stormser | 9643074a1f31da2217c0a5aed608680cf1ec23809974abaeeaece58ca4b1aa15

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_4f77b21d6c46fad61e53cd9bbf73c43d_elex_wannacry.exe
Size 90KB
Sample260604-xp45jacw4z
SHA256 9643074a1f31da2217c0a5aed608680cf1ec23809974abaeeaece58ca4b1aa15
MD5 4f77b21d6c46fad61e53cd9bbf73c43d
SHA1 d06589209673d269f82b2b580395fe31581378e7
SHA512 62c8b49fedb6d3c180917c75c10e0b0eaa69171dab80d311200717cecb54f0babc95f3ede2c6968975a184a6a11b09e8a72102c21bb3cd000949a4028d6decad
SSDEEP 768:Qvw9816vhKQLroL4/wQRNrfrunMxVFA3b7glR:YEGh0oLl2unMxVS3Hg/
TLSH
T1DE93B53D5DDA1037E277D6B585F126E3FE66B98339091D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 10 IoCs

resource	yara_rule
behavioral2/files/0x001400000002af32-2.dat	family_stormser
behavioral2/files/0x002000000002b70f-6.dat	family_stormser
behavioral2/files/0x001500000002af32-8.dat	family_stormser
behavioral2/files/0x002100000002b70f-14.dat	family_stormser
behavioral2/files/0x001600000002af32-19.dat	family_stormser
behavioral2/files/0x002200000002b70f-22.dat	family_stormser
behavioral2/files/0x001700000002af32-27.dat	family_stormser
behavioral2/files/0x002300000002b70f-30.dat	family_stormser
behavioral2/files/0x001800000002af32-34.dat	family_stormser
behavioral2/files/0x002400000002b70f-38.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10D1D4CF-660A-493e-9469-76134152DEE3}\stubpath = "C:\\Windows\\{10D1D4CF-660A-493e-9469-76134152DEE3}.exe"	{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2496E22B-DB98-4a6c-9B57-02ECA076F04A}\stubpath = "C:\\Windows\\{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe"	{119EEF0E-903C-4f70-A268-079648BAF06B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}	{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}\stubpath = "C:\\Windows\\{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe"	{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{119EEF0E-903C-4f70-A268-079648BAF06B}	{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2496E22B-DB98-4a6c-9B57-02ECA076F04A}	{119EEF0E-903C-4f70-A268-079648BAF06B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A23D475B-3F22-4dd6-AF8D-6F7C2A8B5401}	{8D749565-0A88-48f4-B090-6BC891EA150B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A23D475B-3F22-4dd6-AF8D-6F7C2A8B5401}\stubpath = "C:\\Windows\\{A23D475B-3F22-4dd6-AF8D-6F7C2A8B5401}.exe"	{8D749565-0A88-48f4-B090-6BC891EA150B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89FD00A4-C965-4507-990C-1AE10A1C4725}\stubpath = "C:\\Windows\\{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe"	{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44E54418-E9ED-4787-9AD9-37672FB713E5}\stubpath = "C:\\Windows\\{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe"	{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10D1D4CF-660A-493e-9469-76134152DEE3}	{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64D063AD-1AF5-44b2-A07D-8ADA589EB946}	{10D1D4CF-660A-493e-9469-76134152DEE3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D749565-0A88-48f4-B090-6BC891EA150B}\stubpath = "C:\\Windows\\{8D749565-0A88-48f4-B090-6BC891EA150B}.exe"	{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{119EEF0E-903C-4f70-A268-079648BAF06B}\stubpath = "C:\\Windows\\{119EEF0E-903C-4f70-A268-079648BAF06B}.exe"	{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A81B06C-20C1-44e4-9741-4A95A99922F5}	2026-06-04_4f77b21d6c46fad61e53cd9bbf73c43d_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A81B06C-20C1-44e4-9741-4A95A99922F5}\stubpath = "C:\\Windows\\{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe"	2026-06-04_4f77b21d6c46fad61e53cd9bbf73c43d_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89FD00A4-C965-4507-990C-1AE10A1C4725}	{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44E54418-E9ED-4787-9AD9-37672FB713E5}	{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64D063AD-1AF5-44b2-A07D-8ADA589EB946}\stubpath = "C:\\Windows\\{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe"	{10D1D4CF-660A-493e-9469-76134152DEE3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D749565-0A88-48f4-B090-6BC891EA150B}	{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe

Executes dropped EXE 10 IoCs

pid	Process
3748	{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe
2196	{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe
4196	{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe
4544	{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe
908	{10D1D4CF-660A-493e-9469-76134152DEE3}.exe
2528	{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe
420	{119EEF0E-903C-4f70-A268-079648BAF06B}.exe
1544	{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe
2952	{8D749565-0A88-48f4-B090-6BC891EA150B}.exe
1936	{A23D475B-3F22-4dd6-AF8D-6F7C2A8B5401}.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe	{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe
File created	C:\Windows\{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe	{10D1D4CF-660A-493e-9469-76134152DEE3}.exe
File created	C:\Windows\{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe	{119EEF0E-903C-4f70-A268-079648BAF06B}.exe
File created	C:\Windows\{A23D475B-3F22-4dd6-AF8D-6F7C2A8B5401}.exe	{8D749565-0A88-48f4-B090-6BC891EA150B}.exe
File created	C:\Windows\{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe	{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe
File created	C:\Windows\{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe	{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe
File created	C:\Windows\{10D1D4CF-660A-493e-9469-76134152DEE3}.exe	{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe
File created	C:\Windows\{119EEF0E-903C-4f70-A268-079648BAF06B}.exe	{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe
File created	C:\Windows\{8D749565-0A88-48f4-B090-6BC891EA150B}.exe	{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe
File created	C:\Windows\{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe	2026-06-04_4f77b21d6c46fad61e53cd9bbf73c43d_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{119EEF0E-903C-4f70-A268-079648BAF06B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A23D475B-3F22-4dd6-AF8D-6F7C2A8B5401}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{10D1D4CF-660A-493e-9469-76134152DEE3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8D749565-0A88-48f4-B090-6BC891EA150B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_4f77b21d6c46fad61e53cd9bbf73c43d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2096	2026-06-04_4f77b21d6c46fad61e53cd9bbf73c43d_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3748	{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe
Token: SeIncBasePriorityPrivilege	2196	{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe
Token: SeIncBasePriorityPrivilege	4196	{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe
Token: SeIncBasePriorityPrivilege	4544	{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe
Token: SeIncBasePriorityPrivilege	908	{10D1D4CF-660A-493e-9469-76134152DEE3}.exe
Token: SeIncBasePriorityPrivilege	2528	{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe
Token: SeIncBasePriorityPrivilege	420	{119EEF0E-903C-4f70-A268-079648BAF06B}.exe
Token: SeIncBasePriorityPrivilege	1544	{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe
Token: SeIncBasePriorityPrivilege	2952	{8D749565-0A88-48f4-B090-6BC891EA150B}.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3748	2096	2026-06-04_4f77b21d6c46fad61e53cd9bbf73c43d_elex_wannacry.exe	80
PID 2096 wrote to memory of 1480	2096	2026-06-04_4f77b21d6c46fad61e53cd9bbf73c43d_elex_wannacry.exe	81
PID 3748 wrote to memory of 2196	3748	{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe	82
PID 3748 wrote to memory of 1212	3748	{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe	83
PID 2196 wrote to memory of 4196	2196	{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe	84
PID 2196 wrote to memory of 2824	2196	{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe	85
PID 4196 wrote to memory of 4544	4196	{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe	86
PID 4196 wrote to memory of 4780	4196	{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe	87
PID 4544 wrote to memory of 908	4544	{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe	88
PID 4544 wrote to memory of 6060	4544	{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe	89
PID 908 wrote to memory of 2528	908	{10D1D4CF-660A-493e-9469-76134152DEE3}.exe	90
PID 908 wrote to memory of 4004	908	{10D1D4CF-660A-493e-9469-76134152DEE3}.exe	91
PID 2528 wrote to memory of 420	2528	{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe	92
PID 2528 wrote to memory of 3148	2528	{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe	93
PID 420 wrote to memory of 1544	420	{119EEF0E-903C-4f70-A268-079648BAF06B}.exe	94
PID 420 wrote to memory of 2024	420	{119EEF0E-903C-4f70-A268-079648BAF06B}.exe	95
PID 1544 wrote to memory of 2952	1544	{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe	96
PID 1544 wrote to memory of 5724	1544	{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe	97
PID 2952 wrote to memory of 1936	2952	{8D749565-0A88-48f4-B090-6BC891EA150B}.exe	98
PID 2952 wrote to memory of 1960	2952	{8D749565-0A88-48f4-B090-6BC891EA150B}.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-06-04_4f77b21d6c46fad61e53cd9bbf73c43d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_4f77b21d6c46fad61e53cd9bbf73c43d_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe
  C:\Windows\{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe
    C:\Windows\{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe
      C:\Windows\{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4196
    - - C:\Windows\{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe
        
        C:\Windows\{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4544
      - C:\Windows\{10D1D4CF-660A-493e-9469-76134152DEE3}.exe
        
        C:\Windows\{10D1D4CF-660A-493e-9469-76134152DEE3}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe
        
        C:\Windows\{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\{119EEF0E-903C-4f70-A268-079648BAF06B}.exe
        
        C:\Windows\{119EEF0E-903C-4f70-A268-079648BAF06B}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:420
        
        C:\Windows\{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe
        
        C:\Windows\{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\{8D749565-0A88-48f4-B090-6BC891EA150B}.exe
        
        C:\Windows\{8D749565-0A88-48f4-B090-6BC891EA150B}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\{A23D475B-3F22-4dd6-AF8D-6F7C2A8B5401}.exe
        
        C:\Windows\{A23D475B-3F22-4dd6-AF8D-6F7C2A8B5401}.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8D749~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2496E~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{119EE~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{64D06~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{10D1D~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{44E54~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4A1E2~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{89FD0~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{3A81B~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{10D1D4CF-660A-493e-9469-76134152DEE3}.exe

Path C:\Windows\{10D1D4CF-660A-493e-9469-76134152DEE3}.exe
Size 90KB
SHA256 49390690d914b2c027c96ba046662632c27ee5ceec785acd621165430294bc13
MD5 8f53d4a81673dc2f4fe6ad83fb582d84
SHA1 590c985319cadcc40073c7684e143b5979c63fb2
SHA512 8d98ab7618d0c28d8ec5b0b82186cd61a104b28f3edeb36f9facae06beead4440e3d9994e709af233d1a6129e8c9a115ddf9b7b7c22ea5095067e5fca3f5b984
SSDEEP 768:Qvw9816vhKQLroX4/wQRNrfrunMxVFA3b7glR:YEGh0oXl2unMxVS3Hg/
TLSH
T11F93B43D5DDA1037E277D6B585F126E3FE66B9833A0A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{119EEF0E-903C-4f70-A268-079648BAF06B}.exe

Path C:\Windows\{119EEF0E-903C-4f70-A268-079648BAF06B}.exe
Size 90KB
SHA256 e8712794373f9ba7114b7d371b5891ff3407836248339d6b048b5ae5e38d2094
MD5 f1efa39c7a7294e588e4018db4d1eb75
SHA1 c3765a0e6b864104007ca82b8f27b231b8382287
SHA512 8bd2dcd61946f9dd9e293d81ba8b87ae28463028741f3d2865a6810758d16aeda406cf47ec177031e085d6534ee4d313f4dbe2b53834f1f825e04ac78b14ad33
SSDEEP 768:Qvw9816vhKQLroo4/wQRNrfrunMxVFA3b7glR:YEGh0ool2unMxVS3Hg/
TLSH
T10E93B43D5DDA1037E2B7D6B585F126E3FE66B983390A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe

Path C:\Windows\{2496E22B-DB98-4a6c-9B57-02ECA076F04A}.exe
Size 90KB
SHA256 2d4d5d3cabc0bfe55bd6e92a0915515c641e64dc1c2f30f4ce70584c1458695b
MD5 d32c10a33eda28effdd72af0b6e7587e
SHA1 a0725fdcfa96082a3dca2ea18182582bdbee8386
SHA512 ed879272d2ebda1437a325f5e849a5be88620da769de66d48ab34dc0837db376449b9b0257784587c3afeb6a44d783aee69c1ae507b1690baf00325fca14812d
SSDEEP 768:Qvw9816vhKQLro54/wQRNrfrunMxVFA3b7glR:YEGh0o5l2unMxVS3Hg/
TLSH
T10A93B43D5DDA1037E277D6B585F126E3FE66B983390A1D0E469243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe

Path C:\Windows\{3A81B06C-20C1-44e4-9741-4A95A99922F5}.exe
Size 90KB
SHA256 fd87eac70cc7c340e285fd3e52b2a59900e132d1c566f0cd8e3d5ec15accccdc
MD5 9b8242ab9598a783829470c3a7342d5f
SHA1 acc7c12969043dd2b2057507c713091d8719cb97
SHA512 455adf8a148970f0ab9d3fb335adb7f03536dd3bf5f5e8230fca29ce500172ca2f27ec158e6d7391b2f9eddfc472763ced1d4629c20a101d74b28ab1c2c642ba
SSDEEP 768:Qvw9816vhKQLroW4/wQRNrfrunMxVFA3b7glR:YEGh0oWl2unMxVS3Hg/
TLSH
T1EA93B43D5DDA103BE277D6B585F126E3FE66B983390A1D0E469243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe

Path C:\Windows\{44E54418-E9ED-4787-9AD9-37672FB713E5}.exe
Size 90KB
SHA256 81083f34105e69d433dbcc3c3c4268c88f65a0ac32321f92cb106dc4e20ac80b
MD5 1855e32e9a248c58b4a2025a9369e1aa
SHA1 b5689ce02235f87f7ec9dea94b6102ac6e1f1f08
SHA512 92af4d080cd8945dcee2d2c3997177c1013244c2157d956d7d99f7d4b3fe4c4bcc2fa943e709d60d238c212130251e91ed464e53e3a30050bbe56acfda0439c6
SSDEEP 768:Qvw9816vhKQLroZ4/wQRNrfrunMxVFA3b7glR:YEGh0oZl2unMxVS3Hg/
TLSH
T16393B53D5DDA1037E2B7D6B585F126E3FE66B983390A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe

Path C:\Windows\{4A1E2E04-0784-4908-82CA-3A4318A8A8FA}.exe
Size 90KB
SHA256 ba07ad5634364f4a32053d57b7ece9d07d71efc68b54a190ad7375310700d586
MD5 6a6ce54492f5670ce8943876d9279600
SHA1 600935ae21f02334a941e3b5c8698a8ef98bcdaf
SHA512 718d662d233107fb2a4f19a7e266fe4b7c1bc35351006d2b4e730fc75a683830f998d1e5fc3e1c11b9fb2720a2f4b8ca8fb28fc0c0fac60859713518099f5d25
SSDEEP 768:Qvw9816vhKQLroUC4/wQRNrfrunMxVFA3b7glR:YEGh0ojl2unMxVS3Hg/
TLSH
T17493B43D5DDA1037E277D6B585F126E3FE66B9833A0A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe

Path C:\Windows\{64D063AD-1AF5-44b2-A07D-8ADA589EB946}.exe
Size 90KB
SHA256 68f9fdcfcc788dceab8d9c13f00d0abb0a9e637ff766c319b5339f06326fe5b1
MD5 0e15cebe20859ef0eacbf83057ff99be
SHA1 d15ef5ee437e0d3f5999ca9a0e2471b770c0e0ef
SHA512 dd36dc17c1489d12038f6ecbff4960f4844b5a4e3155ad8c9e0041377be79c46a157d0ecae91b78d7d5d2f5a63aeb65b8927c415ea0e1b31eb3be314f28de244
SSDEEP 768:Qvw9816vhKQLroIk4/wQRNrfrunMxVFA3b7glR:YEGh0oDl2unMxVS3Hg/
TLSH
T14393B43D5DDA1037E2B7D6B585F126E3FE66B983390A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe

Path C:\Windows\{89FD00A4-C965-4507-990C-1AE10A1C4725}.exe
Size 90KB
SHA256 734b2d26fbbf45647973f11a3899d7c63d37b5c2598b557acffa580d7bf0da58
MD5 50b5e7872e71d9b3088c644984314612
SHA1 adb0aa64176567bb0ece5d75f91111eb6fae84cb
SHA512 77c2a387808ff27032d55b3e04ca0bd6a5de85022a05a7a78d385c84b89ef5da0e3f9b0087e1a27b9a84a62c89955bb8d04627b2fc60685599b93bdcbdce6263
SSDEEP 768:Qvw9816vhKQLrov4/wQRNrfrunMxVFA3b7glR:YEGh0ovl2unMxVS3Hg/
TLSH
T1CC93B43D5DDA1037E2B7D6B585F126E3FE66B98339091D0E469243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8D749565-0A88-48f4-B090-6BC891EA150B}.exe

Path C:\Windows\{8D749565-0A88-48f4-B090-6BC891EA150B}.exe
Size 90KB
SHA256 8d793c83fe1e2e1a9b4a508643d388df74d07c83f0d0052cfb75168aee26b370
MD5 f2e466076394e97a4d7e1ecba98208ed
SHA1 41bdaa34dba3a1d40d829138dfca20eb765ca8ef
SHA512 54dc4f5f522e655fc8f9f8e0ecb7f32aadd18b1ac32da6ac428291f2915e0e87e140fdd87393dab89cd06f5880655ec4acbc7bc8fe22f995f2fe403bd2cd482b
SSDEEP 768:Qvw9816vhKQLroJ4/wQRNrfrunMxVFA3b7glR:YEGh0oJl2unMxVS3Hg/
TLSH
T10893B43D5DDA1037E277D6B585F126E3FE66B983390A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A23D475B-3F22-4dd6-AF8D-6F7C2A8B5401}.exe

Path C:\Windows\{A23D475B-3F22-4dd6-AF8D-6F7C2A8B5401}.exe
Size 90KB
SHA256 60c706a4a1a98f065f112bada8edd9cc8d66039beadc04a38191521071514fae
MD5 537c5567ecbbe308300253dc8acdebc6
SHA1 065d07ed490beb87285a2910ce029c8e25099db5
SHA512 1aa3d21ab999513b5363439d2f98e3344ca4b5dee9ba879695634ca8a7d21f52cd8abf512e8edf25ad3bb44cdfb8e37b32bba03505e263b8030e39802c0573cf
SSDEEP 768:Qvw9816vhKQLro14/wQRNrfrunMxVFA3b7glR:YEGh0o1l2unMxVS3Hg/
TLSH
T1CF93B43D5DDA1037E2B7D6B585F126E3FE66B983390A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads