512 d2bc5b5c6b566f248eac45d4895c97c1af9cf6b2b83650ac6b945d229d8a4a5bc54fb056480c73eac3aa40f66df57e654cb633961734d19825eee61258aed001
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroc4/CFsrdHWMZ:vvw9816vhKQLroc4/wQpWMZ
TLSH
T1EF533B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 10 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024514-2.dat	family_stormser
behavioral1/files/0x0007000000024521-7.dat	family_stormser
behavioral1/files/0x000300000001e747-8.dat	family_stormser
behavioral1/files/0x000800000002452a-15.dat	family_stormser
behavioral1/files/0x000400000001e747-19.dat	family_stormser
behavioral1/files/0x0006000000000035-23.dat	family_stormser
behavioral1/files/0x0003000000000701-27.dat	family_stormser
behavioral1/files/0x0007000000000035-31.dat	family_stormser
behavioral1/files/0x00050000000006d1-35.dat	family_stormser
behavioral1/files/0x0008000000000035-38.dat	family_stormser

Custom signature

Detects Windows executables referencing non-Windows User-Agents 10 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024514-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0007000000024521-7.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000300000001e747-8.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000800000002452a-15.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000400000001e747-19.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0006000000000035-23.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0003000000000701-27.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0007000000000035-31.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00050000000006d1-35.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000000035-38.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{192826D2-03E1-49a2-B219-95D031A3E58A}	2026-04-19_6117ff33a18c48e49f8c929d77bcbc46_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C44C3E63-DC31-43e8-868A-8CB415F7C911}	{192826D2-03E1-49a2-B219-95D031A3E58A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C44C3E63-DC31-43e8-868A-8CB415F7C911}\stubpath = "C:\\Windows\\{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe"	{192826D2-03E1-49a2-B219-95D031A3E58A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{970F5001-2F6A-46b2-A66B-A702BEA2A104}	{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{970F5001-2F6A-46b2-A66B-A702BEA2A104}\stubpath = "C:\\Windows\\{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe"	{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A22F368-40B1-448e-BE98-19138EFE9411}\stubpath = "C:\\Windows\\{7A22F368-40B1-448e-BE98-19138EFE9411}.exe"	{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41DC7480-8359-4112-BAED-E646EBC6F9F4}\stubpath = "C:\\Windows\\{41DC7480-8359-4112-BAED-E646EBC6F9F4}.exe"	{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{192826D2-03E1-49a2-B219-95D031A3E58A}\stubpath = "C:\\Windows\\{192826D2-03E1-49a2-B219-95D031A3E58A}.exe"	2026-04-19_6117ff33a18c48e49f8c929d77bcbc46_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A22F368-40B1-448e-BE98-19138EFE9411}	{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77CEA8C9-31FF-430a-B497-7B60B5E27C04}	{7A22F368-40B1-448e-BE98-19138EFE9411}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77CEA8C9-31FF-430a-B497-7B60B5E27C04}\stubpath = "C:\\Windows\\{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe"	{7A22F368-40B1-448e-BE98-19138EFE9411}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}	{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}\stubpath = "C:\\Windows\\{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe"	{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41DC7480-8359-4112-BAED-E646EBC6F9F4}	{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe

Executes dropped EXE 7 IoCs

pid	Process
4728	{192826D2-03E1-49a2-B219-95D031A3E58A}.exe
5904	{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe
1316	{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe
1148	{7A22F368-40B1-448e-BE98-19138EFE9411}.exe
2564	{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe
5504	{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe
6140	{41DC7480-8359-4112-BAED-E646EBC6F9F4}.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe	{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe
File created	C:\Windows\{7A22F368-40B1-448e-BE98-19138EFE9411}.exe	{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe
File created	C:\Windows\{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe	{7A22F368-40B1-448e-BE98-19138EFE9411}.exe
File created	C:\Windows\{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe	{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe
File created	C:\Windows\{41DC7480-8359-4112-BAED-E646EBC6F9F4}.exe	{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe
File created	C:\Windows\{192826D2-03E1-49a2-B219-95D031A3E58A}.exe	2026-04-19_6117ff33a18c48e49f8c929d77bcbc46_elex_wannacry.exe
File created	C:\Windows\{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe	{192826D2-03E1-49a2-B219-95D031A3E58A}.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7A22F368-40B1-448e-BE98-19138EFE9411}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{41DC7480-8359-4112-BAED-E646EBC6F9F4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_6117ff33a18c48e49f8c929d77bcbc46_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{192826D2-03E1-49a2-B219-95D031A3E58A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4876	2026-04-19_6117ff33a18c48e49f8c929d77bcbc46_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4728	{192826D2-03E1-49a2-B219-95D031A3E58A}.exe
Token: SeIncBasePriorityPrivilege	5904	{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe
Token: SeIncBasePriorityPrivilege	1316	{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe
Token: SeIncBasePriorityPrivilege	1148	{7A22F368-40B1-448e-BE98-19138EFE9411}.exe
Token: SeIncBasePriorityPrivilege	2564	{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe
Token: SeIncBasePriorityPrivilege	5504	{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4728	4876	2026-04-19_6117ff33a18c48e49f8c929d77bcbc46_elex_wannacry.exe	87
PID 4876 wrote to memory of 4940	4876	2026-04-19_6117ff33a18c48e49f8c929d77bcbc46_elex_wannacry.exe	88
PID 4728 wrote to memory of 5904	4728	{192826D2-03E1-49a2-B219-95D031A3E58A}.exe	94
PID 4728 wrote to memory of 2368	4728	{192826D2-03E1-49a2-B219-95D031A3E58A}.exe	95
PID 5904 wrote to memory of 1316	5904	{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe	98
PID 5904 wrote to memory of 5152	5904	{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe	99
PID 1316 wrote to memory of 1148	1316	{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe	100
PID 1316 wrote to memory of 5932	1316	{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe	101
PID 1148 wrote to memory of 2564	1148	{7A22F368-40B1-448e-BE98-19138EFE9411}.exe	102
PID 1148 wrote to memory of 4616	1148	{7A22F368-40B1-448e-BE98-19138EFE9411}.exe	103
PID 2564 wrote to memory of 5504	2564	{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe	104
PID 2564 wrote to memory of 4460	2564	{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe	105
PID 5504 wrote to memory of 6140	5504	{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe	106
PID 5504 wrote to memory of 5836	5504	{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-04-19_6117ff33a18c48e49f8c929d77bcbc46_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_6117ff33a18c48e49f8c929d77bcbc46_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\{192826D2-03E1-49a2-B219-95D031A3E58A}.exe
  C:\Windows\{192826D2-03E1-49a2-B219-95D031A3E58A}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe
    C:\Windows\{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Windows\{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe
      C:\Windows\{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Windows\{7A22F368-40B1-448e-BE98-19138EFE9411}.exe
        
        C:\Windows\{7A22F368-40B1-448e-BE98-19138EFE9411}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1148
      - C:\Windows\{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe
        
        C:\Windows\{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe
        
        C:\Windows\{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5504
        
        C:\Windows\{41DC7480-8359-4112-BAED-E646EBC6F9F4}.exe
        
        C:\Windows\{41DC7480-8359-4112-BAED-E646EBC6F9F4}.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Windows\{4FF1ABB7-3A7D-470c-9D35-A69672D45DC5}.exe
        
        C:\Windows\{4FF1ABB7-3A7D-470c-9D35-A69672D45DC5}.exe
        9⤵
        
        PID:3996
        
        C:\Windows\{E66EB06F-D4F4-4fdc-BE7E-2034BCFF5448}.exe
        
        C:\Windows\{E66EB06F-D4F4-4fdc-BE7E-2034BCFF5448}.exe
        10⤵
        
        PID:1236
        
        C:\Windows\{80A82359-1982-4a14-A36B-DE581C786DBF}.exe
        
        C:\Windows\{80A82359-1982-4a14-A36B-DE581C786DBF}.exe
        11⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E66EB~1.EXE > nul
        11⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4FF1A~1.EXE > nul
        10⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{41DC7~1.EXE > nul
        9⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1A54F~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{77CEA~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A22F~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{970F5~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C44C3~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:5152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{19282~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{192826D2-03E1-49a2-B219-95D031A3E58A}.exe

Path C:\Windows\{192826D2-03E1-49a2-B219-95D031A3E58A}.exe
Size 60KB
SHA256 cec6e1254c6f4972b873d9ef6e217326c46df8a640fcdf2b7a0d19097626d749
MD5 2b0acd3f19c525723743928af7ebbf79
SHA1 f49103e492a8ec6337c818150fa714be4707332a
SHA512 6b59ee49da54a6912903345b60b909b5231fce5299420aeef38fe72bf046569207839dc002da7e27dd70d83cfe5f49a225c6ac7ef33a469a858c817474d21d23
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro14/CFsrdHWMZ:vvw9816vhKQLro14/wQpWMZ
TLSH
T1C7534C830F997CF2F7810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe

Path C:\Windows\{1A54FAB6-08D1-4b4e-A14E-C34CC45336C3}.exe
Size 60KB
SHA256 aad418046cf7c7dcb663ba91faae51c1feabdeccae19d5d34978f8f593e2e521
MD5 c12b4617590ea2fb2247e06c4917b051
SHA1 ace54722a2163144a7d3c2cadc273ef9a86a9d0f
SHA512 8f7743851d93056a48a2698d71d22c66182f3cd9d95bb6a3292f02d70f5aee963dc2ee4c2af797be0599c59725be3e5e657f07747b1e64605dfe736549c80edd
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroR4/CFsrdHWMZ:vvw9816vhKQLroR4/wQpWMZ
TLSH
T1A4533B830F997CF2FB810175047A8BB9926B59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{41DC7480-8359-4112-BAED-E646EBC6F9F4}.exe

Path C:\Windows\{41DC7480-8359-4112-BAED-E646EBC6F9F4}.exe
Size 60KB
SHA256 cb3aaa69b040cd559e0670d73502837405c7abd35c0a91fd64bd5c71cd680902
MD5 3476dbaf242d53eb30e377c1a3ba064d
SHA1 e59aeaea4af6fce1f2c7854d7069345160d8ca97
SHA512 28a7b06a45d3951d6f638174322de8bab7b04254f0a4aa8b3566753e5feb54b1fdbbaeabb9a1d4db662ab896760d774093bcaed7ea083ce86d1ded0a8416c84e
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroD4/CFsrdHWMZ:vvw9816vhKQLroD4/wQpWMZ
TLSH
T10B533B830F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4FF1ABB7-3A7D-470c-9D35-A69672D45DC5}.exe

Path C:\Windows\{4FF1ABB7-3A7D-470c-9D35-A69672D45DC5}.exe
Size 60KB
SHA256 5abc034601c35206bed12414672af67aefb535ba085a1ab2ef5fe717157c2188
MD5 b6c2f005efd36fce1ac3e1056b9cac4a
SHA1 7bd2a41505355f00c00f3225435069a15039652d
SHA512 3380b1ac1140eafbc77c2b175452e07aea63ac52d1ae6a0faba5fbff29bc5614247c294ce5ac9f5d6f3ae9127587888041042c442a6885c1cc0a32fa1d857a77
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrovY4/CFsrdHWMZ:vvw9816vhKQLrovY4/wQpWMZ
TLSH
T1FD534B830F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe

Path C:\Windows\{77CEA8C9-31FF-430a-B497-7B60B5E27C04}.exe
Size 60KB
SHA256 5ff2af095c0723ad6e5e575f5b14c280b7aedacd67da5fc81acd30946945879d
MD5 91d4c4f0baff2f7af768a5139774984b
SHA1 04ad546c228545dda472e8a5fdc2cd61dc6a5f09
SHA512 fa68ce8c8558f33113fe4e59a0e9b2dc795405c1e7b4984a9908491c51e478811126e9707ce255bd8a0003b80af5db1fd338142949c3d3d9498cf1d0c70db760
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroD4/CFsrdHWMZ:vvw9816vhKQLroD4/wQpWMZ
TLSH
T15E534B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7A22F368-40B1-448e-BE98-19138EFE9411}.exe

Path C:\Windows\{7A22F368-40B1-448e-BE98-19138EFE9411}.exe
Size 60KB
SHA256 d6117b8aa7bb3fe2245515d4aeeb4fd86d722d78cde793c2dd9ff84f7b497b96
MD5 79643cbe27441014f006185402af6e5e
SHA1 d6f317ebe9753d866d6f7aebbb6aa98f1b187bab
SHA512 af83e133af7b9f2d6f269ed3d2983f4556e63400a1e6170cd987f3ee465fa0c258809e267ff921457deb77235e71944305e25601e99e57c372e67f3b41bd24b7
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroh4/CFsrdHWMZ:vvw9816vhKQLroh4/wQpWMZ
TLSH
T1AE533B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{80A82359-1982-4a14-A36B-DE581C786DBF}.exe

Path C:\Windows\{80A82359-1982-4a14-A36B-DE581C786DBF}.exe
Size 60KB
SHA256 e438007750bc1186121251cb2f7976f5fe34b3ad1465fc90cdae90828ed36afc
MD5 3f7597e389492365bf0cbe9a8964b5ea
SHA1 91d96e7646226d79a721df0628497166231d6eb2
SHA512 9753ddbf2591bb7e75fa5d799bc241b838d299cce3ade74ee8dc797b93352e143118fef73eca8be93b7b41043e09fa4136878e818227b11df8eb3031f745d5c2
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrog4/CFsrdHWMZ:vvw9816vhKQLrog4/wQpWMZ
TLSH
T121534B830F997CF2FB810175047A8BB9926B59D4D14FFE9BBF90CC194436691E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe

Path C:\Windows\{970F5001-2F6A-46b2-A66B-A702BEA2A104}.exe
Size 60KB
SHA256 84d9627002e2407272d4c3e9c0aedcd8fb21a39b6c63ff2b37f2cf0ff5793244
MD5 bb3125879673d179d8174ec593beabe2
SHA1 5641bd3aec85a259f9210ec216113f5633a7fdf9
SHA512 52ca4a02e4f657679e026f863fd217face700b8394b821db51c25da420a7dc01abe162f906791af626bd6da01283dd03f48ce54decffa699233b2155c536cb44
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroN4/CFsrdHWMZ:vvw9816vhKQLroN4/wQpWMZ
TLSH
T1A4534B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe

Path C:\Windows\{C44C3E63-DC31-43e8-868A-8CB415F7C911}.exe
Size 60KB
SHA256 df0f45b7b04f4af881ab0ccf0a4f37440ee6d6291e2e01bbd889bcf0f1fbb4cf
MD5 7d48c6b011bfe5772202e630077ec3a1
SHA1 7237256fd57c9f4ed903a5f4545acf7d28bed469
SHA512 31d2b9dbe85d16f9267129b3ec75f7f5738f9f3313fc69a37b18a0dfbd1dad608379977f1415742f2c3557ff655581899e440e0342ce67f27c934ed4a0e18add
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro84/CFsrdHWMZ:vvw9816vhKQLro84/wQpWMZ
TLSH
T18B534B830F997CF2FB810175047A8B79926B59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E66EB06F-D4F4-4fdc-BE7E-2034BCFF5448}.exe

Path C:\Windows\{E66EB06F-D4F4-4fdc-BE7E-2034BCFF5448}.exe
Size 60KB
SHA256 63c5935d5c78c6e6552ac4d57b4935a4e56f90da57921f54d9c795b47bb1e3fa
MD5 0ce9cc08f435ea1216ca8ed5199743bb
SHA1 df910949c747068df7434ea3d64e3630d150edb6
SHA512 ae92d40b7f5db23230750e2a7fa274035a1d950982104f8e96b894d017b886bc476b3f4ab47662964ab886d7a9d9a94b6ae9083370e7cd8025be9fc591f4cdc2
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroM4/CFsrdHWMZ:vvw9816vhKQLroM4/wQpWMZ
TLSH
T14A534B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads