9bd74c5a3b55c753a147d3e784a26cbbd80ea57f2b6728cb5f4351888e921a6b

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe
Size 42KB
Sample260527-e31p6ahv8x
SHA256 9bd74c5a3b55c753a147d3e784a26cbbd80ea57f2b6728cb5f4351888e921a6b
MD5 3d1d87dab60a1d6876444bfbfa387003
SHA1 4d956e1af7baddeecd771e96f6dac2ffe09cff96
SHA512 1a3304ad966e5ee634b721493bfa9d0c688446c2d9155d5cf6b29d9ecbba618cfa84115a3a88752addc0c455de8a6f2a075242d2adabac7c48634a425984e3f3
SSDEEP 768:D+5x0rteORAR+UOKLarA0ImIcXdn/pK0UyOUzuIPeMtnDUQhlHHrSr7:i5gteORvE0rIK5/pKZyOUPPeMtDHWn
TLSH
T180132913A6A0944EF8811A3553644F7B88ABA07E0B0590D7E7F4EEE0D9359F1673C61F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b4b5-6.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Executes dropped EXE 1 IoCs

pid	Process
932	winmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-505052790752093502937529340\\winmgr.exe"	2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-505052790752093502937529340\\winmgr.exe"	2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	winmgr.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	D:\autorun.inf	winmgr.exe
File created	F:\autorun.inf	winmgr.exe
File opened for modification	F:\autorun.inf	winmgr.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	winmgr.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\M-505052790752093502937529340\winmgr.exe	2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe
File opened for modification	C:\Windows\M-505052790752093502937529340\winmgr.exe	2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe
File opened for modification	C:\Windows\M-505052790752093502937529340	2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe
932	winmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
932	winmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 912	2948	2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe	84
PID 2948 wrote to memory of 932	2948	2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe	85
PID 932 wrote to memory of 3460	932	winmgr.exe	87
PID 932 wrote to memory of 5052	932	winmgr.exe	89
PID 932 wrote to memory of 2832	932	winmgr.exe	91
PID 932 wrote to memory of 2200	932	winmgr.exe	93
PID 932 wrote to memory of 5008	932	winmgr.exe	95
PID 932 wrote to memory of 2132	932	winmgr.exe	97
PID 932 wrote to memory of 4068	932	winmgr.exe	99
PID 932 wrote to memory of 4480	932	winmgr.exe	101
PID 932 wrote to memory of 2112	932	winmgr.exe	103
PID 932 wrote to memory of 1068	932	winmgr.exe	105
PID 932 wrote to memory of 1180	932	winmgr.exe	107
PID 932 wrote to memory of 4744	932	winmgr.exe	109
PID 932 wrote to memory of 780	932	winmgr.exe	111
PID 932 wrote to memory of 2928	932	winmgr.exe	113
PID 932 wrote to memory of 1112	932	winmgr.exe	115
PID 932 wrote to memory of 4368	932	winmgr.exe	117
PID 932 wrote to memory of 4612	932	winmgr.exe	119
PID 932 wrote to memory of 1624	932	winmgr.exe	121
PID 932 wrote to memory of 3380	932	winmgr.exe	123
PID 932 wrote to memory of 3604	932	winmgr.exe	125
PID 932 wrote to memory of 416	932	winmgr.exe	127
PID 932 wrote to memory of 4792	932	winmgr.exe	129
PID 932 wrote to memory of 2180	932	winmgr.exe	131
PID 932 wrote to memory of 3812	932	winmgr.exe	133
PID 932 wrote to memory of 1512	932	winmgr.exe	135
PID 932 wrote to memory of 2200	932	winmgr.exe	137
PID 932 wrote to memory of 1444	932	winmgr.exe	139
PID 932 wrote to memory of 232	932	winmgr.exe	141
PID 932 wrote to memory of 656	932	winmgr.exe	143
PID 932 wrote to memory of 4272	932	winmgr.exe	145
PID 932 wrote to memory of 3948	932	winmgr.exe	147
PID 932 wrote to memory of 4496	932	winmgr.exe	151
PID 932 wrote to memory of 2272	932	winmgr.exe	155
PID 932 wrote to memory of 3988	932	winmgr.exe	157
PID 932 wrote to memory of 2772	932	winmgr.exe	159
PID 932 wrote to memory of 3720	932	winmgr.exe	163
PID 932 wrote to memory of 5000	932	winmgr.exe	166
PID 932 wrote to memory of 4436	932	winmgr.exe	168
PID 932 wrote to memory of 4968	932	winmgr.exe	170
PID 932 wrote to memory of 1136	932	winmgr.exe	172
PID 932 wrote to memory of 4184	932	winmgr.exe	174
PID 932 wrote to memory of 2988	932	winmgr.exe	176
PID 932 wrote to memory of 1260	932	winmgr.exe	178
PID 932 wrote to memory of 4596	932	winmgr.exe	180
PID 932 wrote to memory of 4584	932	winmgr.exe	182
PID 932 wrote to memory of 1308	932	winmgr.exe	184
PID 932 wrote to memory of 1824	932	winmgr.exe	186
PID 932 wrote to memory of 4984	932	winmgr.exe	188
PID 932 wrote to memory of 4448	932	winmgr.exe	190
PID 932 wrote to memory of 2384	932	winmgr.exe	192
PID 932 wrote to memory of 1820	932	winmgr.exe	194
PID 932 wrote to memory of 1180	932	winmgr.exe	197
PID 932 wrote to memory of 2492	932	winmgr.exe	199
PID 932 wrote to memory of 3288	932	winmgr.exe	201
PID 932 wrote to memory of 2276	932	winmgr.exe	203
PID 932 wrote to memory of 1340	932	winmgr.exe	205
PID 932 wrote to memory of 1184	932	winmgr.exe	207
PID 932 wrote to memory of 2976	932	winmgr.exe	209
PID 932 wrote to memory of 2140	932	winmgr.exe	211
PID 932 wrote to memory of 2560	932	winmgr.exe	213
PID 932 wrote to memory of 4472	932	winmgr.exe	215
PID 932 wrote to memory of 3344	932	winmgr.exe	217

C:\Users\Admin\AppData\Local\Temp\2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_3d1d87dab60a1d6876444bfbfa387003_elex_phorpiex_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hvpfhrmtcv.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:912
- C:\Windows\M-505052790752093502937529340\winmgr.exe
  C:\Windows\M-505052790752093502937529340\winmgr.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\$RECYCLE.BIN", "F:\\_\$RECYCLE.BIN"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5052
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:780
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1112
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:416
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1444
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:656
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2772
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3720
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1136
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4184
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:4984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:4448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1820
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3288
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2276
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1184
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2140
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4472
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5052
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4120
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3544
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3228
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move /y "F:\\System Volume Information", "F:\\_\System Volume Information"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hvpfhrmtcv.bat

Path C:\Users\Admin\AppData\Local\Temp\hvpfhrmtcv.bat
Size 306B
SHA256 daaed25c0817856ee250d427a5556fb5e789c8ea1e6d86183d0857bb38f20792
MD5 58140053907caaa88e991fa8335107f9
SHA1 7d151f8c4a7af694335cd5416347c0cc5946c0a2
SHA512 247077a3d221e42917bc421d97c660c011d96ca72740fe7776b472a7995e0e2eee313657ad28c6aff1d282e03eb3b09c73fc0d5fb1075de3959733d21df19fc7
TLSH
T1B9E0CD5141BA9E1F4254911B4A71190EC1666F887A862714F710CD9EB1C0C4DBACA253
MD5 SHA1 SHA512 TLSH

Submit Download

winmgr.exe

Path C:\Windows\M-505052790752093502937529340\winmgr.exe
Size 42KB
SHA256 9bd74c5a3b55c753a147d3e784a26cbbd80ea57f2b6728cb5f4351888e921a6b
MD5 3d1d87dab60a1d6876444bfbfa387003
SHA1 4d956e1af7baddeecd771e96f6dac2ffe09cff96
SHA512 1a3304ad966e5ee634b721493bfa9d0c688446c2d9155d5cf6b29d9ecbba618cfa84115a3a88752addc0c455de8a6f2a075242d2adabac7c48634a425984e3f3
SSDEEP 768:D+5x0rteORAR+UOKLarA0ImIcXdn/pK0UyOUzuIPeMtnDUQhlHHrSr7:i5gteORvE0rIK5/pKZyOUPPeMtDHWn
TLSH
T180132913A6A0944EF8811A3553644F7B88ABA07E0B0590D7E7F4EEE0D9359F1673C61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download