7272ad35a6a98b855f2594bb57608862fe23caa1b611b31f41a9247be1d96771

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe
Size 2.1MB
Sample260517-lnrx2aat3j
SHA256 7272ad35a6a98b855f2594bb57608862fe23caa1b611b31f41a9247be1d96771
MD5 1c1f0a3687dd3fc08af27ef2cdcaeca9
SHA1 766eed44a84a9ba413ef7317bef25853a01fdaf8
SHA512 e7ca498ea918232351bb3b710afe7ff6506d62de28a3d4a83b78d8f33afea7423c7f075cbb5b960976cb59f5801f5b3022ea0d2392f403743065977226bb77f1
SSDEEP 24576:hbCj2sObHtqQEdNYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7Wl:hbCjPKNidNFIbBMyl
TLSH
T15AA5D0C6F2EA40E6DC023FF5582567C78B344736473840597BAA3D498F234A9C16EBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence

Malware Config

Signatures

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/2384-19-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2384-22-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2384-20-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

Custom signature

Detects executables referencing many email and collaboration clients. Observed in information steale 3 IoCs

resource	yara_rule
behavioral1/memory/2384-19-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2384-22-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2384-20-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/2384-19-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/2384-22-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/2384-20-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

Executes dropped EXE 2 IoCs

pid	Process
3128	winmgr21.exe
3744	winmgr21.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegAsm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr21.exe"	2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr21.exe"	winmgr21.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2896-0-0x0000000000400000-0x000000000062F000-memory.dmp	autoit_exe
behavioral1/files/0x000b0000000004e9-6.dat	autoit_exe
behavioral1/files/0x0009000000024331-9.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3128 set thread context of 4732	3128	winmgr21.exe	86
PID 4732 set thread context of 2384	4732	RegAsm.exe	91
PID 4732 set thread context of 2404	4732	RegAsm.exe	93

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe:Zone.Identifier:$DATA	2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe
File created	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe:Zone.Identifier:$DATA	2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe
File created	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4080	schtasks.exe
4668	schtasks.exe
1260	schtasks.exe
1568	schtasks.exe
1044	schtasks.exe
4140	schtasks.exe
408	schtasks.exe
2712	schtasks.exe
2372	schtasks.exe
4876	schtasks.exe
4516	schtasks.exe
4980	schtasks.exe
4160	schtasks.exe
2956	schtasks.exe
3532	schtasks.exe
3820	schtasks.exe
4696	schtasks.exe
3172	schtasks.exe
5068	schtasks.exe
3276	schtasks.exe
396	schtasks.exe
988	schtasks.exe
3460	schtasks.exe
4604	schtasks.exe
892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2896	2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe
2896	2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3744	winmgr21.exe
3744	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe
3128	winmgr21.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2896	2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe
3128	winmgr21.exe
3744	winmgr21.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	RegAsm.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 3128	2896	2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe	85
PID 3128 wrote to memory of 4732	3128	winmgr21.exe	86
PID 3128 wrote to memory of 4732	3128	winmgr21.exe	86
PID 3128 wrote to memory of 4732	3128	winmgr21.exe	86
PID 3128 wrote to memory of 3172	3128	winmgr21.exe	87
PID 4732 wrote to memory of 2384	4732	RegAsm.exe	91
PID 4732 wrote to memory of 2384	4732	RegAsm.exe	91
PID 4732 wrote to memory of 2384	4732	RegAsm.exe	91
PID 4732 wrote to memory of 2384	4732	RegAsm.exe	91
PID 4732 wrote to memory of 2384	4732	RegAsm.exe	91
PID 4732 wrote to memory of 2384	4732	RegAsm.exe	91
PID 4732 wrote to memory of 2404	4732	RegAsm.exe	93
PID 4732 wrote to memory of 2404	4732	RegAsm.exe	93
PID 4732 wrote to memory of 2404	4732	RegAsm.exe	93
PID 4732 wrote to memory of 2404	4732	RegAsm.exe	93
PID 4732 wrote to memory of 2404	4732	RegAsm.exe	93
PID 4732 wrote to memory of 2404	4732	RegAsm.exe	93
PID 3128 wrote to memory of 408	3128	winmgr21.exe	94
PID 3128 wrote to memory of 4604	3128	winmgr21.exe	96
PID 3128 wrote to memory of 892	3128	winmgr21.exe	98
PID 3128 wrote to memory of 5068	3128	winmgr21.exe	100
PID 3128 wrote to memory of 3532	3128	winmgr21.exe	102
PID 3128 wrote to memory of 4080	3128	winmgr21.exe	104
PID 3128 wrote to memory of 3276	3128	winmgr21.exe	106
PID 3128 wrote to memory of 396	3128	winmgr21.exe	108
PID 3128 wrote to memory of 2712	3128	winmgr21.exe	110
PID 3128 wrote to memory of 4668	3128	winmgr21.exe	112
PID 3128 wrote to memory of 2372	3128	winmgr21.exe	114
PID 3128 wrote to memory of 1260	3128	winmgr21.exe	116
PID 3128 wrote to memory of 4876	3128	winmgr21.exe	118
PID 3128 wrote to memory of 988	3128	winmgr21.exe	120
PID 3128 wrote to memory of 1568	3128	winmgr21.exe	122
PID 3128 wrote to memory of 3820	3128	winmgr21.exe	124
PID 3128 wrote to memory of 1044	3128	winmgr21.exe	126
PID 3128 wrote to memory of 4140	3128	winmgr21.exe	128
PID 3128 wrote to memory of 4516	3128	winmgr21.exe	130
PID 3128 wrote to memory of 4980	3128	winmgr21.exe	132
PID 3128 wrote to memory of 4160	3128	winmgr21.exe	134
PID 3128 wrote to memory of 4696	3128	winmgr21.exe	136
PID 3128 wrote to memory of 2956	3128	winmgr21.exe	138
PID 3128 wrote to memory of 3460	3128	winmgr21.exe	140

C:\Users\Admin\AppData\Local\Temp\2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe"
1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2896
- C:\ProgramData\winmgr21.exe
  C:\ProgramData\winmgr21.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /stext C:\ProgramData\Mails.txt
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:2384
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /stext C:\ProgramData\Browsers.txt
      4⤵
      PID:2404
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3172
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:408
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4604
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:892
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5068
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3532
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4080
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3276
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:396
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2712
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4668
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2372
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1260
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4876
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:988
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1568
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3820
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1044
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4980
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4696
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2956
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3460

C:\ProgramData\winmgr21.exe
C:\ProgramData\winmgr21.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winmgr21.exe

Path C:\ProgramData\winmgr21.exe
Size 2.1MB
SHA256 cda2ac5be35c281497dee15930d42faffeb005a0ce5d5f8f28532f151a921c84
MD5 71d71e49daf89ef0e137fad7e7ed5861
SHA1 fc71aaa886acd8fc4f8e308dad5bbe2c3479f2f1
SHA512 a4ac4122645fbd357485b23d659dc38d7f7d2f5a3f7786dd307db29b4d2015a8054051759a158d24bd67abeeb5978b7ea67e0988be3076e39b6c576ac9514844
SSDEEP 24576:hbCj2sObHtqQEdNYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7Wj:hbCjPKNidNFIbBMyj
TLSH
T100A5D0C6F2EA40E6DC023FF5582567C78B344736473840597BAA3D498F234A9C16EBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-17_1c1f0a3687dd3fc08af27ef2cdcaeca9_elex_stop.exe
Size 2.1MB
SHA256 7272ad35a6a98b855f2594bb57608862fe23caa1b611b31f41a9247be1d96771
MD5 1c1f0a3687dd3fc08af27ef2cdcaeca9
SHA1 766eed44a84a9ba413ef7317bef25853a01fdaf8
SHA512 e7ca498ea918232351bb3b710afe7ff6506d62de28a3d4a83b78d8f33afea7423c7f075cbb5b960976cb59f5801f5b3022ea0d2392f403743065977226bb77f1
SSDEEP 24576:hbCj2sObHtqQEdNYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7Wl:hbCjPKNidNFIbBMyl
TLSH
T15AA5D0C6F2EA40E6DC023FF5582567C78B344736473840597BAA3D498F234A9C16EBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2384-19-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2384-22-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2384-20-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2896-0-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/4732-13-0x0000000000400000-0x00000000004AA000-memory.dmp

Download

memory/4732-14-0x0000000002060000-0x0000000002070000-memory.dmp

Download

memory/4732-15-0x0000000073172000-0x0000000073174000-memory.dmp

Download

memory/4732-24-0x0000000002060000-0x0000000002070000-memory.dmp

Download

memory/4732-25-0x0000000073172000-0x0000000073174000-memory.dmp

Download