stormser | 3e2d69e0cac2727a4e9c75658ce0048dfe2ac277a509ca40e0d86e24b222c508

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_8320bb2a53dea1ee709dd0afbd5e0649_elex_wannacry.exe
Size 167KB
Sample260701-k6vafaat3m
SHA256 3e2d69e0cac2727a4e9c75658ce0048dfe2ac277a509ca40e0d86e24b222c508
MD5 8320bb2a53dea1ee709dd0afbd5e0649
SHA1 3241a84510f0244b589d97732525b5b772e598a4
SHA512 b0b70034ae2240d3403e45b8757857ca3243826d1652ded79315e142d0db2c4fb689703ffefe1619af98a1a9820f379fe7bcb9c0a5af353a235ff4fe9abe6eb2
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwpY04/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLrob4/CFsrd
TLSH
T1EDF309834BEA5CF3F7911131087D4AB9927BD9C4910EBEDFAB50CD250077292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 10 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c5e7-3.dat	family_stormser
behavioral2/files/0x000e00000001c5ea-6.dat	family_stormser
behavioral2/files/0x001000000001c5e7-13.dat	family_stormser
behavioral2/files/0x000f00000001c5ea-18.dat	family_stormser
behavioral2/files/0x001100000001c5e7-23.dat	family_stormser
behavioral2/files/0x001000000001c5ea-28.dat	family_stormser
behavioral2/files/0x001200000001c5e7-34.dat	family_stormser
behavioral2/files/0x001100000001c5ea-38.dat	family_stormser
behavioral2/files/0x001300000001c5e7-43.dat	family_stormser
behavioral2/files/0x001200000001c5ea-48.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}	{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D54DFB27-F265-43af-9DE4-F484F871D531}	{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}\stubpath = "C:\\Windows\\{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe"	2026-07-01_8320bb2a53dea1ee709dd0afbd5e0649_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36738104-FCB0-4fc1-8498-00855909AEA3}	{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}	{36738104-FCB0-4fc1-8498-00855909AEA3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}\stubpath = "C:\\Windows\\{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe"	{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D54DFB27-F265-43af-9DE4-F484F871D531}\stubpath = "C:\\Windows\\{D54DFB27-F265-43af-9DE4-F484F871D531}.exe"	{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}\stubpath = "C:\\Windows\\{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe"	{36738104-FCB0-4fc1-8498-00855909AEA3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF939ED4-E340-448d-A142-7118BA3E1C6C}\stubpath = "C:\\Windows\\{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe"	{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9BC4353C-2828-403c-8067-67D06FB20B69}	{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9BC4353C-2828-403c-8067-67D06FB20B69}\stubpath = "C:\\Windows\\{9BC4353C-2828-403c-8067-67D06FB20B69}.exe"	{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2918B552-5CA2-42bd-B4B1-29493DF030D7}\stubpath = "C:\\Windows\\{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe"	{9BC4353C-2828-403c-8067-67D06FB20B69}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31862D4E-08BF-441c-8F2E-A4080C29FBE0}	{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}	2026-07-01_8320bb2a53dea1ee709dd0afbd5e0649_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}\stubpath = "C:\\Windows\\{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe"	{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF939ED4-E340-448d-A142-7118BA3E1C6C}	{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2918B552-5CA2-42bd-B4B1-29493DF030D7}	{9BC4353C-2828-403c-8067-67D06FB20B69}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31862D4E-08BF-441c-8F2E-A4080C29FBE0}\stubpath = "C:\\Windows\\{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe"	{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}	{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36738104-FCB0-4fc1-8498-00855909AEA3}\stubpath = "C:\\Windows\\{36738104-FCB0-4fc1-8498-00855909AEA3}.exe"	{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe

Executes dropped EXE 10 IoCs

pid	Process
5700	{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe
620	{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe
1876	{36738104-FCB0-4fc1-8498-00855909AEA3}.exe
1992	{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe
6148	{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe
4464	{9BC4353C-2828-403c-8067-67D06FB20B69}.exe
6344	{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe
1480	{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe
1204	{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe
696	{D54DFB27-F265-43af-9DE4-F484F871D531}.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe	2026-07-01_8320bb2a53dea1ee709dd0afbd5e0649_elex_wannacry.exe
File created	C:\Windows\{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe	{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe
File created	C:\Windows\{36738104-FCB0-4fc1-8498-00855909AEA3}.exe	{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe
File created	C:\Windows\{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe	{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe
File created	C:\Windows\{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe	{9BC4353C-2828-403c-8067-67D06FB20B69}.exe
File created	C:\Windows\{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe	{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe
File created	C:\Windows\{D54DFB27-F265-43af-9DE4-F484F871D531}.exe	{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe
File created	C:\Windows\{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe	{36738104-FCB0-4fc1-8498-00855909AEA3}.exe
File created	C:\Windows\{9BC4353C-2828-403c-8067-67D06FB20B69}.exe	{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe
File created	C:\Windows\{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe	{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_8320bb2a53dea1ee709dd0afbd5e0649_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D54DFB27-F265-43af-9DE4-F484F871D531}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{36738104-FCB0-4fc1-8498-00855909AEA3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9BC4353C-2828-403c-8067-67D06FB20B69}.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5692	2026-07-01_8320bb2a53dea1ee709dd0afbd5e0649_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	5700	{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe
Token: SeIncBasePriorityPrivilege	620	{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe
Token: SeIncBasePriorityPrivilege	1876	{36738104-FCB0-4fc1-8498-00855909AEA3}.exe
Token: SeIncBasePriorityPrivilege	1992	{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe
Token: SeIncBasePriorityPrivilege	6148	{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe
Token: SeIncBasePriorityPrivilege	4464	{9BC4353C-2828-403c-8067-67D06FB20B69}.exe
Token: SeIncBasePriorityPrivilege	6344	{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe
Token: SeIncBasePriorityPrivilege	1480	{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe
Token: SeIncBasePriorityPrivilege	1204	{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5692 wrote to memory of 5700	5692	2026-07-01_8320bb2a53dea1ee709dd0afbd5e0649_elex_wannacry.exe	89
PID 5692 wrote to memory of 4936	5692	2026-07-01_8320bb2a53dea1ee709dd0afbd5e0649_elex_wannacry.exe	90
PID 5700 wrote to memory of 620	5700	{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe	92
PID 5700 wrote to memory of 3404	5700	{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe	93
PID 620 wrote to memory of 1876	620	{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe	94
PID 620 wrote to memory of 4136	620	{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe	95
PID 1876 wrote to memory of 1992	1876	{36738104-FCB0-4fc1-8498-00855909AEA3}.exe	96
PID 1876 wrote to memory of 5272	1876	{36738104-FCB0-4fc1-8498-00855909AEA3}.exe	97
PID 1992 wrote to memory of 6148	1992	{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe	98
PID 1992 wrote to memory of 4948	1992	{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe	99
PID 6148 wrote to memory of 4464	6148	{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe	100
PID 6148 wrote to memory of 2308	6148	{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe	101
PID 4464 wrote to memory of 6344	4464	{9BC4353C-2828-403c-8067-67D06FB20B69}.exe	102
PID 4464 wrote to memory of 2832	4464	{9BC4353C-2828-403c-8067-67D06FB20B69}.exe	103
PID 6344 wrote to memory of 1480	6344	{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe	104
PID 6344 wrote to memory of 1272	6344	{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe	105
PID 1480 wrote to memory of 1204	1480	{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe	106
PID 1480 wrote to memory of 928	1480	{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe	107
PID 1204 wrote to memory of 696	1204	{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe	108
PID 1204 wrote to memory of 1288	1204	{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-01_8320bb2a53dea1ee709dd0afbd5e0649_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_8320bb2a53dea1ee709dd0afbd5e0649_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5692
- C:\Windows\{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe
  C:\Windows\{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe
    C:\Windows\{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Windows\{36738104-FCB0-4fc1-8498-00855909AEA3}.exe
      C:\Windows\{36738104-FCB0-4fc1-8498-00855909AEA3}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Windows\{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe
        
        C:\Windows\{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1992
      - C:\Windows\{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe
        
        C:\Windows\{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6148
        
        C:\Windows\{9BC4353C-2828-403c-8067-67D06FB20B69}.exe
        
        C:\Windows\{9BC4353C-2828-403c-8067-67D06FB20B69}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe
        
        C:\Windows\{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6344
        
        C:\Windows\{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe
        
        C:\Windows\{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe
        
        C:\Windows\{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\{D54DFB27-F265-43af-9DE4-F484F871D531}.exe
        
        C:\Windows\{D54DFB27-F265-43af-9DE4-F484F871D531}.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8C2D9~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31862~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2918B~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9BC43~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CF939~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{81100~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{36738~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2F653~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{34887~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe

Path C:\Windows\{2918B552-5CA2-42bd-B4B1-29493DF030D7}.exe
Size 167KB
SHA256 4fcc2702f8f711b4de1b36e91fbf51d1f95417faf2847c5b09579de0cf426f3e
MD5 2ee211ee7dff074ffd1ad77a18693d68
SHA1 aeec868091ae1e4f9002a7157600357e3615a725
SHA512 b33ebf2b60a2dfefe7e384502302649caf8d56ae1ab5118e8b310c540b73d2d43eacf77a27be017b28487a56a16ee78fa9a0a825a9445473d402b8d73e13b779
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwE8Y04/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLrof4/CFsrd
TLSH
T117F309834BEA5CF3F7911131087D4BB9927B99C4950EBEDFAB50CD250077292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe

Path C:\Windows\{2F6536E4-D4E9-4438-BF3B-77DDAE1DF4BD}.exe
Size 167KB
SHA256 9296f296b4174d18673f8045494b8353de4568859569dc92d99d3ee9a3dab87b
MD5 41840d79d0eade524d50997c4b562a71
SHA1 5cb91ddc4ba0bd141f17429b2b95c95d3f3eafe0
SHA512 92595d4e86545cb36cff3cc675ddd7a24d3fc6070a0e8f1503a00026641e1b231104aad9d74ba182784757415c8bf842de29a70654533e45349839ef9648ea7c
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwEPY04/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLroQ4/CFsrd
TLSH
T187F308834BEE5CF3F7911131087D4BB9927B99C4960EBE9FAB50CD250077292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe

Path C:\Windows\{31862D4E-08BF-441c-8F2E-A4080C29FBE0}.exe
Size 167KB
SHA256 540b488e0ae9e63da2e4460e72b4cb914916711f86112f3f8b4ea37113852959
MD5 6784139d0d789ac124180ba46f55fa7b
SHA1 3da1ba5569afbd3454d03bb14460f86095a791ea
SHA512 dedd11e9415b31aa059adb94951db6524260e6636103c40b7b6d20d4df7968332180ea790046520a04d3a337f8a4328851ad9f65225d84f4fba96f44702734fc
SSDEEP 384:4/bLwOs8AHsc4sMfwhKQLrogb4/CFsrd:Wvw9816vhKQLroY4/wQ
TLSH
T135F308834BEE5CF3F7911131087D4BB9927B99C4950EBE9FAB90CD650077292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe

Path C:\Windows\{3488772C-A6FE-4162-A75F-B40D3E6CB5F2}.exe
Size 167KB
SHA256 bacdcae9c22d64e651cea81bd8ce86f5ad757eeee943ed348255224362c035c6
MD5 fc1b9330f56b9ae7ef12f3f9c09bf304
SHA1 e88d60d7dbebd15702f6fd5d708ebe831f7f49f4
SHA512 bda3408befab961211949270b0f1668ec6f71bd16e1ec1464ded5b7c8b8c425b2104ec19a8fb3664852a86f9429521af0999769fed3d38f39b444c6a8d9f109e
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwWY04/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLroc4/CFsrd
TLSH
T197F309834BDA5CF3F7911131087D4AB9927B99C4910EBEDFBB90CD250077292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{36738104-FCB0-4fc1-8498-00855909AEA3}.exe

Path C:\Windows\{36738104-FCB0-4fc1-8498-00855909AEA3}.exe
Size 167KB
SHA256 0bdcf0629f0ee62512be6136237390d400472ea311c59bdc158f41be4ba6eee9
MD5 9c5dcd6fe369688f38ba1e5be459fbec
SHA1 68fd265a872167e8975cd0bca0c8b64bd6eb2110
SHA512 36b3449e5f43e7b805a4683747b2c85ddf8dd0f7ca9daa83482531709959d9e5dbaeb4e0f01a99f383962a6a165406bf9fb47148825f6945de12111a8b45cf4d
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwCbY04/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLrow4/CFsrd
TLSH
T1CBF309834BEE5CF3F7911131087D4AB9927B99C4950EBEDFAB50CD250077292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe

Path C:\Windows\{81100C3E-91E9-4e53-8ED5-57A40FD00DF9}.exe
Size 167KB
SHA256 e072798d16caed4dcbe16f6201ec898ce5a7a54f922fa695e2bb78972b02d479
MD5 d6272ecb12214b3d8129b0c641d63260
SHA1 aa5e9619a519dd600b6044026719364109b0f7c4
SHA512 b8d9f2172109bb7e3357c3450ea2e9517281092b9a8d7e03c50afa529c07e2e8372d84fa5de6540c2ea20f0345b1e6eb252bee873b704b7ecd1a9a34c04cd3af
SSDEEP 384:4/bLwOs8AHsc4sMfwhKQLroQL4/CFsrd:Wvw9816vhKQLroQL4/wQ
TLSH
T10EF309834BEA5CF3F7911131087D4BB9927B99C4950EBE9FAB50CD650077292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe

Path C:\Windows\{8C2D9225-83DD-4d25-AB0E-53CD2F26BCC7}.exe
Size 167KB
SHA256 b1b18a6185a023a6dcc3b6e2545108805b46df9826f2d2822e71a37e5d9a01f8
MD5 abef1e338e4f4b849c1239fbe91ab78e
SHA1 e023020aacc07330ee973cd0aee88afea0893edf
SHA512 adc39cad7046e57c8278e7230d32266ca5d4d15c8ed5dd2e342a37da5377088bbddb016bf0c2fd0701572a3bedfe714a7bc48d3b885ae4e12cb501f6db8b0397
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwLY04/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLrot4/CFsrd
TLSH
T13CF309834BEA5CF3F7911131087D4BB9927B99D4950EBEDFAB50CD250077292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9BC4353C-2828-403c-8067-67D06FB20B69}.exe

Path C:\Windows\{9BC4353C-2828-403c-8067-67D06FB20B69}.exe
Size 167KB
SHA256 aa0d116ff90539711172c19ed7bfc7b50b87ed004cef1a455c5995550f320c4b
MD5 133192c385c9c8fc1320f6aa13d062b4
SHA1 f8a3693c54b590d7bdcd6c971e5a1e257ee3916d
SHA512 2019d8ee86893f8c9905fa9e167472a47902ad4ac62e8f01108abb06bf93f61726db46996b067997e4626135e2a08326abf8885d4a08ef8e91a527ccc0470f21
SSDEEP 384:4/bLwOs8AHsc4sMfwhKQLroFL4/CFsrd:Wvw9816vhKQLroFL4/wQ
TLSH
T17AF308834BEA5CF3F7951131087D4BB9927B99C4910EBEDFAB50CD250077292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe

Path C:\Windows\{CF939ED4-E340-448d-A142-7118BA3E1C6C}.exe
Size 167KB
SHA256 ec2259dbcd6ff20f093b47ad5070ac9605553f14c7b08472e0732df49487f92e
MD5 2f92bb72175aa263e7cf480fe5431547
SHA1 3858aca805bd2df0ee644351a17d8c501b9b7421
SHA512 066a2ed3d38fb9d8629ead81f985b74a56b246dce141bd36fdfca0b66ccfc0fc1bd83c92c2abdd39e73c64fe71d1e2c3558af64f7faf3f00be348e04f2ad130f
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw8Y04/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLroK4/CFsrd
TLSH
T1F9F309834BEA5CF3F7911131087D4AB9927B99C4910EBE9FAB50CD250037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D54DFB27-F265-43af-9DE4-F484F871D531}.exe

Path C:\Windows\{D54DFB27-F265-43af-9DE4-F484F871D531}.exe
Size 167KB
SHA256 6dae98f0c7443c12577437a427278e1a93f48063c6f42a08d8c397279585e8b1
MD5 80c4cd4ae82f3ac8a7dac095027b91c2
SHA1 ff58a016e5803cc83cdc715a5c2e657d10c6c636
SHA512 4d87f41783ce39ae6530ee9703999c912bf594c057dbc1c6ba35c226e62723f56d0f40c44e9e51d4631573422db908b86bb08e2b80961eef1dee6768308145e8
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw/WY04/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLroU4/CFsrd
TLSH
T147F308834BEE5CF3F7911131087D4AB9927BD9C4920EBE9FAB50CD250077292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads