stormser | 45490140af8ae542821d59b85dea35e8a3679eba3a60dc9b832982f05890a120

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_973f082457e6891d093198b010a1f201_elex_goldeneye_wannacry.exe
Size 216KB
Sample260522-tecezsa15x
SHA256 45490140af8ae542821d59b85dea35e8a3679eba3a60dc9b832982f05890a120
MD5 973f082457e6891d093198b010a1f201
SHA1 3a919da83039475cd80e889dff446975969ba242
SHA512 44bfc7a7f95d52080f97a771e30899fa0f527d57d9df18ce749fd0570fabb47740527ab63afe1069ba1252723e9eed6d2a1eec8af2b9513bb50ff8140a45c04f
SSDEEP 3072:jEGh0oal+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGglEeKcAEcGy
TLSH
T13E2493352BE50626F0F39B7599B18492AE37BE923A35CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b35b-2.dat	family_stormser
behavioral2/files/0x001b00000002b3c2-6.dat	family_stormser
behavioral2/files/0x001d00000002b35b-8.dat	family_stormser
behavioral2/files/0x001c00000002b3c2-14.dat	family_stormser
behavioral2/files/0x001e00000002b35b-18.dat	family_stormser
behavioral2/files/0x001d00000002b3c2-23.dat	family_stormser
behavioral2/files/0x001f00000002b35b-26.dat	family_stormser
behavioral2/files/0x001e00000002b3c2-30.dat	family_stormser
behavioral2/files/0x002000000002b35b-35.dat	family_stormser

Auto-generated rule 9 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b35b-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001b00000002b3c2-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001d00000002b35b-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001c00000002b3c2-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001e00000002b35b-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001d00000002b3c2-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001f00000002b35b-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001e00000002b3c2-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x002000000002b35b-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}\stubpath = "C:\\Windows\\{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe"	{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}\stubpath = "C:\\Windows\\{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe"	{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B830AE3-34E5-4031-8598-BDCC27B81F71}\stubpath = "C:\\Windows\\{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe"	{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FD785E3-B179-48d2-B7F8-33D8B6420F4B}	{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A70425E0-6D66-4d18-82D1-EE383E4625CE}	2026-05-22_973f082457e6891d093198b010a1f201_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B88F02C-55E9-4b8c-AD9F-C320558258BA}\stubpath = "C:\\Windows\\{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe"	{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7AF4863-6225-4e14-8100-FEC5CC400DD5}	{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7AF4863-6225-4e14-8100-FEC5CC400DD5}\stubpath = "C:\\Windows\\{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe"	{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4C42000-65E3-4e73-9DD7-774FB33F383B}	{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10326B23-D0F9-4c9d-8592-D0001DA294E3}\stubpath = "C:\\Windows\\{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe"	{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}	{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B88F02C-55E9-4b8c-AD9F-C320558258BA}	{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4C42000-65E3-4e73-9DD7-774FB33F383B}\stubpath = "C:\\Windows\\{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe"	{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B830AE3-34E5-4031-8598-BDCC27B81F71}	{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10326B23-D0F9-4c9d-8592-D0001DA294E3}	{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FD785E3-B179-48d2-B7F8-33D8B6420F4B}\stubpath = "C:\\Windows\\{5FD785E3-B179-48d2-B7F8-33D8B6420F4B}.exe"	{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A70425E0-6D66-4d18-82D1-EE383E4625CE}\stubpath = "C:\\Windows\\{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe"	2026-05-22_973f082457e6891d093198b010a1f201_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}	{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe

Executes dropped EXE 9 IoCs

pid	Process
1172	{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe
1308	{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe
2568	{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe
4912	{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe
1856	{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe
4776	{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe
1968	{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe
1824	{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe
3500	{5FD785E3-B179-48d2-B7F8-33D8B6420F4B}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe	{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe
File created	C:\Windows\{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe	{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe
File created	C:\Windows\{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe	{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe
File created	C:\Windows\{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe	{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe
File created	C:\Windows\{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe	{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe
File created	C:\Windows\{5FD785E3-B179-48d2-B7F8-33D8B6420F4B}.exe	{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe
File created	C:\Windows\{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe	2026-05-22_973f082457e6891d093198b010a1f201_elex_goldeneye_wannacry.exe
File created	C:\Windows\{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe	{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe
File created	C:\Windows\{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe	{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5FD785E3-B179-48d2-B7F8-33D8B6420F4B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_973f082457e6891d093198b010a1f201_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5184	2026-05-22_973f082457e6891d093198b010a1f201_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	1172	{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe
Token: SeIncBasePriorityPrivilege	1308	{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe
Token: SeIncBasePriorityPrivilege	2568	{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe
Token: SeIncBasePriorityPrivilege	4912	{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe
Token: SeIncBasePriorityPrivilege	1856	{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe
Token: SeIncBasePriorityPrivilege	4776	{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe
Token: SeIncBasePriorityPrivilege	1968	{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe
Token: SeIncBasePriorityPrivilege	1824	{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 1172	5184	2026-05-22_973f082457e6891d093198b010a1f201_elex_goldeneye_wannacry.exe	80
PID 5184 wrote to memory of 2636	5184	2026-05-22_973f082457e6891d093198b010a1f201_elex_goldeneye_wannacry.exe	81
PID 1172 wrote to memory of 1308	1172	{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe	82
PID 1172 wrote to memory of 3920	1172	{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe	83
PID 1308 wrote to memory of 2568	1308	{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe	84
PID 1308 wrote to memory of 3160	1308	{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe	85
PID 2568 wrote to memory of 4912	2568	{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe	86
PID 2568 wrote to memory of 2240	2568	{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe	87
PID 4912 wrote to memory of 1856	4912	{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe	88
PID 4912 wrote to memory of 4532	4912	{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe	89
PID 1856 wrote to memory of 4776	1856	{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe	90
PID 1856 wrote to memory of 4800	1856	{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe	91
PID 4776 wrote to memory of 1968	4776	{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe	92
PID 4776 wrote to memory of 4140	4776	{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe	93
PID 1968 wrote to memory of 1824	1968	{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe	94
PID 1968 wrote to memory of 1432	1968	{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe	95
PID 1824 wrote to memory of 3500	1824	{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe	96
PID 1824 wrote to memory of 2912	1824	{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-05-22_973f082457e6891d093198b010a1f201_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_973f082457e6891d093198b010a1f201_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe
  C:\Windows\{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe
    C:\Windows\{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe
      C:\Windows\{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Windows\{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe
        
        C:\Windows\{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4912
      - C:\Windows\{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe
        
        C:\Windows\{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe
        
        C:\Windows\{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe
        
        C:\Windows\{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe
        
        C:\Windows\{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\{5FD785E3-B179-48d2-B7F8-33D8B6420F4B}.exe
        
        C:\Windows\{5FD785E3-B179-48d2-B7F8-33D8B6420F4B}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{10326~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0B830~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D4C42~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7AF4~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9B88F~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D3C1C~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{7F3B5~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A7042~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe

Path C:\Windows\{0B830AE3-34E5-4031-8598-BDCC27B81F71}.exe
Size 216KB
SHA256 0241ae6ce6224ea6bc2c9ae7ba6e0b4bdd97e8a5bfcdc2affaf91f453bc0d8bb
MD5 e4f83056b53f04895fff8c34a3adf600
SHA1 220a995c7bdc85ec62759f8654955d662544cd02
SHA512 1d9a74af145810b159bc379bc52a8d3c8e156ca30f9f3d377671bb640445a5df07b9f67423f3c96f2d3a75c62753fc6a76e16c73af3275f5c86043b93f0c7a4b
SSDEEP 3072:jEGh0ozl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGtlEeKcAEcGy
TLSH
T1B32493352BE50626F0F39B7599B18492AE37BE923935CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe

Path C:\Windows\{10326B23-D0F9-4c9d-8592-D0001DA294E3}.exe
Size 216KB
SHA256 5a22c1ef00de41ce36df7475e58817ba97519592cd1f5c17a1aaf1e410b96df5
MD5 9f96bf702c89c5c255de2e3cac6884c5
SHA1 7c2265760161046a5410b8a131003d9e0e854c66
SHA512 fee163dd11fbcc28c610b3f60cb8beb073072ac69fe7ad6d05c34b27ccb63a07d444b9584e6d1cda7139edaf73dc3d2da9b9cbe6dd90c5b0bc7e5137fc254350
SSDEEP 3072:jEGh0obl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGdlEeKcAEcGy
TLSH
T19D24A3252BE50626F0F39B7599B18492AE37BE923A35CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5FD785E3-B179-48d2-B7F8-33D8B6420F4B}.exe

Path C:\Windows\{5FD785E3-B179-48d2-B7F8-33D8B6420F4B}.exe
Size 216KB
SHA256 1a181f4d5fa12c431beed9c6e9a0e67054135479e06bf0acc74e6fd87301cf77
MD5 079b9e788530d75eb34669a48897b510
SHA1 d5809694139200ceb1a191694e4c56d247c7c81a
SHA512 5967058ae9010f0fa8e1b0d4919a5cd712ed53a7070b7b5b6950a24a0674bb33d80aeb53cd1927ed5716509d44b1679522b16c056ca9b5f77198bb401c788441
SSDEEP 3072:jEGh0orl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGplEeKcAEcGy
TLSH
T13F24A3352BE50626F0F39B7599B18492AE37BE923A35CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe

Path C:\Windows\{7F3B5183-CAFA-4891-8097-8BF156EFB5DE}.exe
Size 216KB
SHA256 c7d6ef375ec29442426fc073f31a1b91e970295a0131d9973ef35410543cc18d
MD5 73f8a6498eea8092597141f7d243a76d
SHA1 fc2613d24a1b907623eb9d8d562126c5805a0ccd
SHA512 6ccbd66f04c5abc81dd6c9911477d596fdf713bdbc711f965065feab9b2b0a81b3ded11f8c1a642ba960970a37bcd82994dc3bfa2aa92bcf103aa56dbdfe792b
SSDEEP 3072:jEGh0oLl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG1lEeKcAEcGy
TLSH
T17D2493252BE50626F0F39B7599B18492AE37BE923935CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe

Path C:\Windows\{9B88F02C-55E9-4b8c-AD9F-C320558258BA}.exe
Size 216KB
SHA256 4bd5f2b087b317148d798e50781cf1e571f394fac4cc261218a413b57f3ef7ee
MD5 bd125422f77e7cf90a4945b11536c54b
SHA1 993dfe3549e85ddd2e4d5f6ba785921d2b90b802
SHA512 a50e889ab161f5f5e6c73f2a43feb59ff94d11a49efccfe138dae642a05f6d614571efa9cf47b46c1b36ac58651b058dea2c85ccf938f3c3454cf68e13b38ac6
SSDEEP 3072:jEGh0oXl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG1lEeKcAEcGy
TLSH
T11F2493352BE50626F0F39B7599B18492AE37BE923A35CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe

Path C:\Windows\{A70425E0-6D66-4d18-82D1-EE383E4625CE}.exe
Size 216KB
SHA256 aa7f0303cd054a3b1b2c3fb15ef7ab24c05c97be89b23b5a909b8ca509bbdbac
MD5 dddc419a5c189382f4295bc679609111
SHA1 d2f8c68a725cb0da05d55a23a3268675d5171b2c
SHA512 33a6b255350f67bc56152682591c56e403ad6e78adf357bb68612129898c7953c41fcfea541ea5395a02abeeb1edb88eecbc01e34c2e442c7b4797d00d72a289
SSDEEP 3072:jEGh0oYl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGylEeKcAEcGy
TLSH
T10D2493352BE50626F0F39B7599B18492AE37BE923A35CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe

Path C:\Windows\{D3C1C8A6-A020-4c98-8B3E-2A8149EBE4F2}.exe
Size 216KB
SHA256 9b2d3f428fddfdd81da3cc14e21a44ea1c722ec351debe005e33d6bf5bd3cd39
MD5 ece9bde82fc7838c80fba4d5a1d942d7
SHA1 97d0f101fe68e74a8f1f0ada3584bf04188e2046
SHA512 23d67fec7c413ffeb66669f59602903e11578c092077abe1bd8977f4c1a55f85062b1905baf76986d40231b8000155a45ab26a3c50f6116724553c8cfe3723c3
SSDEEP 3072:jEGh0o5l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG/lEeKcAEcGy
TLSH
T11F24A3352BE60626F0F39B7599B18492AE37BE923935CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe

Path C:\Windows\{D4C42000-65E3-4e73-9DD7-774FB33F383B}.exe
Size 216KB
SHA256 e34bc50191987506409010555928016bf60cddc59ca4dee9b9b7c6735b12993b
MD5 1042205000fcf7542c938afff2704875
SHA1 fcb8d078db68ac1eefbc81b232f1488ca0c9c5ac
SHA512 8437d317018c6f259d1cca5b8aa9c11bee5c769c3fe55076679f2954bf4c346ef5d002c14fdb4e380e5911aadf0d89dcb9e98a8747f7dc1c12413ba0eb9cf975
SSDEEP 3072:jEGh0ofl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGZlEeKcAEcGy
TLSH
T10A24A3352BE50626F0F39B7599B18492AE37BE923A35CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe

Path C:\Windows\{D7AF4863-6225-4e14-8100-FEC5CC400DD5}.exe
Size 216KB
SHA256 dee21a577215076bb0f813f36bc9e3fc0dea044e69435d42cba2c20186138ca7
MD5 9c50a9e7a17c2bf7c3ccf98081194c46
SHA1 94c3d7a0c7651c9b9351389f49b061676ba7f128
SHA512 8fef22bb75e2587d4b40d3718fb93dff45b493e4ffee544c11cf4f01469e16e17c86246bb711824607ce9fb2da6424b05dac9c69b0cad5ca2ac48db31f9aa932
SSDEEP 3072:jEGh0oBl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG7lEeKcAEcGy
TLSH
T1D42493352BE50626F0F39B7599B18492AE37BE923A35CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads