stormser | 711609361769d1926a2e444fc0fa33eef44db1d5e8487a1dc8f17fe97ace314f

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_87806136bc0645c0bde8241c5001bb6a_elex_wannacry.exe
Size 372KB
Sample260507-endxvaex41
SHA256 711609361769d1926a2e444fc0fa33eef44db1d5e8487a1dc8f17fe97ace314f
MD5 87806136bc0645c0bde8241c5001bb6a
SHA1 a1bb462412c0f93c582a57e4b832eed6fe2ff0a3
SHA512 4a342f797be9fd69de7841c7218d48120644c753c5cb04946167231ed3a4913deaa6280c1829009b0c8bd31f04423d7817515b0c0eb9ca5721eeb4f8536780f0
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroyx4/CFsrdb:Gvw9816vhKQLroyx4/wQR
TLSH
T10E8409835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD150037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b145-2.dat	family_stormser
behavioral2/files/0x001c00000002b27e-6.dat	family_stormser
behavioral2/files/0x001e00000002b145-10.dat	family_stormser
behavioral2/files/0x001d00000002b27e-14.dat	family_stormser
behavioral2/files/0x001f00000002b145-19.dat	family_stormser
behavioral2/files/0x001e00000002b27e-22.dat	family_stormser
behavioral2/files/0x002000000002b145-26.dat	family_stormser
behavioral2/files/0x000b000000024f5d-30.dat	family_stormser
behavioral2/files/0x0003000000024f90-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB608169-CF35-4432-B00B-08C95B9CAC6F}	{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24E97E95-1CF2-4eac-9BC1-4C943008887C}\stubpath = "C:\\Windows\\{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe"	2026-05-07_87806136bc0645c0bde8241c5001bb6a_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}\stubpath = "C:\\Windows\\{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe"	{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE01A62E-7BA8-4517-A332-1F5155F707DD}\stubpath = "C:\\Windows\\{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe"	{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6729707C-4926-486b-8EB7-3976D7F30C6C}	{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}	{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}	{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}\stubpath = "C:\\Windows\\{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe"	{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}	{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}\stubpath = "C:\\Windows\\{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe"	{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB9E6801-20E1-419a-9157-CB86FEE7916C}\stubpath = "C:\\Windows\\{EB9E6801-20E1-419a-9157-CB86FEE7916C}.exe"	{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6729707C-4926-486b-8EB7-3976D7F30C6C}\stubpath = "C:\\Windows\\{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe"	{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24E97E95-1CF2-4eac-9BC1-4C943008887C}	2026-05-07_87806136bc0645c0bde8241c5001bb6a_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}	{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}\stubpath = "C:\\Windows\\{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe"	{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE01A62E-7BA8-4517-A332-1F5155F707DD}	{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB608169-CF35-4432-B00B-08C95B9CAC6F}\stubpath = "C:\\Windows\\{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe"	{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB9E6801-20E1-419a-9157-CB86FEE7916C}	{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe

Executes dropped EXE 9 IoCs

pid	Process
2536	{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe
760	{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe
2524	{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe
2740	{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe
2872	{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe
1360	{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe
5048	{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe
2544	{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe
5116	{EB9E6801-20E1-419a-9157-CB86FEE7916C}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe	{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe
File created	C:\Windows\{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe	{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe
File created	C:\Windows\{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe	2026-05-07_87806136bc0645c0bde8241c5001bb6a_elex_wannacry.exe
File created	C:\Windows\{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe	{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe
File created	C:\Windows\{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe	{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe
File created	C:\Windows\{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe	{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe
File created	C:\Windows\{EB9E6801-20E1-419a-9157-CB86FEE7916C}.exe	{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe
File created	C:\Windows\{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe	{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe
File created	C:\Windows\{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe	{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EB9E6801-20E1-419a-9157-CB86FEE7916C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_87806136bc0645c0bde8241c5001bb6a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4520	2026-05-07_87806136bc0645c0bde8241c5001bb6a_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2536	{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe
Token: SeIncBasePriorityPrivilege	760	{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe
Token: SeIncBasePriorityPrivilege	2524	{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe
Token: SeIncBasePriorityPrivilege	2740	{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe
Token: SeIncBasePriorityPrivilege	2872	{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe
Token: SeIncBasePriorityPrivilege	1360	{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe
Token: SeIncBasePriorityPrivilege	5048	{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe
Token: SeIncBasePriorityPrivilege	2544	{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 2536	4520	2026-05-07_87806136bc0645c0bde8241c5001bb6a_elex_wannacry.exe	80
PID 4520 wrote to memory of 3928	4520	2026-05-07_87806136bc0645c0bde8241c5001bb6a_elex_wannacry.exe	81
PID 2536 wrote to memory of 760	2536	{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe	82
PID 2536 wrote to memory of 4948	2536	{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe	83
PID 760 wrote to memory of 2524	760	{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe	84
PID 760 wrote to memory of 1376	760	{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe	85
PID 2524 wrote to memory of 2740	2524	{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe	86
PID 2524 wrote to memory of 1312	2524	{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe	87
PID 2740 wrote to memory of 2872	2740	{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe	88
PID 2740 wrote to memory of 1080	2740	{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe	89
PID 2872 wrote to memory of 1360	2872	{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe	90
PID 2872 wrote to memory of 3444	2872	{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe	91
PID 1360 wrote to memory of 5048	1360	{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe	92
PID 1360 wrote to memory of 3372	1360	{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe	93
PID 5048 wrote to memory of 2544	5048	{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe	94
PID 5048 wrote to memory of 4700	5048	{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe	95
PID 2544 wrote to memory of 5116	2544	{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe	96
PID 2544 wrote to memory of 3104	2544	{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-05-07_87806136bc0645c0bde8241c5001bb6a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_87806136bc0645c0bde8241c5001bb6a_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe
  C:\Windows\{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe
    C:\Windows\{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe
      C:\Windows\{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\Windows\{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe
        
        C:\Windows\{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2740
      - C:\Windows\{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe
        
        C:\Windows\{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe
        
        C:\Windows\{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe
        
        C:\Windows\{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe
        
        C:\Windows\{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\{EB9E6801-20E1-419a-9157-CB86FEE7916C}.exe
        
        C:\Windows\{EB9E6801-20E1-419a-9157-CB86FEE7916C}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{75DAF~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CB608~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{01CC4~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{67297~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CE01A~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1080
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CC5E1~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{AA005~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{24E97~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe

Path C:\Windows\{01CC416F-8E41-4aa5-9DD7-4930180FAB5C}.exe
Size 372KB
SHA256 2ed97e2fa437b42643f4c31e5bdcfc9898e680c6c0c631ae2e82d5b9f01c83d7
MD5 98eb9fdfdd0678bcc83bb0bb07663cc3
SHA1 203af14b32895c57e37e72690a02dba1bc32d6f3
SHA512 202fbb81bc071d3a2c5e329e83d7669559820789afda6aff6b3e3e1ae2b3f4b31a76fd3497ef3479ec8178d6005e621af8aa7ed6c35453784d2ba9c2415eedd8
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroWx4/CFsrdb:Gvw9816vhKQLroWx4/wQR
TLSH
T149841A835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD150037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe

Path C:\Windows\{24E97E95-1CF2-4eac-9BC1-4C943008887C}.exe
Size 372KB
SHA256 771f74f5eb3e01a8fd8f902188939590e0c4c84187b819d55a7ae05b31d3d67d
MD5 8fecc7321332455e3991a38486f67174
SHA1 4b68dd16f6d7f838edb9e8440efd5fad1950305d
SHA512 b64401319bcb8f1733e6d41e8ae085ca171327bbb4a5ec3ecc1335fc0b4ee517b10192134ca3ccdb044bdb0ddc72342931d7f5d6a267e868af4738512fd1f72f
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroYx4/CFsrdb:Gvw9816vhKQLroYx4/wQR
TLSH
T1448409835BDE9CF2FB91113009798AB9927B9AD4910EBEDFBF90CD150037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe

Path C:\Windows\{6729707C-4926-486b-8EB7-3976D7F30C6C}.exe
Size 372KB
SHA256 c831a013201e520da1231412328ab5fa5d65787275499c1457091e341b8dff77
MD5 df3a9b6c15d596321ed395fad14e93c9
SHA1 9932482f1b01c5440af1f4f170a3a57d39146752
SHA512 517b5e47a4bbd86e0e4410eb7e556191d0e6a88404a470f25e55135a0b29c569c26b48ae2978bb2840c060ffda68ca55b3cd5619cfe16df02f9553fb3b10e5eb
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroePx4/CFsrdb:Gvw9816vhKQLroSx4/wQR
TLSH
T16B8409835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD550037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe

Path C:\Windows\{75DAFFE4-EE1C-47fe-9EE2-49C8134855CB}.exe
Size 372KB
SHA256 8a9f269a8bf8c6a50b283b6cb4221e21d7ceb0bb0cd973e3b9f5e1d06d66936d
MD5 167d2e414391c179a42d025d6ba47c23
SHA1 627336c6e9283e50e97fb9b5f376ce3353e58415
SHA512 8bf70b39ebbe77b6cc31cb0d130689da6c1ba782c0d87914a64424fe127890bb9cb4c71fd049c2a9cf5acdf15cdc481586c5a691872f167e65ae559888212b74
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLro5x4/CFsrdb:Gvw9816vhKQLro5x4/wQR
TLSH
T1358418835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD150437292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe

Path C:\Windows\{AA0053B9-9EA1-47e5-AEC9-C3DC6C5C08BF}.exe
Size 372KB
SHA256 d1b456a5591a7ed727a618c1455acfdedb2f39a6cc66cc0e86474e1f3b24bef6
MD5 6ca80cf961792ba83dfa33b8f9fe2b10
SHA1 fdccbee85d1e9b931235d81224bd5b623ed4f71c
SHA512 810cee5a73aa711f19eeb2dbbf021d74f9da1620b2416cf2746dd3575a1f31402fc04e6a960280fc7ce2507cd8fca272d74e11034747b64306eb0f1de6bd9765
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrofx4/CFsrdb:Gvw9816vhKQLrofx4/wQR
TLSH
T19D8409835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD150037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe

Path C:\Windows\{CB608169-CF35-4432-B00B-08C95B9CAC6F}.exe
Size 372KB
SHA256 3f84aa8837348c892b821b53c4caecb334b839b3b3881b7438a7976f24a7fbea
MD5 f29c13e6c29aca97f8fc76ba64bf5131
SHA1 b6c693a5b7354eb2dac2c1a60470fef387e18466
SHA512 b20d3b9fa6274023f385811e4e496d1134020ab435e42c4c1405cf06a58bd2337f1a043d1fd67412be5c7fcc4c92ee4e2109a70eda45be3f1abefa3ff41c0798
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroVx4/CFsrdb:Gvw9816vhKQLroVx4/wQR
TLSH
T1588419835BDE9CF2FB91113009798AB9927B9AC4910EBEDFBF90CD150037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe

Path C:\Windows\{CC5E11FD-8D78-4aba-8CE3-148E60BC9DAA}.exe
Size 372KB
SHA256 9ee792d5ce3f0735fbb76fb1851e9bc15d6f73b362b5d43cacaf62af01079d3a
MD5 f99df74a8e8f9ffc1bf254de3bfc2fe7
SHA1 9daa4c4133282c3303c5e44b4a420bff0d3e194b
SHA512 54fe57b93eff4e27ace5f70fc5e03fe55c7195f7b99564432a3ce36af41cc944091d8b84a54e86dae74243dd8fda7f0abfd37a73389f596a4a099b1970ecbc0e
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroJx4/CFsrdb:Gvw9816vhKQLroJx4/wQR
TLSH
T1408409835BDE9CF2FB91113009798AB9927B99C4910EBEDFBF90CD150037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe

Path C:\Windows\{CE01A62E-7BA8-4517-A332-1F5155F707DD}.exe
Size 372KB
SHA256 52674a9bf55dc2d5a832d90e527aab268d8aee8a63a25da6927c39b606e450dc
MD5 87a39bc4c4914a8eaca8a55a40850784
SHA1 b83750fb2f73d1e08f82b011ab5e76bbafa929ba
SHA512 7c3979d5b9fbcdd13316dec82995b74b96e61c26841ad29a931d29bdfb73bc9401dccea838e6c0d305a09f18d97a93cfd5d3c89d8908883d6ef53784a3dff555
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroVx4/CFsrdb:Gvw9816vhKQLroVx4/wQR
TLSH
T1A78408835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD550037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{EB9E6801-20E1-419a-9157-CB86FEE7916C}.exe

Path C:\Windows\{EB9E6801-20E1-419a-9157-CB86FEE7916C}.exe
Size 372KB
SHA256 818a4807e67687336d39f7dc3b35e546fd8a6420849aa9d3c766a21765a0df78
MD5 5de33105a530e74f78874d888dbf72b3
SHA1 e64b6609d85a71a808fb110950eba5bee3468aa6
SHA512 02d455c164102b2b273e46f13f7b4def0395dbfc6535d16331ad26d5d8bd14824d3664de064472e9fcdeb36be88e5f7f877e2b0f1c0ba1e823cb05725cb5685d
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLro1x4/CFsrdb:Gvw9816vhKQLro1x4/wQR
TLSH
T1BE8418835BDE9CF2FB91117009798AB9927B9AC4910EBEDFBF90CD550037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads