stormser | 5ec11c66095d305c7598d4215d78598b81a53efe3bfc94cace2a330cffdd32b8

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_d0f0c2f360a3cb1ddcaba601d89cf11a_elex_wannacry.exe
Size 60KB
Sample260629-ye55hsdy91
SHA256 5ec11c66095d305c7598d4215d78598b81a53efe3bfc94cace2a330cffdd32b8
MD5 d0f0c2f360a3cb1ddcaba601d89cf11a
SHA1 600aa611fbe6509521c43fc80e3f7a7d66d7eb38
SHA512 3d8e93cb45fd4960959b8a1b9b2caf090b3e1703de9eaeb725bb3fa893d76527db2e96f643a10e4f8ebdce593f04fc65c801bdb5a395da1eeb18ea8ab1165c88
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwAY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroO4/CFsrd
TLSH
T14253F9834BDE9CF2F791123108794AB9927B9AD4910EBE9FBF90CD540037692E53A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 10 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c6ae-3.dat	family_stormser
behavioral2/files/0x000d00000001c6af-6.dat	family_stormser
behavioral2/files/0x000e00000001c6ae-13.dat	family_stormser
behavioral2/files/0x000e00000001c6af-17.dat	family_stormser
behavioral2/files/0x000f00000001c6ae-22.dat	family_stormser
behavioral2/files/0x000f00000001c6af-28.dat	family_stormser
behavioral2/files/0x001000000001c6ae-33.dat	family_stormser
behavioral2/files/0x001000000001c6af-39.dat	family_stormser
behavioral2/files/0x001100000001c6ae-43.dat	family_stormser
behavioral2/files/0x001100000001c6af-48.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{812BAFB5-35B0-49be-8746-C07F3FB0A5C5}	{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{812BAFB5-35B0-49be-8746-C07F3FB0A5C5}\stubpath = "C:\\Windows\\{812BAFB5-35B0-49be-8746-C07F3FB0A5C5}.exe"	{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93294359-B1AE-4b30-801A-593E696F8C31}	{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE449215-440F-4235-A5DB-1D05E179F3A7}	{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93294359-B1AE-4b30-801A-593E696F8C31}\stubpath = "C:\\Windows\\{93294359-B1AE-4b30-801A-593E696F8C31}.exe"	{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}\stubpath = "C:\\Windows\\{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe"	{1A2DA198-192E-43f7-87D1-EC401337A162}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8901828D-E601-4462-9768-00658F7F2D37}	2026-06-25_d0f0c2f360a3cb1ddcaba601d89cf11a_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D082AA55-9131-46ea-AD24-1728D37CAE1A}\stubpath = "C:\\Windows\\{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe"	{8901828D-E601-4462-9768-00658F7F2D37}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD43D399-F544-4fd2-9928-3FAA775A85DB}	{93294359-B1AE-4b30-801A-593E696F8C31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE449215-440F-4235-A5DB-1D05E179F3A7}\stubpath = "C:\\Windows\\{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe"	{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}	{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8077174-18A8-48b3-BA4C-861B4C12179F}	{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A2DA198-192E-43f7-87D1-EC401337A162}	{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A2DA198-192E-43f7-87D1-EC401337A162}\stubpath = "C:\\Windows\\{1A2DA198-192E-43f7-87D1-EC401337A162}.exe"	{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8901828D-E601-4462-9768-00658F7F2D37}\stubpath = "C:\\Windows\\{8901828D-E601-4462-9768-00658F7F2D37}.exe"	2026-06-25_d0f0c2f360a3cb1ddcaba601d89cf11a_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D082AA55-9131-46ea-AD24-1728D37CAE1A}	{8901828D-E601-4462-9768-00658F7F2D37}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD43D399-F544-4fd2-9928-3FAA775A85DB}\stubpath = "C:\\Windows\\{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe"	{93294359-B1AE-4b30-801A-593E696F8C31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}\stubpath = "C:\\Windows\\{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe"	{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8077174-18A8-48b3-BA4C-861B4C12179F}\stubpath = "C:\\Windows\\{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe"	{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}	{1A2DA198-192E-43f7-87D1-EC401337A162}.exe

Executes dropped EXE 10 IoCs

pid	Process
2388	{8901828D-E601-4462-9768-00658F7F2D37}.exe
5220	{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe
1948	{93294359-B1AE-4b30-801A-593E696F8C31}.exe
6816	{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe
5204	{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe
6548	{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe
2812	{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe
4932	{1A2DA198-192E-43f7-87D1-EC401337A162}.exe
704	{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe
2460	{812BAFB5-35B0-49be-8746-C07F3FB0A5C5}.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\{93294359-B1AE-4b30-801A-593E696F8C31}.exe	{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe
File created	C:\Windows\{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe	{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe
File created	C:\Windows\{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe	{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe
File created	C:\Windows\{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe	{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe
File created	C:\Windows\{1A2DA198-192E-43f7-87D1-EC401337A162}.exe	{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe
File created	C:\Windows\{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe	{1A2DA198-192E-43f7-87D1-EC401337A162}.exe
File created	C:\Windows\{812BAFB5-35B0-49be-8746-C07F3FB0A5C5}.exe	{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe
File created	C:\Windows\{8901828D-E601-4462-9768-00658F7F2D37}.exe	2026-06-25_d0f0c2f360a3cb1ddcaba601d89cf11a_elex_wannacry.exe
File created	C:\Windows\{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe	{8901828D-E601-4462-9768-00658F7F2D37}.exe
File created	C:\Windows\{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe	{93294359-B1AE-4b30-801A-593E696F8C31}.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8901828D-E601-4462-9768-00658F7F2D37}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{93294359-B1AE-4b30-801A-593E696F8C31}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1A2DA198-192E-43f7-87D1-EC401337A162}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_d0f0c2f360a3cb1ddcaba601d89cf11a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{812BAFB5-35B0-49be-8746-C07F3FB0A5C5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1684	2026-06-25_d0f0c2f360a3cb1ddcaba601d89cf11a_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2388	{8901828D-E601-4462-9768-00658F7F2D37}.exe
Token: SeIncBasePriorityPrivilege	5220	{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe
Token: SeIncBasePriorityPrivilege	1948	{93294359-B1AE-4b30-801A-593E696F8C31}.exe
Token: SeIncBasePriorityPrivilege	6816	{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe
Token: SeIncBasePriorityPrivilege	5204	{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe
Token: SeIncBasePriorityPrivilege	6548	{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe
Token: SeIncBasePriorityPrivilege	2812	{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe
Token: SeIncBasePriorityPrivilege	4932	{1A2DA198-192E-43f7-87D1-EC401337A162}.exe
Token: SeIncBasePriorityPrivilege	704	{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2388	1684	2026-06-25_d0f0c2f360a3cb1ddcaba601d89cf11a_elex_wannacry.exe	88
PID 1684 wrote to memory of 5124	1684	2026-06-25_d0f0c2f360a3cb1ddcaba601d89cf11a_elex_wannacry.exe	89
PID 2388 wrote to memory of 5220	2388	{8901828D-E601-4462-9768-00658F7F2D37}.exe	90
PID 2388 wrote to memory of 2456	2388	{8901828D-E601-4462-9768-00658F7F2D37}.exe	91
PID 5220 wrote to memory of 1948	5220	{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe	92
PID 5220 wrote to memory of 484	5220	{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe	93
PID 1948 wrote to memory of 6816	1948	{93294359-B1AE-4b30-801A-593E696F8C31}.exe	94
PID 1948 wrote to memory of 6400	1948	{93294359-B1AE-4b30-801A-593E696F8C31}.exe	95
PID 6816 wrote to memory of 5204	6816	{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe	96
PID 6816 wrote to memory of 1740	6816	{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe	97
PID 5204 wrote to memory of 6548	5204	{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe	98
PID 5204 wrote to memory of 5092	5204	{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe	99
PID 6548 wrote to memory of 2812	6548	{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe	100
PID 6548 wrote to memory of 5080	6548	{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe	101
PID 2812 wrote to memory of 4932	2812	{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe	102
PID 2812 wrote to memory of 2580	2812	{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe	103
PID 4932 wrote to memory of 704	4932	{1A2DA198-192E-43f7-87D1-EC401337A162}.exe	104
PID 4932 wrote to memory of 5740	4932	{1A2DA198-192E-43f7-87D1-EC401337A162}.exe	105
PID 704 wrote to memory of 2460	704	{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe	106
PID 704 wrote to memory of 6296	704	{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-06-25_d0f0c2f360a3cb1ddcaba601d89cf11a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_d0f0c2f360a3cb1ddcaba601d89cf11a_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\{8901828D-E601-4462-9768-00658F7F2D37}.exe
  C:\Windows\{8901828D-E601-4462-9768-00658F7F2D37}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe
    C:\Windows\{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Windows\{93294359-B1AE-4b30-801A-593E696F8C31}.exe
      C:\Windows\{93294359-B1AE-4b30-801A-593E696F8C31}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1948
    - - C:\Windows\{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe
        
        C:\Windows\{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6816
      - C:\Windows\{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe
        
        C:\Windows\{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5204
        
        C:\Windows\{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe
        
        C:\Windows\{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6548
        
        C:\Windows\{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe
        
        C:\Windows\{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\{1A2DA198-192E-43f7-87D1-EC401337A162}.exe
        
        C:\Windows\{1A2DA198-192E-43f7-87D1-EC401337A162}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe
        
        C:\Windows\{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\{812BAFB5-35B0-49be-8746-C07F3FB0A5C5}.exe
        
        C:\Windows\{812BAFB5-35B0-49be-8746-C07F3FB0A5C5}.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7CEA9~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1A2DA~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A8077~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2A11A~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BE449~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD43D~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{93294~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D082A~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{89018~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1A2DA198-192E-43f7-87D1-EC401337A162}.exe

Path C:\Windows\{1A2DA198-192E-43f7-87D1-EC401337A162}.exe
Size 60KB
SHA256 b21116d5f7405a79633f9053abac3040b9b7b096dc61df95ead2938f8a78d97d
MD5 3a10b80e95ebb1f1a620ad5040eb6393
SHA1 098ecbef102902f2871c79e336cf34ed7ff863e5
SHA512 94ca85bb8917dfaf825dd58b2c2474b792ca695e9aca8d014081b4d806fb731f8b174d50c7ae50201b12ab49fd39aa814c9e8f4b7ded2000f74f2b787bb5ad6c
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwuY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroU4/CFsrd
TLSH
T1245309834BDE5CF2F791127118794AB9927B9AC4910EBE9FBF90CE140037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe

Path C:\Windows\{2A11A050-37E5-4f69-AAE2-44CEBCBCE514}.exe
Size 60KB
SHA256 3b4add95ea1cbda875609a4817692a88a85b002137ae03eb0b6e3f86ed1fec6d
MD5 f7014456831bc3e5f88b62f587488568
SHA1 1b9acaaae9c551d487ecc86d42ae036f9a823f58
SHA512 6bc9c29b573f241dcfdf093aead393963bbd6c6953688016f43a169c09097c95116176eb6d3a8c57202f5a8144295ad4ad85dfce5af01d22208b3c99567f53c8
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwElY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroG4/CFsrd
TLSH
T1D05309834BDE9CF2F791127108794AB9927B9AC4910EBE9FBF90CD544037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe

Path C:\Windows\{7CEA9D3A-DF5B-43b3-89D7-9E8FDABA34E8}.exe
Size 60KB
SHA256 4b0c00c12526017df064a69a100abd61b6fee04ab845dd502c91a758f324e204
MD5 7b0c3d02349e649137d7d86dbbac8894
SHA1 7621a9ea352478a6381d51d5415852899a4c37a8
SHA512 8210d6e0cd4b16f89194ab74c64edd579faa13caf1bdff959ac31321fe6739c408281f6b0d4055f5e23bd4419d7b9bd7343bfe982e1bfd90f9e36425f11bc779
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwWY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroc4/CFsrd
TLSH
T1595309834BDE9CF2F791123108795BB9927B9AC4910EBE9FBF90CD540037692E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{812BAFB5-35B0-49be-8746-C07F3FB0A5C5}.exe

Path C:\Windows\{812BAFB5-35B0-49be-8746-C07F3FB0A5C5}.exe
Size 60KB
SHA256 78c056ef0bd84d6d4ca7cbdf7db59395cb8def2b75595fd0ab86adcec66b3b1e
MD5 fbd61a90044d9c2cda78f2a949401887
SHA1 4fb7a797d363d9e12b5096467ecf9b6aa1723e57
SHA512 86c16c6513f308a8a1d21f26f58719a0eba6f323842f32e25d75565ea951502ec209f086688385be6e75c6face4ee11d0ecd7c58fa14dac3da2ee9d3098c1329
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwVY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLron4/CFsrd
TLSH
T15F5309834BDE5CF2F791123108794AB9927B9AD4910EBE9FBF90CD140037692E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8901828D-E601-4462-9768-00658F7F2D37}.exe

Path C:\Windows\{8901828D-E601-4462-9768-00658F7F2D37}.exe
Size 60KB
SHA256 9e3f101ee341e9239c2f5967d285d03bda58a80d62a568df3d951a70d311e2de
MD5 9e0dd746ba4ccde418bbd77cf4ff24ab
SHA1 bd69ba5e5a7d2480416c9fb1a35f051f3841bddc
SHA512 4f4e14dda0a40c40e8ca7877b257511e849c2bb82dae5be0629da2269549ec182ecaf06d1d89ac454c4b76a9bfa8265c06423410d15cc6269dfb5ad3001822a5
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwCY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLro44/CFsrd
TLSH
T1805309834BDE5CF2F791123118794AB9927B9AD4910EBE9FBF90CD540037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{93294359-B1AE-4b30-801A-593E696F8C31}.exe

Path C:\Windows\{93294359-B1AE-4b30-801A-593E696F8C31}.exe
Size 60KB
SHA256 8864fc3d3814ceb0dd1f2bb29c479978a1734b29a5530a13338a1485c290a75b
MD5 945d138bfae24eaeb4f713ab521a3f8f
SHA1 3802790215163688328eaab55e46609e9c404665
SHA512 37928f4bf59dfc20ee006425863bfa4120ba057692ddb9867e860087e339543804c5f4cf11d96bef5bc20ba9db85abfff9c3d4977677782c1e8403678f8cfe6d
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqweY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLrok4/CFsrd
TLSH
T1E45309834BDE5CF2F791123108794AB9927B9AD4910EBE9FBF90CD540037692E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe

Path C:\Windows\{A8077174-18A8-48b3-BA4C-861B4C12179F}.exe
Size 60KB
SHA256 ab80f83c686a8698233feeb49b2a2ec5ac71c929187964d256c59600a6358b37
MD5 3db4c2927cc2d9f9aa0dcc517fda1f38
SHA1 9488db018c4ab5080cb290c8fe67a6a2dcdfbf72
SHA512 9fba0ceded0a739894bef81b6a2e23ed90949c9627fe603eaecabe2f29b3a9de3ba63815fa03a3a6f5f7c8020cf32285fed0470e361a802a3a2cbce669244de1
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwgY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLrou4/CFsrd
TLSH
T19A530A834BDE5CF2F791127108794AB9927B99C4910EBE9FBF90CD540037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe

Path C:\Windows\{BE449215-440F-4235-A5DB-1D05E179F3A7}.exe
Size 60KB
SHA256 fdc8d710ac63d29b7250d506126ff3d73b4ce1ef6b5f457ce22c8112529eceac
MD5 701dea38a7565b17dfccef0c48bb2341
SHA1 48636bd085cf9c4cd3a086fec2ae35e53d1e0d58
SHA512 435c27ad8b7a639dd359695dd67f4977b93a8dd0b773b56e469f8b934d1c2c744ab064ff8c9978e55a2191949002a961f5edfb8c482e7ce6a993e5fac6b08dcd
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwhY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroT4/CFsrd
TLSH
T11153F8834BDE9CF2F791127108794AB9927B9AC4910EBE9FBF90CD540037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe

Path C:\Windows\{D082AA55-9131-46ea-AD24-1728D37CAE1A}.exe
Size 60KB
SHA256 9773401cfd99c385cb71b68fa71999caf888ba6ec414daaf48a90d3f2e0d2237
MD5 aff7233b4c50a8655929e97b21ddc9ab
SHA1 da0dc46fe133c46907fa334e6bc4882dd7406450
SHA512 7eead349df8f746232bc697a0cf427d6602e2558bbe0f422d249fe6ce9f822ae496bbaa0ad189cc8928bba2e20eafeb65cc1a5064f217934bbd996d84e83fbe5
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwwY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroe4/CFsrd
TLSH
T10553F9834BDE5CF2F791127108794AB9927B9AC4910EBE9FBF90CD540037692E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe

Path C:\Windows\{FD43D399-F544-4fd2-9928-3FAA775A85DB}.exe
Size 60KB
SHA256 9f3561a8f161594cc16f6cae04bd8c9ff97cf268cc502001a75221322b50a231
MD5 50560e32354c54e481ea2db5232aefed
SHA1 661ebc28c2dc6a91d04aaa8319bdcfa23b126be2
SHA512 fab59d822d894ba07a0e5f4ce540e1bd00c411304bd04c2e6654ed441e4c4348dd05b730033d36cff5ca892ff6c87aaadfc33d30cf7ad95e5ba6e922d1f02753
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw7Y04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLro94/CFsrd
TLSH
T1FC5309834BDE9CF2F791127108794AB9927B9AC4910EBE9FBF90CD540037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads