stormser | 09bd8452dfb5b0ece03a53b96a385a7a777c39e9366cba700ec86a1377aa9ce0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_8ce1ec3b0484f9cb2f0de4ed3f0837ab_elex_wannacry.exe
Size 116KB
Sample260425-e6lqeafv5w
SHA256 09bd8452dfb5b0ece03a53b96a385a7a777c39e9366cba700ec86a1377aa9ce0
MD5 8ce1ec3b0484f9cb2f0de4ed3f0837ab
SHA1 5011eb58d3827b11ba0343b1f525e541fdfdf033
SHA512 3bf77099e701f0efff877c14d38800b5c5b3956ac3e5735b038c12304dfb901348cb396411a599cba73a73b504602bb6e710cf49f66bc57d0ec19b25c02e53f0
SSDEEP 768:Qvw9816vhKQLrom4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiLJN:YEGh0oml2unMxVS3HgdoKjhLJhL
TLSH
T1EBC3C1295FEA0026F1F3D6749AF556DABE36FC5339058E0E019203064D22F16ED96E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b2db-2.dat	family_stormser
behavioral2/files/0x001a00000002b450-6.dat	family_stormser
behavioral2/files/0x002100000002b2db-8.dat	family_stormser
behavioral2/files/0x001b00000002b450-14.dat	family_stormser
behavioral2/files/0x002200000002b2db-18.dat	family_stormser
behavioral2/files/0x001c00000002b450-23.dat	family_stormser
behavioral2/files/0x000f0000000004aa-26.dat	family_stormser
behavioral2/files/0x000f0000000004ab-30.dat	family_stormser
behavioral2/files/0x00100000000004aa-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D67A4E70-62EA-4c22-A368-07CB072FBC09}\stubpath = "C:\\Windows\\{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe"	{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}	{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E63301F-FE80-414c-A8E8-4EBC1E15B637}	{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA3692CD-EE50-47b0-8397-229053B13C1A}\stubpath = "C:\\Windows\\{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe"	{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E63301F-FE80-414c-A8E8-4EBC1E15B637}\stubpath = "C:\\Windows\\{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe"	{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}\stubpath = "C:\\Windows\\{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe"	{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD241A59-5266-4dbe-B6EB-442AAC29280B}\stubpath = "C:\\Windows\\{DD241A59-5266-4dbe-B6EB-442AAC29280B}.exe"	{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}	2026-04-25_8ce1ec3b0484f9cb2f0de4ed3f0837ab_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}\stubpath = "C:\\Windows\\{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe"	2026-04-25_8ce1ec3b0484f9cb2f0de4ed3f0837ab_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}\stubpath = "C:\\Windows\\{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe"	{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}	{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9052B5AB-38AB-46dd-BC95-4840B059962F}	{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD241A59-5266-4dbe-B6EB-442AAC29280B}	{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D67A4E70-62EA-4c22-A368-07CB072FBC09}	{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}	{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}\stubpath = "C:\\Windows\\{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe"	{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9052B5AB-38AB-46dd-BC95-4840B059962F}\stubpath = "C:\\Windows\\{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe"	{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA3692CD-EE50-47b0-8397-229053B13C1A}	{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe

Executes dropped EXE 9 IoCs

pid	Process
3412	{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe
1376	{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe
4068	{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe
2812	{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe
2652	{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe
2292	{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe
2100	{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe
1676	{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe
4484	{DD241A59-5266-4dbe-B6EB-442AAC29280B}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe	2026-04-25_8ce1ec3b0484f9cb2f0de4ed3f0837ab_elex_wannacry.exe
File created	C:\Windows\{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe	{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe
File created	C:\Windows\{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe	{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe
File created	C:\Windows\{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe	{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe
File created	C:\Windows\{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe	{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe
File created	C:\Windows\{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe	{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe
File created	C:\Windows\{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe	{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe
File created	C:\Windows\{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe	{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe
File created	C:\Windows\{DD241A59-5266-4dbe-B6EB-442AAC29280B}.exe	{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DD241A59-5266-4dbe-B6EB-442AAC29280B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_8ce1ec3b0484f9cb2f0de4ed3f0837ab_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2780	2026-04-25_8ce1ec3b0484f9cb2f0de4ed3f0837ab_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3412	{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe
Token: SeIncBasePriorityPrivilege	1376	{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe
Token: SeIncBasePriorityPrivilege	4068	{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe
Token: SeIncBasePriorityPrivilege	2812	{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe
Token: SeIncBasePriorityPrivilege	2652	{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe
Token: SeIncBasePriorityPrivilege	2292	{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe
Token: SeIncBasePriorityPrivilege	2100	{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe
Token: SeIncBasePriorityPrivilege	1676	{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 3412	2780	2026-04-25_8ce1ec3b0484f9cb2f0de4ed3f0837ab_elex_wannacry.exe	79
PID 2780 wrote to memory of 2452	2780	2026-04-25_8ce1ec3b0484f9cb2f0de4ed3f0837ab_elex_wannacry.exe	80
PID 3412 wrote to memory of 1376	3412	{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe	81
PID 3412 wrote to memory of 4260	3412	{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe	82
PID 1376 wrote to memory of 4068	1376	{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe	83
PID 1376 wrote to memory of 3872	1376	{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe	84
PID 4068 wrote to memory of 2812	4068	{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe	85
PID 4068 wrote to memory of 4820	4068	{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe	86
PID 2812 wrote to memory of 2652	2812	{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe	87
PID 2812 wrote to memory of 1928	2812	{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe	88
PID 2652 wrote to memory of 2292	2652	{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe	89
PID 2652 wrote to memory of 4252	2652	{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe	90
PID 2292 wrote to memory of 2100	2292	{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe	91
PID 2292 wrote to memory of 3528	2292	{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe	92
PID 2100 wrote to memory of 1676	2100	{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe	93
PID 2100 wrote to memory of 3948	2100	{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe	94
PID 1676 wrote to memory of 4484	1676	{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe	95
PID 1676 wrote to memory of 5096	1676	{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-04-25_8ce1ec3b0484f9cb2f0de4ed3f0837ab_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_8ce1ec3b0484f9cb2f0de4ed3f0837ab_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe
  C:\Windows\{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe
    C:\Windows\{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe
      C:\Windows\{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4068
    - - C:\Windows\{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe
        
        C:\Windows\{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2812
      - C:\Windows\{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe
        
        C:\Windows\{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe
        
        C:\Windows\{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe
        
        C:\Windows\{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe
        
        C:\Windows\{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\{DD241A59-5266-4dbe-B6EB-442AAC29280B}.exe
        
        C:\Windows\{DD241A59-5266-4dbe-B6EB-442AAC29280B}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CA369~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9052B~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{503A8~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E633~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0E57F~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1928
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{09CB5~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D67A4~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:3872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{2F204~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe

Path C:\Windows\{09CB511F-31BD-49b3-97C3-EDE3EABCAB21}.exe
Size 116KB
SHA256 cf32738869e23279a234a48f8473f8de8ff00dbe558be763245f7d079a4e0641
MD5 0f77f73b32c8a358b4be75bdb9737351
SHA1 b75a5287d007398ca6758fb783c9ca99baf49e2b
SHA512 5e9b0bc870c44398a59e63333743fca537bdcf1d255dc26bfa27d2a129939b99df5d16928c92375a0e522a91fef318127a4a94ea8be97e39e0289d6d8828debb
SSDEEP 768:Qvw9816vhKQLroh4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiLJN:YEGh0ohl2unMxVS3HgdoKjhLJhL
TLSH
T171C3C1295FEA0026F1F3D6749AF556DABE36FC5339058E0E019203064D22F16ED96E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe

Path C:\Windows\{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe
Size 116KB
SHA256 c54e406f40ff7f3a710480b320a31902e157e4f5ca2571955fbdd91cc2d6b3c1
MD5 50772c3ff63c3d17a0502905f7dbf900
SHA1 1d44b19fbee585480e940db8451a2754738cd473
SHA512 d0c638850f1547c628b21721a3ad56cff95e8134ccc081c923f291d114f3c03290c8c820898338febad7b159a79b0ac333d96c7d0179b60c4ade94047dd71ccd
SSDEEP 768:Qvw9816vhKQLroIq4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiL3:YEGh0ojl2unMxVS3HgdoKjhLJhL
TLSH
T13BC3C1295FEA0026F1F3D6749AF556DABE36FC5339058E0E019203064D22F16ED96E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe

Path C:\Windows\{2F204DE5-37C8-4ea7-A00B-DD85DB60D678}.exe
Size 116KB
SHA256 f1dedfcaf0a45c60cfc5fce5c57fc46199a0ad4547fa370e309c47c442d3a18f
MD5 cfa5d43323cb4746685168cdc5e64663
SHA1 6ca79c66512d98e1cfb887ee7317c85a0c378203
SHA512 0d93652874ff1b237bd2eb4fe34e304f0999581e5252033dbd58ec83ddd62b9f83b2a655245cc44f1ded284748d9c7d31a800b551b52d50c4deadf4aa47fd6d2
SSDEEP 768:Qvw9816vhKQLroD4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiLJN:YEGh0oDl2unMxVS3HgdoKjhLJhL
TLSH
T1FDC3C0295FEA0026F1F3D6749AF556DABE36FC5339058E0E019203064D22F16ED96E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe

Path C:\Windows\{503A8EA7-C8C6-45a9-A1D9-94EC5225710A}.exe
Size 116KB
SHA256 dde7cf57783b8a1b5c96847a89de1b767a71e780a1fa91e678af08480f0943f0
MD5 7436bec01f510228a2308534d2bbc95d
SHA1 bf0d02a1682e03d45cb1c19f773927c9240f8f17
SHA512 c3d4c48e45fbd591b68cba6eb581601c1a372756154f26e2c508f8d259adff7bc55d816c57a5b8e6dc8dbb615724c1ea3e1ecbd462e432e3c3f87386463a256c
SSDEEP 768:Qvw9816vhKQLroNS4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiL3:YEGh0oNSl2unMxVS3HgdoKjhLJhL
TLSH
T10FC3C1296FEA0026F1F3D6749AF556DABE36FC5339058D0E019203064D22F16ED96E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe

Path C:\Windows\{7E63301F-FE80-414c-A8E8-4EBC1E15B637}.exe
Size 116KB
SHA256 72364d763e6812f0fe9fd96b177a88d57698be6e01d287531c18043e87d63aaf
MD5 a3eafe13868e36f3fc74a6dd087b0168
SHA1 3ff8246cbb5acdc86255074662634a8f0f5f2230
SHA512 4bf4e1d91186094394dc7bd517b75e8d8539aa11922a68e8372d05685b33e7890662f7aace324dda2e43c0c71c5985255f8cadae796be067d9183ed0f019993e
SSDEEP 768:Qvw9816vhKQLroa4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiLJN:YEGh0oal2unMxVS3HgdoKjhLJhL
TLSH
T1E3C3C1295FEA0026F1F3D6749AF556DABE36FC5339058E0E019203064D22F16ED96E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe

Path C:\Windows\{9052B5AB-38AB-46dd-BC95-4840B059962F}.exe
Size 116KB
SHA256 95ef6f351bd9e87d82615eb2029c46814fff91531d4cb2c0fd156a1956dc898e
MD5 528d8f0f3c13fb99a3ef5e01f0e5954a
SHA1 1900365d93587b91e0445d65f61052ccd425888f
SHA512 b8a989801945d542de271c1c47225b67275c5a7c55993710b8c62d69926e73ff6f88501fdcce93763c8d69c451d9b88816430ea8843f4858d0890657cdff6c42
SSDEEP 768:Qvw9816vhKQLroA4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiLJN:YEGh0oAl2unMxVS3HgdoKjhLJhL
TLSH
T195C3C1295FEA0026F1F3D6749AF556DABE36FC5339058E0E019203064D22F16ED96E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe

Path C:\Windows\{CA3692CD-EE50-47b0-8397-229053B13C1A}.exe
Size 116KB
SHA256 31535d2462145658a22c49b412f3768c5cdfd7a9c555455039f2ca4d676919ad
MD5 9af6a10a6d290e98dd752f5c03176f72
SHA1 b39c627f034a7dda6f6aea66f48a9b0fb6756fd3
SHA512 a12421ad319f773989fa0a7a745006c333068d08311d3a475376c7d5ae61ccf1ba2a2f9e4dcc69ba8ecc6ac9713ba1128e53664799442c6bd9c882e43f6558cf
SSDEEP 768:Qvw9816vhKQLroW4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiLJN:YEGh0oWl2unMxVS3HgdoKjhLJhL
TLSH
T12CC3C1295FEA0026F1F3D6749AF556DABE36FC5339058E0E019203064D22F16ED96E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe

Path C:\Windows\{D67A4E70-62EA-4c22-A368-07CB072FBC09}.exe
Size 116KB
SHA256 e088a950e9278f8e80ead590a7f3fd18bd5c1d976354165ae5361a130313e26f
MD5 b31c279583ffd3166c194becf382a940
SHA1 d621e7c93910ffcde81e8d3f75f2040a87f0ebd3
SHA512 d8ed1a0a4ca47db4b88a234455b17a65f82c51675d5b576aedffb37a9c4f456292dd8b3eff902f58bb2b5674eb70b85dc679b47d8521fc128fd5643d02d4de08
SSDEEP 768:Qvw9816vhKQLrosL4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiL3:YEGh0osLl2unMxVS3HgdoKjhLJhL
TLSH
T106C3C1295FEA0026F1F3D6749AF556DABE36FC5339058E0E019203064D22F16ED96E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{DD241A59-5266-4dbe-B6EB-442AAC29280B}.exe

Path C:\Windows\{DD241A59-5266-4dbe-B6EB-442AAC29280B}.exe
Size 116KB
SHA256 e05a371bb5864dbb6840c19053772040643be0bd5fc6469557396b75a1d584b2
MD5 ecb035282fe8da76df156cd3188fe273
SHA1 b9930d44be51f7e98cb37de51b60174a1af3761b
SHA512 e8ecc57ab14aad2671612fb8816932267979f47daabd481a9392a9d2179544778b06160071fca9c04e84e0a2cef4cfb2005f64f0eef9736635bdc4f646fdb72b
SSDEEP 768:Qvw9816vhKQLrof4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiLJN:YEGh0ofl2unMxVS3HgdoKjhLJhL
TLSH
T1C8C3C1295FEA0026F1F3D6749AF556DABE36FC5339058E0E019203064D22F16ED96E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads