754415a061bf8144bdffa0f500506e6a964393223e95f83e1817648bf044c79f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe
Size 2.1MB
Sample260511-vmjppsax6m
SHA256 754415a061bf8144bdffa0f500506e6a964393223e95f83e1817648bf044c79f
MD5 e1e8c6ee362b6a60d9e66d62c6f2697f
SHA1 be3818c68c1521944059e5a928dff7d8be1d1555
SHA512 3ceb387d328f0872b116036df1a4051d543f94edff0939d2629279bb19cdacc5d50c51afb81658e378438c7beabb474ad46af000e8d07d2891d36757390aabcf
SSDEEP 24576:hbCj2sObHtqQEdNYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W3:hbCjPKNidNFIbBMy3
TLSH
T174A5D0C6F2EA40E6DC023FF5582567C78B344736473840597BAA3D498F234A9C16EBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5264	winmgr21.exe
2944	winmgr21.exe
1276	winmgr21.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr21.exe"	2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr21.exe"	winmgr21.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3968-0-0x0000000000400000-0x000000000062F000-memory.dmp	autoit_exe
behavioral2/files/0x000500000002a73c-6.dat	autoit_exe
behavioral2/memory/5264-8-0x0000000000400000-0x000000000062F000-memory.dmp	autoit_exe
behavioral2/files/0x000200000002a747-9.dat	autoit_exe
behavioral2/memory/2944-20-0x0000000000400000-0x000000000062F000-memory.dmp	autoit_exe
behavioral2/memory/1276-42-0x0000000000400000-0x000000000062F000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5264 set thread context of 4036	5264	winmgr21.exe	80
PID 4036 set thread context of 5980	4036	RegAsm.exe	83

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe:Zone.Identifier:$DATA	2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe
File created	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe:Zone.Identifier:$DATA	2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe
File created	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 26 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4348	schtasks.exe
6044	schtasks.exe
3940	schtasks.exe
272	schtasks.exe
6080	schtasks.exe
3928	schtasks.exe
1832	schtasks.exe
4784	schtasks.exe
6024	schtasks.exe
5440	schtasks.exe
4916	schtasks.exe
3404	schtasks.exe
4864	schtasks.exe
2588	schtasks.exe
1328	schtasks.exe
4472	schtasks.exe
2360	schtasks.exe
6104	schtasks.exe
5620	schtasks.exe
5752	schtasks.exe
5352	schtasks.exe
2172	schtasks.exe
3600	schtasks.exe
2816	schtasks.exe
736	schtasks.exe
3140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
3968	2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe
3968	2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
2944	winmgr21.exe
2944	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
1276	winmgr21.exe
1276	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe
5264	winmgr21.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
3968	2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe
5264	winmgr21.exe
2944	winmgr21.exe
1276	winmgr21.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	RegAsm.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 5264	3968	2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe	79
PID 5264 wrote to memory of 4036	5264	winmgr21.exe	80
PID 5264 wrote to memory of 4036	5264	winmgr21.exe	80
PID 5264 wrote to memory of 4036	5264	winmgr21.exe	80
PID 5264 wrote to memory of 4916	5264	winmgr21.exe	81
PID 4036 wrote to memory of 5980	4036	RegAsm.exe	83
PID 4036 wrote to memory of 5980	4036	RegAsm.exe	83
PID 4036 wrote to memory of 5980	4036	RegAsm.exe	83
PID 4036 wrote to memory of 5980	4036	RegAsm.exe	83
PID 4036 wrote to memory of 5980	4036	RegAsm.exe	83
PID 4036 wrote to memory of 5980	4036	RegAsm.exe	83
PID 5264 wrote to memory of 6104	5264	winmgr21.exe	86
PID 5264 wrote to memory of 3928	5264	winmgr21.exe	88
PID 5264 wrote to memory of 3140	5264	winmgr21.exe	90
PID 5264 wrote to memory of 3404	5264	winmgr21.exe	92
PID 5264 wrote to memory of 4864	5264	winmgr21.exe	94
PID 5264 wrote to memory of 2588	5264	winmgr21.exe	96
PID 5264 wrote to memory of 1832	5264	winmgr21.exe	98
PID 5264 wrote to memory of 4348	5264	winmgr21.exe	100
PID 5264 wrote to memory of 5620	5264	winmgr21.exe	102
PID 5264 wrote to memory of 1328	5264	winmgr21.exe	104
PID 5264 wrote to memory of 4784	5264	winmgr21.exe	106
PID 5264 wrote to memory of 4472	5264	winmgr21.exe	108
PID 5264 wrote to memory of 5440	5264	winmgr21.exe	110
PID 5264 wrote to memory of 2360	5264	winmgr21.exe	112
PID 5264 wrote to memory of 5752	5264	winmgr21.exe	114
PID 5264 wrote to memory of 5352	5264	winmgr21.exe	117
PID 5264 wrote to memory of 2172	5264	winmgr21.exe	119
PID 5264 wrote to memory of 3600	5264	winmgr21.exe	121
PID 5264 wrote to memory of 6044	5264	winmgr21.exe	123
PID 5264 wrote to memory of 2816	5264	winmgr21.exe	125
PID 5264 wrote to memory of 736	5264	winmgr21.exe	127
PID 5264 wrote to memory of 6024	5264	winmgr21.exe	129
PID 5264 wrote to memory of 3940	5264	winmgr21.exe	131
PID 5264 wrote to memory of 272	5264	winmgr21.exe	133
PID 5264 wrote to memory of 6080	5264	winmgr21.exe	135

C:\Users\Admin\AppData\Local\Temp\2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe"
1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3968
- C:\ProgramData\winmgr21.exe
  C:\ProgramData\winmgr21.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /stext C:\ProgramData\Mails.txt
      4⤵
      PID:5980
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4916
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6104
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3928
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3140
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3404
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4864
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2588
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1832
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4348
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5620
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1328
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4784
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4472
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5440
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2360
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5752
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5352
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2172
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3600
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6044
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2816
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:736
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6024
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:272
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6080

C:\ProgramData\winmgr21.exe
C:\ProgramData\winmgr21.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2944

C:\ProgramData\winmgr21.exe
C:\ProgramData\winmgr21.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winmgr21.exe

Path C:\ProgramData\winmgr21.exe
Size 2.1MB
SHA256 9f218b937629733bb7d41d9006165b5b55d56aea4e4e6428ba60447329aa2165
MD5 1357568f876b3ab58ae0d873b0564de7
SHA1 1f1e121cadf7b96d9fb5c59071c1b6d3cd83f41a
SHA512 a4f924f517fb8f0fe0c2fb7bb318ee1d30d8894ac80f8bbb19cf30c223de9b5412276a0d0284a5f6140d6f180c7dbe515488529888592eb83d227efe0b1f65f3
SSDEEP 24576:hbCj2sObHtqQEdNYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W2:hbCjPKNidNFIbBMy2
TLSH
T171A5D0C6F2EA40E6DC023FF5582567C78B344736473840597BAA3D498F234A9C16EBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_e1e8c6ee362b6a60d9e66d62c6f2697f_elex_stop.exe
Size 2.1MB
SHA256 754415a061bf8144bdffa0f500506e6a964393223e95f83e1817648bf044c79f
MD5 e1e8c6ee362b6a60d9e66d62c6f2697f
SHA1 be3818c68c1521944059e5a928dff7d8be1d1555
SHA512 3ceb387d328f0872b116036df1a4051d543f94edff0939d2629279bb19cdacc5d50c51afb81658e378438c7beabb474ad46af000e8d07d2891d36757390aabcf
SSDEEP 24576:hbCj2sObHtqQEdNYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W3:hbCjPKNidNFIbBMy3
TLSH
T174A5D0C6F2EA40E6DC023FF5582567C78B344736473840597BAA3D498F234A9C16EBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-48-0x0000000000BF0000-0x0000000000C8C000-memory.dmp

Download

memory/1276-46-0x0000000000BF0000-0x0000000000C8C000-memory.dmp

Download

memory/1276-42-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/2944-20-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/2944-28-0x0000000000BD0000-0x0000000000C6C000-memory.dmp

Download

memory/2944-25-0x0000000000BD0000-0x0000000000C6C000-memory.dmp

Download

memory/3968-11-0x0000000001C00000-0x0000000001C9C000-memory.dmp

Download

memory/3968-0-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/4036-17-0x00000000730A0000-0x0000000073651000-memory.dmp

Download

memory/4036-23-0x0000000001460000-0x000000000147A000-memory.dmp

Download

memory/4036-24-0x00000000730A0000-0x0000000073651000-memory.dmp

Download

memory/4036-16-0x00000000730A1000-0x00000000730A2000-memory.dmp

Download

memory/4036-15-0x00000000011B0000-0x000000000125A000-memory.dmp

Download

memory/5264-12-0x00000000013D0000-0x000000000146C000-memory.dmp

Download

memory/5264-8-0x0000000000400000-0x000000000062F000-memory.dmp

Download