stormser | 04b08f5ff8ac48bcdc9b73fc4f23c333bb26f098fe366b72f1ab404533848b21

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_fc63ef58bab1e3a7442ccba6743253f2_elex_wannacry.exe
Size 90KB
Sample260519-e2efjabx9r
SHA256 04b08f5ff8ac48bcdc9b73fc4f23c333bb26f098fe366b72f1ab404533848b21
MD5 fc63ef58bab1e3a7442ccba6743253f2
SHA1 bc81c0374e8edf7244da7cb6461b4e02e7ea865b
SHA512 969e625623273f58211bdb95a66ddc41b9c35b3c1b9242c51bbd8b302f6bd58af6354b8cfdcfc0f870a93ed8af4447649e865a7979f49620dcb120459ed61509
SSDEEP 768:Qvw9816vhKQLrow4/wQRNrfrunMxVFA3b7glw6:YEGh0owl2unMxVS3Hgl
TLSH
T14793C53D5DDA103BE2B7D6B585F126E3FE66B983360A5D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b2f5-3.dat	family_stormser
behavioral2/files/0x001a00000002b407-7.dat	family_stormser
behavioral2/files/0x001d00000002b2f5-10.dat	family_stormser
behavioral2/files/0x001b00000002b407-15.dat	family_stormser
behavioral2/files/0x001e00000002b2f5-18.dat	family_stormser
behavioral2/files/0x001c00000002b407-22.dat	family_stormser
behavioral2/files/0x001f00000002b2f5-26.dat	family_stormser
behavioral2/files/0x001d00000002b407-30.dat	family_stormser
behavioral2/files/0x002000000002b2f5-35.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16A44A0D-95BB-4885-8B1E-3082C366D159}\stubpath = "C:\\Windows\\{16A44A0D-95BB-4885-8B1E-3082C366D159}.exe"	{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33F59E19-A1E4-4803-843F-D66DC713A5D0}	2026-05-19_fc63ef58bab1e3a7442ccba6743253f2_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}	{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29D942DA-0CCB-4633-A06F-08A536B68B26}	{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29D942DA-0CCB-4633-A06F-08A536B68B26}\stubpath = "C:\\Windows\\{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe"	{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C64B0D06-CD16-4411-BBAC-84A09EA483D0}	{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}\stubpath = "C:\\Windows\\{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe"	{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}	{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}\stubpath = "C:\\Windows\\{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe"	{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB77E555-282D-4cac-B468-58E52C408E8B}	{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB77E555-282D-4cac-B468-58E52C408E8B}\stubpath = "C:\\Windows\\{FB77E555-282D-4cac-B468-58E52C408E8B}.exe"	{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}\stubpath = "C:\\Windows\\{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe"	{FB77E555-282D-4cac-B468-58E52C408E8B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16A44A0D-95BB-4885-8B1E-3082C366D159}	{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33F59E19-A1E4-4803-843F-D66DC713A5D0}\stubpath = "C:\\Windows\\{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe"	2026-05-19_fc63ef58bab1e3a7442ccba6743253f2_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C64B0D06-CD16-4411-BBAC-84A09EA483D0}\stubpath = "C:\\Windows\\{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe"	{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}	{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}\stubpath = "C:\\Windows\\{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe"	{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}	{FB77E555-282D-4cac-B468-58E52C408E8B}.exe

Executes dropped EXE 9 IoCs

pid	Process
3652	{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe
2416	{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe
3200	{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe
1936	{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe
568	{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe
1900	{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe
3700	{FB77E555-282D-4cac-B468-58E52C408E8B}.exe
4532	{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe
5000	{16A44A0D-95BB-4885-8B1E-3082C366D159}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe	{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe
File created	C:\Windows\{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe	{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe
File created	C:\Windows\{FB77E555-282D-4cac-B468-58E52C408E8B}.exe	{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe
File created	C:\Windows\{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe	{FB77E555-282D-4cac-B468-58E52C408E8B}.exe
File created	C:\Windows\{16A44A0D-95BB-4885-8B1E-3082C366D159}.exe	{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe
File created	C:\Windows\{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe	2026-05-19_fc63ef58bab1e3a7442ccba6743253f2_elex_wannacry.exe
File created	C:\Windows\{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe	{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe
File created	C:\Windows\{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe	{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe
File created	C:\Windows\{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe	{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FB77E555-282D-4cac-B468-58E52C408E8B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{16A44A0D-95BB-4885-8B1E-3082C366D159}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-19_fc63ef58bab1e3a7442ccba6743253f2_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3144	2026-05-19_fc63ef58bab1e3a7442ccba6743253f2_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3652	{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe
Token: SeIncBasePriorityPrivilege	2416	{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe
Token: SeIncBasePriorityPrivilege	3200	{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe
Token: SeIncBasePriorityPrivilege	1936	{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe
Token: SeIncBasePriorityPrivilege	568	{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe
Token: SeIncBasePriorityPrivilege	1900	{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe
Token: SeIncBasePriorityPrivilege	3700	{FB77E555-282D-4cac-B468-58E52C408E8B}.exe
Token: SeIncBasePriorityPrivilege	4532	{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3652	3144	2026-05-19_fc63ef58bab1e3a7442ccba6743253f2_elex_wannacry.exe	80
PID 3144 wrote to memory of 8	3144	2026-05-19_fc63ef58bab1e3a7442ccba6743253f2_elex_wannacry.exe	81
PID 3652 wrote to memory of 2416	3652	{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe	82
PID 3652 wrote to memory of 4452	3652	{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe	83
PID 2416 wrote to memory of 3200	2416	{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe	84
PID 2416 wrote to memory of 2156	2416	{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe	85
PID 3200 wrote to memory of 1936	3200	{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe	86
PID 3200 wrote to memory of 4748	3200	{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe	87
PID 1936 wrote to memory of 568	1936	{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe	88
PID 1936 wrote to memory of 4160	1936	{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe	89
PID 568 wrote to memory of 1900	568	{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe	90
PID 568 wrote to memory of 1940	568	{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe	91
PID 1900 wrote to memory of 3700	1900	{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe	92
PID 1900 wrote to memory of 5104	1900	{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe	93
PID 3700 wrote to memory of 4532	3700	{FB77E555-282D-4cac-B468-58E52C408E8B}.exe	94
PID 3700 wrote to memory of 896	3700	{FB77E555-282D-4cac-B468-58E52C408E8B}.exe	95
PID 4532 wrote to memory of 5000	4532	{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe	96
PID 4532 wrote to memory of 4296	4532	{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-05-19_fc63ef58bab1e3a7442ccba6743253f2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_fc63ef58bab1e3a7442ccba6743253f2_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe
  C:\Windows\{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe
    C:\Windows\{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe
      C:\Windows\{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3200
    - - C:\Windows\{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe
        
        C:\Windows\{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1936
      - C:\Windows\{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe
        
        C:\Windows\{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Windows\{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe
        
        C:\Windows\{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\{FB77E555-282D-4cac-B468-58E52C408E8B}.exe
        
        C:\Windows\{FB77E555-282D-4cac-B468-58E52C408E8B}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe
        
        C:\Windows\{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\{16A44A0D-95BB-4885-8B1E-3082C366D159}.exe
        
        C:\Windows\{16A44A0D-95BB-4885-8B1E-3082C366D159}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{15C9B~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FB77E~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E512E~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0CD66~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{29D94~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AAE80~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C64B0~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{33F59~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe

Path C:\Windows\{0CD664C4-7FEB-432a-AFD9-AA9EFA072546}.exe
Size 90KB
SHA256 81775f89683d263b55342fcd51ac8347c0f4c68905ba28c0c32e4c724424c154
MD5 a3fe6457d2bf2f36f1aee2da2665fdb5
SHA1 23a628ee9a215934c06422f74b391d1b15d58562
SHA512 7bd832419b649e44f0f797de8fbad3a2ce5ec3a24776c67bb0df34cf05bf58b6266e4c95a897b678c42d02c75c28e8b9e009c88dcad1e41965b37f84aac7ab1c
SSDEEP 768:Qvw9816vhKQLrob4/wQRNrfrunMxVFA3b7glw6:YEGh0obl2unMxVS3Hgl
TLSH
T19693C53D5DDA103BE2B7D6B585F126E3FE66B98336095D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe

Path C:\Windows\{15C9B811-805C-41e8-9CF2-A2EEA9ADA0F2}.exe
Size 90KB
SHA256 c3d28f0e1da9288fc639d86e7f67a4f36156c9c5b43ca62c64560dee6927fbe9
MD5 d79a1406351fc243e6a91ffc9b1fcf81
SHA1 3f163a355db74b295ca91cdf0046f1e5ebd5e224
SHA512 476c502ba5955ca7bb4d1f23253e8fdcc38a66fcb2eb123cde61685d6a62b171954d7a9ceb4dda976e8c1843a309bbbc09b0625382ff96f964eadab9a129aa04
SSDEEP 768:Qvw9816vhKQLroD4/wQRNrfrunMxVFA3b7glw6:YEGh0oDl2unMxVS3Hgl
TLSH
T13193C53D5DDA103BE2B7D6B585F126E3FE66B983360A5D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{16A44A0D-95BB-4885-8B1E-3082C366D159}.exe

Path C:\Windows\{16A44A0D-95BB-4885-8B1E-3082C366D159}.exe
Size 90KB
SHA256 f1b5afc722f2614b090c911c92f2f73bfb64b5425227b5ca9cf247c5c25f7061
MD5 c34b2a1e6a2953af9189a2703ac2dd67
SHA1 2a57cc4f2541dd02043e97bae8314552be10acea
SHA512 65df437fee4380f92af6979885c97888ddd393ce9a842f4be92deae8209d4a3437f9231c77eeeeb3e4e29438b88e98f81568dcef6f363c540f0ed4924c009df1
SSDEEP 768:Qvw9816vhKQLroIL4/wQRNrfrunMxVFA3b7glw6:YEGh0oILl2unMxVS3Hgl
TLSH
T15393C53D5DDA103BE2B7D6B585F126E7FE66B98336094D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe

Path C:\Windows\{29D942DA-0CCB-4633-A06F-08A536B68B26}.exe
Size 90KB
SHA256 06efaf23ee08b8bf7a18b8a4833ea9e99d30d3efd8ce65bab5e33c732c77e18a
MD5 95905cb3b3d35bac378196ce5bd95c1d
SHA1 7efd55090dbe32ad9cbb92b0759564480d3d16d6
SHA512 1c24e73032d7f789c90c02dc4c9da8406d8d8cd572537f3244e7bfd8985ca5c654cbd76a541ef5eabed6d3498bef4c6b0ae437afac4132d0e92f2b553a212fe6
SSDEEP 768:Qvw9816vhKQLrot4/wQRNrfrunMxVFA3b7glw6:YEGh0otl2unMxVS3Hgl
TLSH
T1AD93C53D5DDA103BE2B7D6B585F126E3FE66B98336095D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe

Path C:\Windows\{33F59E19-A1E4-4803-843F-D66DC713A5D0}.exe
Size 90KB
SHA256 c05420d892f8bd45dadb07ef6094c3b7000c2f502fb1377c155c52ca5b8ced80
MD5 ed0e3a0c909197d01bb731e3fd2d4e90
SHA1 ad867e60c57c453091eabd54abb4f178713daf88
SHA512 f7541099153c3a3d042b4eef15f9cbdae47fbde1c9945e211347e316cdc6a64644b9d193950a8211f616ee19bdb1d5db41ac003e933e26832d1a7d2716cc81ee
SSDEEP 768:Qvw9816vhKQLroG4/wQRNrfrunMxVFA3b7glw6:YEGh0oGl2unMxVS3Hgl
TLSH
T1AA93C53D5DDA103BE2B7D6B585F125E3FE66B98336095D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe

Path C:\Windows\{AAE80A5A-2BC5-44ce-9177-AB9501CE05E8}.exe
Size 90KB
SHA256 a18ec2693abaf0833eb7462439fc6579934335bd84776ca3eb347d8917b677b4
MD5 d9c8e82d71d47c0a7b8a5ee6ad6fae43
SHA1 b8dabbd9d312bc84f06086d3b8f0592e7564572a
SHA512 43507042770ef0c7d389754b24a3cb21d75525ae73a9ae1f446b64ee16040acb979fe5697066e33ca93b4efcb44888638fe39bf5353477535ebfbe1fc81d55b5
SSDEEP 768:Qvw9816vhKQLroqd4/wQRNrfrunMxVFA3b7glw6:YEGh0o4l2unMxVS3Hgl
TLSH
T1EE93C53D5EDA103BE2B7D6B585F126E3FE66B98336095D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe

Path C:\Windows\{C64B0D06-CD16-4411-BBAC-84A09EA483D0}.exe
Size 90KB
SHA256 078f5b89863a9c6f3539c7bcdc5a9044ca8dae86176f2eca6910722a0dd3cdd4
MD5 352fa732cd80f352200bce399db00314
SHA1 2e99e285795fc50a6340930986c72d8237889ce2
SHA512 be4de3d83326331afef74feadce2927321a59f2ae1bc85ad81b63b1dce6348a725a1fab1bd71257ed1fec21e3fdc15f950b001a52820a8fdef602d3426650508
SSDEEP 768:Qvw9816vhKQLroa4/wQRNrfrunMxVFA3b7glw6:YEGh0oal2unMxVS3Hgl
TLSH
T1B293C53D5DDA103BE2B7D6B585F126E3FE66B98336095D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe

Path C:\Windows\{E512EA4E-AEA8-49f8-98EC-446DD74CF0AE}.exe
Size 90KB
SHA256 b30c201244a1af5ac2e5bb22e1a77e9ab460cc278f7e0a2400f4db26449f0468
MD5 a7293380712a368e752352c6d0a98da4
SHA1 ac8f6d6fb1767ee17d4071e31f1f174073376fe5
SHA512 577a045d18684c8948921476cb99a7152be63321c86d5e4c1c924d2d059e5c13582f46b47ac6d86e8e09c34a877ff9c1e3285fec94b24ab97ec2cdeaf7f07c9b
SSDEEP 768:Qvw9816vhKQLroNz4/wQRNrfrunMxVFA3b7glw6:YEGh0opl2unMxVS3Hgl
TLSH
T17D93C53D5EDA103BE2B7D6B585F126E3FE66B98336091D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FB77E555-282D-4cac-B468-58E52C408E8B}.exe

Path C:\Windows\{FB77E555-282D-4cac-B468-58E52C408E8B}.exe
Size 90KB
SHA256 7a68d21793a57f6293617bae3089ba5fcc7590cd922e65c065bb9a0d3cac1b15
MD5 a12cb7c4557a25cc506b7f21e5790db7
SHA1 f8c08d5e8d43c7e46e7a467de7460c4c77578e18
SHA512 a1761e66d2a23ed028a74d5a3545459ddf4d655534a8c7718b1ed3b75503bd26b0a7fe48fd639ef7368051cb184e8577d55ba0b9f559ab4c8bb5aef5aaa0abef
SSDEEP 768:Qvw9816vhKQLrow4/wQRNrfrunMxVFA3b7glw6:YEGh0owl2unMxVS3Hgl
TLSH
T1DB93C53D5DDA103BE2B7D6B585F125E3FE66B983360A5D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads