stormser | 5bd38277df8c81edff60d1b5f024312a5d8890072b42eeae889efd594e231167

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
Size 90KB
Sample260425-e35zwaft7z
SHA256 5bd38277df8c81edff60d1b5f024312a5d8890072b42eeae889efd594e231167
MD5 8b37a81111afefc593771588eba0a215
SHA1 e10752643c4922cd324362d103ccf1fd71b445fc
SHA512 cee277c7ed6b49f23b8cdb0fccc116bdda45c9bbd86ebcdefa7a4e8d1625a54dc8797d65ea63d8498dd4e1adf0a17677ef0c03cdd610b54c1d88e641cb59b2f0
SSDEEP 768:Qvw9816vhKQLroS4/wQRNrfrunMxVFA3b7gl/:YEGh0oSl2unMxVS3HgR
TLSH
T15893B43D5DDA1037E2B7D6B585F126E3FE66B983360A1D0E469243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b29d-2.dat	family_stormser
behavioral2/files/0x001a00000002b398-7.dat	family_stormser
behavioral2/files/0x002100000002b29d-10.dat	family_stormser
behavioral2/files/0x001b00000002b398-15.dat	family_stormser
behavioral2/files/0x002200000002b29d-19.dat	family_stormser
behavioral2/files/0x001c00000002b398-23.dat	family_stormser
behavioral2/files/0x002300000002b29d-26.dat	family_stormser
behavioral2/files/0x000b000000024f5d-31.dat	family_stormser
behavioral2/files/0x0003000000024f90-33.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}	{30201549-A174-4ef2-8929-55093DA1229E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B0FF9EB-5905-4a16-807E-B50F6859E28C}\stubpath = "C:\\Windows\\{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe"	{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}	{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44F34B0E-1B0E-4933-A6CA-36BE040255CE}\stubpath = "C:\\Windows\\{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe"	{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F3D2284-F536-4a09-A79F-EF35D0C2F0A1}\stubpath = "C:\\Windows\\{7F3D2284-F536-4a09-A79F-EF35D0C2F0A1}.exe"	{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30201549-A174-4ef2-8929-55093DA1229E}\stubpath = "C:\\Windows\\{30201549-A174-4ef2-8929-55093DA1229E}.exe"	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B0FF9EB-5905-4a16-807E-B50F6859E28C}	{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}	{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}	{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}\stubpath = "C:\\Windows\\{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe"	{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}\stubpath = "C:\\Windows\\{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe"	{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30201549-A174-4ef2-8929-55093DA1229E}	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}\stubpath = "C:\\Windows\\{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe"	{30201549-A174-4ef2-8929-55093DA1229E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}\stubpath = "C:\\Windows\\{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe"	{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76DEF468-3914-4ad2-8C14-83F12B059A6D}	{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76DEF468-3914-4ad2-8C14-83F12B059A6D}\stubpath = "C:\\Windows\\{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe"	{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44F34B0E-1B0E-4933-A6CA-36BE040255CE}	{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F3D2284-F536-4a09-A79F-EF35D0C2F0A1}	{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe

Executes dropped EXE 9 IoCs

pid	Process
3392	{30201549-A174-4ef2-8929-55093DA1229E}.exe
2536	{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe
4912	{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe
3860	{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe
2052	{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe
3384	{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe
4340	{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe
2080	{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe
3104	{7F3D2284-F536-4a09-A79F-EF35D0C2F0A1}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe	{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe
File created	C:\Windows\{7F3D2284-F536-4a09-A79F-EF35D0C2F0A1}.exe	{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe
File created	C:\Windows\{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe	{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe
File created	C:\Windows\{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe	{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe
File created	C:\Windows\{30201549-A174-4ef2-8929-55093DA1229E}.exe	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
File created	C:\Windows\{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe	{30201549-A174-4ef2-8929-55093DA1229E}.exe
File created	C:\Windows\{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe	{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe
File created	C:\Windows\{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe	{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe
File created	C:\Windows\{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe	{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7F3D2284-F536-4a09-A79F-EF35D0C2F0A1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{30201549-A174-4ef2-8929-55093DA1229E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5020	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3392	{30201549-A174-4ef2-8929-55093DA1229E}.exe
Token: SeIncBasePriorityPrivilege	2536	{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe
Token: SeIncBasePriorityPrivilege	4912	{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe
Token: SeIncBasePriorityPrivilege	3860	{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe
Token: SeIncBasePriorityPrivilege	2052	{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe
Token: SeIncBasePriorityPrivilege	3384	{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe
Token: SeIncBasePriorityPrivilege	4340	{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe
Token: SeIncBasePriorityPrivilege	2080	{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3392	5020	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe	80
PID 5020 wrote to memory of 2120	5020	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe	81
PID 3392 wrote to memory of 2536	3392	{30201549-A174-4ef2-8929-55093DA1229E}.exe	82
PID 3392 wrote to memory of 580	3392	{30201549-A174-4ef2-8929-55093DA1229E}.exe	83
PID 2536 wrote to memory of 4912	2536	{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe	84
PID 2536 wrote to memory of 4464	2536	{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe	85
PID 4912 wrote to memory of 3860	4912	{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe	86
PID 4912 wrote to memory of 3236	4912	{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe	87
PID 3860 wrote to memory of 2052	3860	{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe	88
PID 3860 wrote to memory of 2656	3860	{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe	89
PID 2052 wrote to memory of 3384	2052	{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe	90
PID 2052 wrote to memory of 1812	2052	{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe	91
PID 3384 wrote to memory of 4340	3384	{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe	92
PID 3384 wrote to memory of 3828	3384	{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe	93
PID 4340 wrote to memory of 2080	4340	{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe	94
PID 4340 wrote to memory of 3476	4340	{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe	95
PID 2080 wrote to memory of 3104	2080	{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe	96
PID 2080 wrote to memory of 3428	2080	{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\{30201549-A174-4ef2-8929-55093DA1229E}.exe
  C:\Windows\{30201549-A174-4ef2-8929-55093DA1229E}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe
    C:\Windows\{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe
      C:\Windows\{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Windows\{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe
        
        C:\Windows\{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3860
      - C:\Windows\{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe
        
        C:\Windows\{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe
        
        C:\Windows\{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe
        
        C:\Windows\{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe
        
        C:\Windows\{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\{7F3D2284-F536-4a09-A79F-EF35D0C2F0A1}.exe
        
        C:\Windows\{7F3D2284-F536-4a09-A79F-EF35D0C2F0A1}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{44F34~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1AC34~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{76DEF~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5FC44~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1812
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3DBDF~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6B0FF~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8D8E7~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{30201~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe

Path C:\Windows\{1AC34201-70E6-4ea0-BF12-329ABF57A9EB}.exe
Size 90KB
SHA256 a1fd3d237f11cf2dbbb35c9f6e130cd5bde83038f845125f080f703dcdb28dff
MD5 1fce0612958902f13d9ede0393859dbe
SHA1 e11829f44976edeb7ef13bd670640f98c8392f72
SHA512 8abef0589a9ed1db31f49b47ccc89866d189dc53449d7603ff6c630a52d95bed30d7964082dcd518dd6b8d6cd67d035dcee8a093041e1ad0981b4e201ba5990a
SSDEEP 768:Qvw9816vhKQLroK4/wQRNrfrunMxVFA3b7gl/:YEGh0oKl2unMxVS3HgR
TLSH
T16993B43D5DDA1037E277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{30201549-A174-4ef2-8929-55093DA1229E}.exe

Path C:\Windows\{30201549-A174-4ef2-8929-55093DA1229E}.exe
Size 90KB
SHA256 39f108c4ab9f57278060e4595e82e2422b7a5a87de21266cfd45f1f769b03574
MD5 cbf95a375b110a2d23ea01893211994c
SHA1 54ef3bb6821991477896f0b48df86ced7c40d5ec
SHA512 5b825fc9cbd49f0137344eeb2d6f8138ef184084cebc184833ce04a705076c13e261dd427e32f3bb9ac4442331bf2772aee50d5368e7181d8c925feb0cf47f05
SSDEEP 768:Qvw9816vhKQLroq4/wQRNrfrunMxVFA3b7gl/:YEGh0oql2unMxVS3HgR
TLSH
T12493B43D5DDA1037E2B7D6B585F126E3FE66B983390A1D0E469243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe

Path C:\Windows\{3DBDF7EA-C285-4103-BDCA-08250D8F4F0A}.exe
Size 90KB
SHA256 e600dc258051fdd292783b5ed4f416854acfea17057e8319bc8c13f68a09f41c
MD5 25bcc3965ae3151eba0c411dd135baec
SHA1 440c38501e1dc32a36a676fe49345008d323dd39
SHA512 51dfd4cce234723e3369b2411e62adc1d19271c7ffd6dba1181620de4ac74ea43c2f20eba472d717467ce2940f16ac8be1396be6863e2ddcabee1e4770b79433
SSDEEP 768:Qvw9816vhKQLrom4/wQRNrfrunMxVFA3b7gl/:YEGh0oml2unMxVS3HgR
TLSH
T15293B43D5DDA1037E2B7D6B585F126E3FE66B983390A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe

Path C:\Windows\{44F34B0E-1B0E-4933-A6CA-36BE040255CE}.exe
Size 90KB
SHA256 3c8c84d0ead3994c6264651f54b944cb97d6ea84b415e4b3d44a5d6e2c0afe4e
MD5 07a809d5fea3773df68af95a306f2acf
SHA1 59620e972842561174a2c417d37d6ffe6c897be1
SHA512 2465e2a114c66fb1db91b9d1a2f5a0cc349157883647986d08ddaa85ae8c26e56b72683563e2c0527151f52999df5e6a74a91567a04fbb4fcfe63823e145b17a
SSDEEP 768:Qvw9816vhKQLroY4/wQRNrfrunMxVFA3b7gl/:YEGh0oYl2unMxVS3HgR
TLSH
T1E493B43D5DDA1037E277D6B585F126E3FE66B983360A1D0E469243428D23B53AD86C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe

Path C:\Windows\{5FC446EB-24BB-4f04-8E9B-D91B7183BF52}.exe
Size 90KB
SHA256 6618c51883db8d5d758573a064ad605e0e215588240fad70e37b52aed7e8e199
MD5 5cd0b906d7fb67547ab52c52ecae9299
SHA1 09a1d3e33bb04e6fc4ad132ba5e49d3502c8ce24
SHA512 bf2be4854573698d8a4458f97184499e4dbfcde5ae98743b50a47fbcf441a0189d5f6a7699312cf017ee131e7dbe945198dfaf8491981fcd450545d4a2872c12
SSDEEP 768:Qvw9816vhKQLro74/wQRNrfrunMxVFA3b7gl/:YEGh0o7l2unMxVS3HgR
TLSH
T17A93B43D5DDA1037E2B7D6B585F126E3FE66B983390A1D0E46D243428D23B53AD86C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe

Path C:\Windows\{6B0FF9EB-5905-4a16-807E-B50F6859E28C}.exe
Size 90KB
SHA256 ba531e118c5373a3c702e457ddc67e7e4e1e2045343916bc4037c77399f955a4
MD5 b7be971d3fe7ea6848f6829f29e42be6
SHA1 82db906a5f2e1194dd4e379a057a1a2faa85ab77
SHA512 f262468d5e44ef651463deef427c322505d046a4dd6c8f6a70e1ed83bfcc1db324edc200a0721c1cccca14dc8b79227147cb31f29c3cb7563301d37cbc9691b0
SSDEEP 768:Qvw9816vhKQLroI4/wQRNrfrunMxVFA3b7gl/:YEGh0oIl2unMxVS3HgR
TLSH
T13C93B43D5DDA1037E277D6B585F126E3FE66B983390A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe

Path C:\Windows\{76DEF468-3914-4ad2-8C14-83F12B059A6D}.exe
Size 90KB
SHA256 d0089febdee02fffad891f0f62ef037e102ec25120146dc3409d43dcd63b1d61
MD5 9c3f945ed8951577c63293d39e832faf
SHA1 f9d7d8f027e3ec4857c27dddf179350cd24bb878
SHA512 3efd7d1cae1fadeed61717367cd7c54c5ac6c6b2c0c686530165b1ef68803bade4523bf8deceb9206c926e8ad5c12b387650045944dd60f6b926359b45c8d365
SSDEEP 768:Qvw9816vhKQLroT4/wQRNrfrunMxVFA3b7gl/:YEGh0oTl2unMxVS3HgR
TLSH
T12593B43D5DDA1037E2B7D6B585F126E3FE66B983390A1D0E469243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7F3D2284-F536-4a09-A79F-EF35D0C2F0A1}.exe

Path C:\Windows\{7F3D2284-F536-4a09-A79F-EF35D0C2F0A1}.exe
Size 90KB
SHA256 3294bd5e14be2620d3c6af66cc72bb3a44e8fa834a13741349fe604efd4188cf
MD5 6f5dbd97b6673ec1c5b7b59d6b814553
SHA1 e1976662212dc9b675f618f27f7b5ec9901b6ff5
SHA512 db8b810094d1ddc6344b43371672b80a010a5ddd8bcd7cfe33837a4f95c48d9fb3667b842aaef4b666d6e6bb4bfdedef6881164ab66f712fec37dc1d050d769f
SSDEEP 768:Qvw9816vhKQLroF4/wQRNrfrunMxVFA3b7gl/:YEGh0oFl2unMxVS3HgR
TLSH
T19793B43D5DDA1037E2B7D6B585F126E3FE66B983360A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe

Path C:\Windows\{8D8E78AC-DE3E-4d51-89D4-EBC820AF0F36}.exe
Size 90KB
SHA256 065565af1a16bfcb19fe012d11b60e60c4e047ea33a904c7382fc2a852e3c1c4
MD5 e282979bbe1c184b54ede32fbd43fa7e
SHA1 5c02d41162a2f4d4742620e9dd6d7a4610784873
SHA512 e818b3539ac2813877246ef521d84ec88edf70e0dd261a4d55656ed0892cc59620f88425fd9b1cc8f36f60b13f5b2cb6a087a645eddfe032eedf391b4719a019
SSDEEP 768:Qvw9816vhKQLroG4/wQRNrfrunMxVFA3b7gl/:YEGh0oGl2unMxVS3HgR
TLSH
T19E93B43D5DDA1037E2B7D6B585F126E3FE66B983350A1D0E469343428D23B53AD86C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads