stormser | 8e31d77c72df6895ef9fab8f5c5a50c47529fe3c96dad44deeb2c6990826d2c9

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_8f9bc288db5644aca181dda1c09aa6ee_elex_wannacry.exe
Size 176KB
Sample260605-fxf91act6p
SHA256 8e31d77c72df6895ef9fab8f5c5a50c47529fe3c96dad44deeb2c6990826d2c9
MD5 8f9bc288db5644aca181dda1c09aa6ee
SHA1 ebf7b697bed11e3ffc47bb6bf6abc32a911460aa
SHA512 ed22195480e5ed62a390fada7d192c4c70ca201ea120f2cc376e6414a62354801a9f802849fb21ac842e8bf65eaab7f885a0bce8550b26012657e64eaf2b896e
SSDEEP 384:tNbLwOs8AHsc4sMfwhKQLroNo4/CFsrd:tNvw9816vhKQLroNo4/wQ
TLSH
T1960418834FEE5CF2FA911130087C9AB9927B99C4950EBF9F7F90CD550437292D93A20A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x00180000000256cc-2.dat	family_stormser
behavioral2/files/0x001c00000002b223-7.dat	family_stormser
behavioral2/files/0x00190000000256cc-8.dat	family_stormser
behavioral2/files/0x001d00000002b223-14.dat	family_stormser
behavioral2/files/0x001a0000000256cc-18.dat	family_stormser
behavioral2/files/0x001e00000002b223-22.dat	family_stormser
behavioral2/files/0x001b0000000256cc-26.dat	family_stormser
behavioral2/files/0x001f00000002b223-30.dat	family_stormser
behavioral2/files/0x001c0000000256cc-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}	{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}\stubpath = "C:\\Windows\\{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe"	{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}\stubpath = "C:\\Windows\\{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe"	{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CEC383D-B2F7-4157-A9F5-CC51DC85E63E}\stubpath = "C:\\Windows\\{0CEC383D-B2F7-4157-A9F5-CC51DC85E63E}.exe"	{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55BBE03A-934F-41a9-916A-6A3727648BAF}\stubpath = "C:\\Windows\\{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe"	{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55BBE03A-934F-41a9-916A-6A3727648BAF}	{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}	{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}\stubpath = "C:\\Windows\\{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe"	{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}	{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BAA8557-3D5A-44f1-AC26-212C45A9837E}	{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CEC383D-B2F7-4157-A9F5-CC51DC85E63E}	{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}	2026-06-05_8f9bc288db5644aca181dda1c09aa6ee_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}\stubpath = "C:\\Windows\\{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe"	2026-06-05_8f9bc288db5644aca181dda1c09aa6ee_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}\stubpath = "C:\\Windows\\{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe"	{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}	{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BAA8557-3D5A-44f1-AC26-212C45A9837E}\stubpath = "C:\\Windows\\{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe"	{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3AA523FB-6CFB-417b-83C8-32B47F881CBA}	{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3AA523FB-6CFB-417b-83C8-32B47F881CBA}\stubpath = "C:\\Windows\\{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe"	{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe

Executes dropped EXE 9 IoCs

pid	Process
4660	{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe
4032	{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe
3148	{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe
2288	{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe
800	{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe
404	{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe
3508	{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe
3140	{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe
2216	{0CEC383D-B2F7-4157-A9F5-CC51DC85E63E}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe	{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe
File created	C:\Windows\{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe	{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe
File created	C:\Windows\{0CEC383D-B2F7-4157-A9F5-CC51DC85E63E}.exe	{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe
File created	C:\Windows\{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe	2026-06-05_8f9bc288db5644aca181dda1c09aa6ee_elex_wannacry.exe
File created	C:\Windows\{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe	{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe
File created	C:\Windows\{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe	{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe
File created	C:\Windows\{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe	{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe
File created	C:\Windows\{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe	{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe
File created	C:\Windows\{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe	{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-05_8f9bc288db5644aca181dda1c09aa6ee_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0CEC383D-B2F7-4157-A9F5-CC51DC85E63E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3880	2026-06-05_8f9bc288db5644aca181dda1c09aa6ee_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4660	{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe
Token: SeIncBasePriorityPrivilege	4032	{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe
Token: SeIncBasePriorityPrivilege	3148	{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe
Token: SeIncBasePriorityPrivilege	2288	{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe
Token: SeIncBasePriorityPrivilege	800	{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe
Token: SeIncBasePriorityPrivilege	404	{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe
Token: SeIncBasePriorityPrivilege	3508	{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe
Token: SeIncBasePriorityPrivilege	3140	{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 4660	3880	2026-06-05_8f9bc288db5644aca181dda1c09aa6ee_elex_wannacry.exe	80
PID 3880 wrote to memory of 3760	3880	2026-06-05_8f9bc288db5644aca181dda1c09aa6ee_elex_wannacry.exe	81
PID 4660 wrote to memory of 4032	4660	{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe	82
PID 4660 wrote to memory of 4188	4660	{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe	83
PID 4032 wrote to memory of 3148	4032	{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe	84
PID 4032 wrote to memory of 3156	4032	{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe	85
PID 3148 wrote to memory of 2288	3148	{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe	86
PID 3148 wrote to memory of 3640	3148	{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe	87
PID 2288 wrote to memory of 800	2288	{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe	88
PID 2288 wrote to memory of 4724	2288	{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe	89
PID 800 wrote to memory of 404	800	{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe	90
PID 800 wrote to memory of 3724	800	{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe	91
PID 404 wrote to memory of 3508	404	{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe	92
PID 404 wrote to memory of 3352	404	{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe	93
PID 3508 wrote to memory of 3140	3508	{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe	94
PID 3508 wrote to memory of 4844	3508	{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe	95
PID 3140 wrote to memory of 2216	3140	{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe	96
PID 3140 wrote to memory of 2364	3140	{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-06-05_8f9bc288db5644aca181dda1c09aa6ee_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_8f9bc288db5644aca181dda1c09aa6ee_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe
  C:\Windows\{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe
    C:\Windows\{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe
      C:\Windows\{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3148
    - - C:\Windows\{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe
        
        C:\Windows\{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2288
      - C:\Windows\{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe
        
        C:\Windows\{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:800
        
        C:\Windows\{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe
        
        C:\Windows\{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe
        
        C:\Windows\{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe
        
        C:\Windows\{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\{0CEC383D-B2F7-4157-A9F5-CC51DC85E63E}.exe
        
        C:\Windows\{0CEC383D-B2F7-4157-A9F5-CC51DC85E63E}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3AA52~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8BAA8~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{42B9A~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E2C70~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5F4CF~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{55BBE~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BC0E8~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{01080~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe

Path C:\Windows\{01080AB6-A903-402e-9DE0-34B9FEFCA6FB}.exe
Size 176KB
SHA256 9ee1b9c581b63986dbfcede7d47506017174de27d9e33f5d388b882644e3deee
MD5 f9c55d3e8be06742d81b5b97e0178594
SHA1 654e41c21580cd0340f4d80041dda67cec5557e4
SHA512 551939a7bdfe00b465d6268589ede14097a411427a47ec77de0a5a3b234071e33823ea4404434e081f6f53ba2b5d1b18189042ac4e4efe94b20ae509d04adfa7
SSDEEP 384:tNbLwOs8AHsc4sMfwhKQLroUo4/CFsrd:tNvw9816vhKQLroUo4/wQ
TLSH
T1360418834FEE5CF2FA910130087D9AB9927B99C4950EBF9F7F90CD550437292E93A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0CEC383D-B2F7-4157-A9F5-CC51DC85E63E}.exe

Path C:\Windows\{0CEC383D-B2F7-4157-A9F5-CC51DC85E63E}.exe
Size 176KB
SHA256 5705dfd1af59d3f13dee35b50d279b9f36a3d98d325c0ffe39ffc47e5aca1488
MD5 075e09069756564d4c13f2a3943206a1
SHA1 f04a3a9dbedcca2b7231dcf9ed94a993446c94b3
SHA512 fd92a553a0621ed7e68fb91a9fcc19c75e20459a11eeac91fdbae32046046c4214f3595ed2625d0170072133739aa6a6ba5e41c74feb43cddaefbafff11e4832
SSDEEP 384:tNbLwOs8AHsc4sMfwhKQLroco4/CFsrd:tNvw9816vhKQLroco4/wQ
TLSH
T1D60408834BEE5CF2FA911130087D9AB9926B99C4950EBF9F7F90CD550437292E93A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe

Path C:\Windows\{3AA523FB-6CFB-417b-83C8-32B47F881CBA}.exe
Size 176KB
SHA256 b8c6b1782851823cdb12e6bea0457795311ddb2a965d60089d3faed979ac42fd
MD5 6796bbcf327e8a1e352a924b1dc7e8c9
SHA1 c746cd45827f52552e23ad02fa4e3016749e081c
SHA512 5d6ed01219384050eae2631b137058d28ef97178cf22f0a1469be3246a94aa07efcf46d854437d57e6d75ffa17ebc66ee6600568ba0994ad503dafa6fa0289fa
SSDEEP 384:tNbLwOs8AHsc4sMfwhKQLroIo4/CFsrd:tNvw9816vhKQLroIo4/wQ
TLSH
T1290408834FEE5CF2FA911130087D9AB9927B99C4950EBF9FBF90CD550437252E93A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe

Path C:\Windows\{42B9ABCC-6CF6-4283-9964-F6AF7E688BFE}.exe
Size 176KB
SHA256 2b2afecb993bcc412235026000f01844d30fdf405cab0e63fa7651d7f160b40b
MD5 c568225dd9e9aef1db3d259fa29c495f
SHA1 4cba7e28e86eeeafa47d322aa9024210ece4d157
SHA512 adcbb1ba05cd06c56637ab090f4479b2144c9939941656c712864c670b05067787acb02a01179e4e3671037420a3372a88c05c8c2d2cb306fbfa14dfd8184f72
SSDEEP 384:tNbLwOs8AHsc4sMfwhKQLroHo4/CFsrd:tNvw9816vhKQLroHo4/wQ
TLSH
T1530418834BEE5CF2FA910130087C9AB9927B99D4950EBF9FBF90CD550437252D93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe

Path C:\Windows\{55BBE03A-934F-41a9-916A-6A3727648BAF}.exe
Size 176KB
SHA256 82b892cf84d58cde3abae66fc94da70b100703fb248af0b6d598fcd8492e42cf
MD5 f4a07c3c70c77b79d319613b4732183b
SHA1 a3d9f6c5fae4db999ced8a56f1fa80285087c24f
SHA512 b3a283ee7d9c3ba62e50a3f9b4278b6f8329c7184cf3f8e926b2f60b095149833b0c8af6139fda3efcf0e3b7b7af70e8506c256246d5ddb86e95e3974335199e
SSDEEP 384:tNbLwOs8AHsc4sMfwhKQLrozo4/CFsrd:tNvw9816vhKQLrozo4/wQ
TLSH
T1370408834BEE5CF2FA910131087D9AB9926B99C4950EBF9FBF90CD550437252E93A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe

Path C:\Windows\{5F4CFC75-8904-4732-A6F7-7438ADB5E3D5}.exe
Size 176KB
SHA256 471911907e4462cda1ee6e5cf612ae4fa0bf65e6fac77b838adea8fdebda3021
MD5 5e7c676e9cd27ed2fbbe6e50325d1f1e
SHA1 e1dc1cd16f7e04eafbee301cf95db2094164bb5b
SHA512 e685de249e6e98f0a490ee998c80def0ad24127aad54db44c8e551a3b5984feaae9e979a6525e934520a306c7fbafe31662a61b98273c63d61ba0fb3432647b1
SSDEEP 384:tNbLwOs8AHsc4sMfwhKQLroEo4/CFsrd:tNvw9816vhKQLroEo4/wQ
TLSH
T1030418834FEE5CF2FA910130087D9AB9927B99C4950EBF9FBF90CD550437252D93A20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe

Path C:\Windows\{8BAA8557-3D5A-44f1-AC26-212C45A9837E}.exe
Size 176KB
SHA256 34a50a39302b70557546fc979b363a473064115f3646d344eff6f3c0a6517f95
MD5 1f53c57c79ff8fccdab11458f0db5ae8
SHA1 135d5c305c54f43ff43e38afd26ef03651865ab8
SHA512 30f1b47142593c2c5170c0db20f10570e66c515c4d3afe37cf09543c0e1d186b3849383f24f1fe9dacdb7fdbc57d13cf55f2388edc3caf3e99a149307393495a
SSDEEP 384:tNbLwOs8AHsc4sMfwhKQLroTQo4/CFsrd:tNvw9816vhKQLroco4/wQ
TLSH
T1350408834FEE5CF2FA911130087D9AB9926B99C4950EBF9FBF90CD550437252D93A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe

Path C:\Windows\{BC0E88EE-A8D7-4ebc-81E0-05F9A7601357}.exe
Size 176KB
SHA256 42ce438997f1118cc8c36799febf2f1c83bc64b1b38e4c443f78a742281c2da1
MD5 cd153e15544dbb777189f49331a0a88e
SHA1 3863153ce430314ecf45868d991f06bf123a14ac
SHA512 a0fde63c6828634a288a630c8bd17eda62f6c488a759e54df450c3138ffa7b70cd3bad6e60542d50bbc00958f6c108f2145d1a5ffec404dc812f4fe3c21cd285
SSDEEP 384:tNbLwOs8AHsc4sMfwhKQLroVo4/CFsrd:tNvw9816vhKQLroVo4/wQ
TLSH
T1F00408834BEE5CF2FA911130087D9AB9926B99C4950EBFDF7F90CD550437252D93A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe

Path C:\Windows\{E2C70BEA-64F2-4964-801C-EA10C6C8EEC1}.exe
Size 176KB
SHA256 2f1bc550bf42ad0cd4ebbcb9c2d49cef80d013217d1f15bddc3ddf811c9a320c
MD5 56317d52b27126a0c58a844362275457
SHA1 e5595cb1dea565917ef0585958e1b22a9db9b501
SHA512 8315bf895977662223044da723841069dc72f03f9aad2b65b20ca0eff22758da4b7ccbbae21ce434a8e42a4d960e97b9f102c740a999e153bbbfe75fb8801643
SSDEEP 384:tNbLwOs8AHsc4sMfwhKQLro2o4/CFsrd:tNvw9816vhKQLro2o4/wQ
TLSH
T1450408834BEE5CF2FA910130087D9AB9927B99D4950EBF9FBF90CD550437252D93A20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads