stormser | 644828df323a510ff889adacb2218dd0e9c639a3ebb3f8208e07a2cfcbfbd009

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_b7868cb637db3e9094d9f1a960ee80dc_elex_wannacry.exe
Size 89KB
Sample260531-ycsfmshs5k
SHA256 644828df323a510ff889adacb2218dd0e9c639a3ebb3f8208e07a2cfcbfbd009
MD5 b7868cb637db3e9094d9f1a960ee80dc
SHA1 ccb41e6ea1a720c6b7589940631403c4b73c0c64
SHA512 31ec3fec4dc07eaa5bafd499ef42a9e614634d15126db1384270d5d362174706dea6694b9acfdb40d4c7121f03a3a5c05b4049cf9d5f655cd4edd5d111255d9c
SSDEEP 768:Qvw9816vhKQLro14/wQRNrfrunMxVFA3b7gl:YEGh0o1l2unMxVS3Hg
TLSH
T10193B43D5DDA103BE277D6B585F126E3FE66B983360A1D0E469243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x001b00000002b203-2.dat	family_stormser
behavioral2/files/0x002300000002b208-6.dat	family_stormser
behavioral2/files/0x001c00000002b203-8.dat	family_stormser
behavioral2/files/0x002400000002b208-14.dat	family_stormser
behavioral2/files/0x001d00000002b203-19.dat	family_stormser
behavioral2/files/0x002500000002b208-22.dat	family_stormser
behavioral2/files/0x001e00000002b203-26.dat	family_stormser
behavioral2/files/0x002600000002b208-31.dat	family_stormser
behavioral2/files/0x001f00000002b203-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98D42D2B-9E01-4011-ACB2-58B744AA9747}\stubpath = "C:\\Windows\\{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe"	{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{244A09DD-8F72-4462-B55C-6020E49AB05F}	{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECA12717-BA08-492c-80EE-106D6F45F1E6}\stubpath = "C:\\Windows\\{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe"	{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B052B14B-2FBC-4973-998E-9E7A44DA53F2}	{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B052B14B-2FBC-4973-998E-9E7A44DA53F2}\stubpath = "C:\\Windows\\{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe"	{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}	{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D6A4863-D2DA-4bbf-AC49-505692E166E4}	2026-05-31_b7868cb637db3e9094d9f1a960ee80dc_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECA12717-BA08-492c-80EE-106D6F45F1E6}	{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B255F80-E69E-4388-9371-06D92B736999}	{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B255F80-E69E-4388-9371-06D92B736999}\stubpath = "C:\\Windows\\{5B255F80-E69E-4388-9371-06D92B736999}.exe"	{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}\stubpath = "C:\\Windows\\{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe"	{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{244A09DD-8F72-4462-B55C-6020E49AB05F}\stubpath = "C:\\Windows\\{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe"	{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}	{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6909149B-C634-4cb2-84D7-0606D5CCFFC2}	{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6909149B-C634-4cb2-84D7-0606D5CCFFC2}\stubpath = "C:\\Windows\\{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe"	{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}\stubpath = "C:\\Windows\\{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe"	{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D6A4863-D2DA-4bbf-AC49-505692E166E4}\stubpath = "C:\\Windows\\{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe"	2026-05-31_b7868cb637db3e9094d9f1a960ee80dc_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98D42D2B-9E01-4011-ACB2-58B744AA9747}	{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe

Executes dropped EXE 9 IoCs

pid	Process
1040	{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe
5008	{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe
2080	{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe
4452	{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe
1564	{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe
4972	{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe
936	{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe
3904	{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe
3716	{5B255F80-E69E-4388-9371-06D92B736999}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe	2026-05-31_b7868cb637db3e9094d9f1a960ee80dc_elex_wannacry.exe
File created	C:\Windows\{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe	{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe
File created	C:\Windows\{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe	{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe
File created	C:\Windows\{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe	{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe
File created	C:\Windows\{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe	{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe
File created	C:\Windows\{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe	{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe
File created	C:\Windows\{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe	{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe
File created	C:\Windows\{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe	{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe
File created	C:\Windows\{5B255F80-E69E-4388-9371-06D92B736999}.exe	{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-31_b7868cb637db3e9094d9f1a960ee80dc_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5B255F80-E69E-4388-9371-06D92B736999}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4516	2026-05-31_b7868cb637db3e9094d9f1a960ee80dc_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	1040	{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe
Token: SeIncBasePriorityPrivilege	5008	{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe
Token: SeIncBasePriorityPrivilege	2080	{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe
Token: SeIncBasePriorityPrivilege	4452	{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe
Token: SeIncBasePriorityPrivilege	1564	{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe
Token: SeIncBasePriorityPrivilege	4972	{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe
Token: SeIncBasePriorityPrivilege	936	{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe
Token: SeIncBasePriorityPrivilege	3904	{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 1040	4516	2026-05-31_b7868cb637db3e9094d9f1a960ee80dc_elex_wannacry.exe	80
PID 4516 wrote to memory of 3616	4516	2026-05-31_b7868cb637db3e9094d9f1a960ee80dc_elex_wannacry.exe	81
PID 1040 wrote to memory of 5008	1040	{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe	82
PID 1040 wrote to memory of 2344	1040	{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe	83
PID 5008 wrote to memory of 2080	5008	{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe	84
PID 5008 wrote to memory of 2072	5008	{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe	85
PID 2080 wrote to memory of 4452	2080	{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe	86
PID 2080 wrote to memory of 4656	2080	{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe	87
PID 4452 wrote to memory of 1564	4452	{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe	88
PID 4452 wrote to memory of 940	4452	{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe	89
PID 1564 wrote to memory of 4972	1564	{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe	90
PID 1564 wrote to memory of 1916	1564	{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe	91
PID 4972 wrote to memory of 936	4972	{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe	92
PID 4972 wrote to memory of 1440	4972	{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe	93
PID 936 wrote to memory of 3904	936	{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe	94
PID 936 wrote to memory of 2236	936	{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe	95
PID 3904 wrote to memory of 3716	3904	{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe	96
PID 3904 wrote to memory of 4968	3904	{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-05-31_b7868cb637db3e9094d9f1a960ee80dc_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_b7868cb637db3e9094d9f1a960ee80dc_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe
  C:\Windows\{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe
    C:\Windows\{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe
      C:\Windows\{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\Windows\{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe
        
        C:\Windows\{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4452
      - C:\Windows\{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe
        
        C:\Windows\{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe
        
        C:\Windows\{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe
        
        C:\Windows\{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe
        
        C:\Windows\{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\{5B255F80-E69E-4388-9371-06D92B736999}.exe
        
        C:\Windows\{5B255F80-E69E-4388-9371-06D92B736999}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BB242~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B052B~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ECA12~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{69091~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{244A0~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:940
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21E2A~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{98D42~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0D6A4~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe

Path C:\Windows\{0D6A4863-D2DA-4bbf-AC49-505692E166E4}.exe
Size 89KB
SHA256 330af84f77d14b23f52188607dd579558703188558b151e7eaf1a4abbd05de9a
MD5 89b8bd1c81567584feac584269e5c27f
SHA1 43cca619c844b42dfa60af5df2a98843f8c4d446
SHA512 fa447db374fe979f04cc9ac769186bb80d8b465cbed39a747db3dc701dc92fdc93a14c21b759ad47d5da79e48f2ac46415e0dd8cc9c108bcfbf639269e00efb7
SSDEEP 768:Qvw9816vhKQLroO4/wQRNrfrunMxVFA3b7gl:YEGh0oOl2unMxVS3Hg
TLSH
T15693B43D5DDA103BE2B7D6B585F126E3FE66B983350A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe

Path C:\Windows\{21E2AF16-963A-4c7b-BAFA-AE7674B0D02E}.exe
Size 89KB
SHA256 bcf7dca4002c2c9c6f1b74c1fddc1fb41254fe4d25edc48ff0af902136d706f3
MD5 d77cf7b44d434189828b6d8fda7cf642
SHA1 bdd1ca5de239a1f4a89e409d5b1cfa94528bedf5
SHA512 2e3bc7496e32f0e60e2bc827eeaff42d742c38e8c1c11c4f963f1460c66bc6f63af0faf7004a952dfb03ea27e6ff873064928759d696990841052787b4c2cb2c
SSDEEP 768:Qvw9816vhKQLro+4/wQRNrfrunMxVFA3b7gl:YEGh0o+l2unMxVS3Hg
TLSH
T15693B43D5DDA1037E277D6B585F126E3FE66B9833A0A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe

Path C:\Windows\{244A09DD-8F72-4462-B55C-6020E49AB05F}.exe
Size 89KB
SHA256 4b038590ad0cf75a03451e269618019a1821273b1c6fc9341af30c488e091b4f
MD5 c18b2f6993c031f50955b1896ea64a14
SHA1 f1a6f8e57fd371398899d32156aaaf0e7e657b24
SHA512 cfb4996868a08b28e11dd30b1751b21bc1b32aca8999a9f200cad5a2ca453a00224f06e4d27d51d82aece7c7c79a6b0a8b7bd46d6de039024b34d94426a5f326
SSDEEP 768:Qvw9816vhKQLroc4/wQRNrfrunMxVFA3b7gl:YEGh0ocl2unMxVS3Hg
TLSH
T13393B43D5DDA1037E277D6B585F126E3FE66B9833A0A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5B255F80-E69E-4388-9371-06D92B736999}.exe

Path C:\Windows\{5B255F80-E69E-4388-9371-06D92B736999}.exe
Size 89KB
SHA256 de3bf93ed1efc14b7859160f2de11e6d218b234d090d0737c1f720045baaea60
MD5 04ba4625f14a4edbc836fa520337fb3b
SHA1 6f497bc380190ab322d2e009ed617e060d2f8193
SHA512 dc2c153256279891afea6efc97bead93fc5067f98d616dd101bf5416163f8d83357ed111e93562b6fa23ac183ea7d5bb406066336952807b83e77f347e1225e4
SSDEEP 768:Qvw9816vhKQLrorL4/wQRNrfrunMxVFA3b7gl:YEGh0orLl2unMxVS3Hg
TLSH
T17693B43D5DDA1037E277D6B585F126E3FE66B983390A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe

Path C:\Windows\{6909149B-C634-4cb2-84D7-0606D5CCFFC2}.exe
Size 89KB
SHA256 b54888f1c725f79b679116e1030e01f92565b026902865fb9d418aa19c7e0339
MD5 c144a3eabb85eca3769d00bcc121acdf
SHA1 00491b572459904ac6240a99e58a6a2250b2c0ca
SHA512 e1487254883577ad4734d64c170a77c3ce1d025afc8f768ccd1b8f3253044da7b2beafdb10bd2e7962fe55d418be190f6ed2e02aba3b1a18edb129764113af95
SSDEEP 768:Qvw9816vhKQLro24/wQRNrfrunMxVFA3b7gl:YEGh0o2l2unMxVS3Hg
TLSH
T1C993B43D5DDA1037E2B7D6B485F126E3FE66B983350A1D0E469243428D23B53AD86C1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe

Path C:\Windows\{98D42D2B-9E01-4011-ACB2-58B744AA9747}.exe
Size 89KB
SHA256 f150bd3acda0b48ddbd3893d78705ea886cfa361b775a3358afeb329215cbea5
MD5 091bcc69a9fd3d6c9d3e4b74af21c6f1
SHA1 468e4f8a4936605cf3257f0064e4fa94892689c2
SHA512 a06e3b4607324ac7afa89854b8050b1c7b25a09af6bae4a078c02bd0df701abb313b91bfb694a3d1621b501a8d193b45d7e03d3ca8c4b31da0ba56d60acfecb3
SSDEEP 768:Qvw9816vhKQLro34/wQRNrfrunMxVFA3b7gl:YEGh0o3l2unMxVS3Hg
TLSH
T14493B43D5DDA103BE277D6B585F126E3FE66B983360A1D0E469243428D23B53AD86C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe

Path C:\Windows\{B052B14B-2FBC-4973-998E-9E7A44DA53F2}.exe
Size 89KB
SHA256 e5c14e3fdd063644c650a7ff8c4d0c54fc1170fa53ea9d7ae03086f94d181b15
MD5 e0a62efaa7eaed25440af33461a9051e
SHA1 e28e141352f03da5f5c7cfe1e2dec0427c1e2880
SHA512 8ce80799209e73c949cf9cd021f08a235650bfa3385a0098acd0e15fc28528251a1c24fdb10c060028c697b3eb191e8ef7a39ae995b8c8b5848e2629f8e235a9
SSDEEP 768:Qvw9816vhKQLroa4/wQRNrfrunMxVFA3b7gl:YEGh0oal2unMxVS3Hg
TLSH
T1B593B43D5DDA103BE2B7D6B585F126E3FE66B983350A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe

Path C:\Windows\{BB2425E3-0E9C-46cf-A9BD-18D2D3467D6A}.exe
Size 89KB
SHA256 2983ba9d2350baf461dcebdbb199c02a0844fae5c327dc24ceb89f7d49747296
MD5 3a17c54510e9784df68c3642693726b4
SHA1 5f0dee24632128d090cde8dfb35b11414ef20089
SHA512 b9c114b9fec321ebcfdaa10ee5619ef186c2a5aa84a9e8f63788e5ef2483313611179eb9a77d1edd8f2183411e746e0aaf8cd18e7d592a86ab1d118651e84280
SSDEEP 768:Qvw9816vhKQLrob4/wQRNrfrunMxVFA3b7gl:YEGh0obl2unMxVS3Hg
TLSH
T17A93B43D5DDA1037E277D6B585F126E3FE66B983390A1D0E46D243428D23B53AD86C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe

Path C:\Windows\{ECA12717-BA08-492c-80EE-106D6F45F1E6}.exe
Size 89KB
SHA256 0255fe12ef33c4ddfe2dcf706bd040af42ee09e1d6116e78eb9033053d30e4de
MD5 31eac531814ef2fd71d062e32e1f2441
SHA1 f4e102b4c84622d6d3abf4cda272aad8e4640424
SHA512 3a99aa65b89f7ef8c9bf8f582a94457955a112e37ded30ec4ef12fa8d4d93f9444da8d32cb2f3442514f183b92e4fba0de8a6da17c745e13cbf689054a09b4c2
SSDEEP 768:Qvw9816vhKQLrow4/wQRNrfrunMxVFA3b7gl:YEGh0owl2unMxVS3Hg
TLSH
T1A493B43D5DDA103BE277D6B585F126E3FE66B983360A1D0E46D243428D23B53AD86C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads