stormser | 3e60a193c7d68353f76be3a227b1137529de09cf115c7440a86091952a5f70aa

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_19b272fbfc4ac90cc98b2a111dc9accb_elex_wannacry.exe
Size 372KB
Sample260709-yfc55ahy21
SHA256 3e60a193c7d68353f76be3a227b1137529de09cf115c7440a86091952a5f70aa
MD5 19b272fbfc4ac90cc98b2a111dc9accb
SHA1 bdce8f808d2b6937d89646b29bb40e48b455bb1b
SHA512 3d803176ebd9d6242ea489858efcfcb67dbdd8efd16feba9490b864d152cc873bfe30e11f0481ba9409c71de0d1e061b71cb71f6ba1038f0452ea8900e75b264
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroZ2x4/CFsrdb:Gvw9816vhKQLroZ2x4/wQR
TLSH
T1558408835BDE9CF2FB91113009798AB9927B9AC4910EBEDFBF90CD150437252D93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024693-3.dat	family_stormser
behavioral1/files/0x0008000000024684-6.dat	family_stormser
behavioral1/files/0x0008000000024698-8.dat	family_stormser
behavioral1/files/0x000800000002469b-14.dat	family_stormser
behavioral1/files/0x0002000000022077-18.dat	family_stormser
behavioral1/files/0x00030000000006cf-22.dat	family_stormser
behavioral1/files/0x00030000000006fd-26.dat	family_stormser
behavioral1/files/0x00040000000006cf-30.dat	family_stormser
behavioral1/files/0x00040000000006fd-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA8EF2F9-02DE-4448-B1B8-E63A88414462}	{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04B5C1CC-A781-4043-9406-10541D0AAC5D}	{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BB9A07-5439-471e-B710-C30D0CF98C33}	{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC4A8194-8F21-4f51-892C-EEA5717E1430}	{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA8EF2F9-02DE-4448-B1B8-E63A88414462}\stubpath = "C:\\Windows\\{BA8EF2F9-02DE-4448-B1B8-E63A88414462}.exe"	{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}	{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93E3753D-4F7D-4eb7-A276-D92FE95A947A}	{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93E3753D-4F7D-4eb7-A276-D92FE95A947A}\stubpath = "C:\\Windows\\{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe"	{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04B5C1CC-A781-4043-9406-10541D0AAC5D}\stubpath = "C:\\Windows\\{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe"	{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{482AECDC-F4A2-4ac9-976B-74C17846575B}	{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{482AECDC-F4A2-4ac9-976B-74C17846575B}\stubpath = "C:\\Windows\\{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe"	{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}	{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}\stubpath = "C:\\Windows\\{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe"	{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7DAFD627-19B5-4bae-8A00-65D082243E68}	2026-07-09_19b272fbfc4ac90cc98b2a111dc9accb_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7DAFD627-19B5-4bae-8A00-65D082243E68}\stubpath = "C:\\Windows\\{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe"	2026-07-09_19b272fbfc4ac90cc98b2a111dc9accb_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BB9A07-5439-471e-B710-C30D0CF98C33}\stubpath = "C:\\Windows\\{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe"	{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC4A8194-8F21-4f51-892C-EEA5717E1430}\stubpath = "C:\\Windows\\{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe"	{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}\stubpath = "C:\\Windows\\{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe"	{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe

Executes dropped EXE 9 IoCs

pid	Process
4196	{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe
2056	{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe
2460	{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe
3112	{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe
4256	{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe
4912	{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe
1536	{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe
868	{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe
4084	{BA8EF2F9-02DE-4448-B1B8-E63A88414462}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe	{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe
File created	C:\Windows\{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe	{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe
File created	C:\Windows\{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe	{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe
File created	C:\Windows\{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe	{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe
File created	C:\Windows\{BA8EF2F9-02DE-4448-B1B8-E63A88414462}.exe	{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe
File created	C:\Windows\{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe	2026-07-09_19b272fbfc4ac90cc98b2a111dc9accb_elex_wannacry.exe
File created	C:\Windows\{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe	{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe
File created	C:\Windows\{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe	{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe
File created	C:\Windows\{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe	{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BA8EF2F9-02DE-4448-B1B8-E63A88414462}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_19b272fbfc4ac90cc98b2a111dc9accb_elex_wannacry.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3996	2026-07-09_19b272fbfc4ac90cc98b2a111dc9accb_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4196	{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe
Token: SeIncBasePriorityPrivilege	2056	{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe
Token: SeIncBasePriorityPrivilege	2460	{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe
Token: SeIncBasePriorityPrivilege	3112	{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe
Token: SeIncBasePriorityPrivilege	4256	{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe
Token: SeIncBasePriorityPrivilege	4912	{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe
Token: SeIncBasePriorityPrivilege	1536	{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe
Token: SeIncBasePriorityPrivilege	868	{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 4196	3996	2026-07-09_19b272fbfc4ac90cc98b2a111dc9accb_elex_wannacry.exe	95
PID 3996 wrote to memory of 5112	3996	2026-07-09_19b272fbfc4ac90cc98b2a111dc9accb_elex_wannacry.exe	96
PID 4196 wrote to memory of 2056	4196	{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe	97
PID 4196 wrote to memory of 3444	4196	{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe	98
PID 2056 wrote to memory of 2460	2056	{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe	100
PID 2056 wrote to memory of 4416	2056	{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe	101
PID 2460 wrote to memory of 3112	2460	{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe	103
PID 2460 wrote to memory of 1220	2460	{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe	104
PID 3112 wrote to memory of 4256	3112	{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe	105
PID 3112 wrote to memory of 2088	3112	{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe	106
PID 4256 wrote to memory of 4912	4256	{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe	107
PID 4256 wrote to memory of 4812	4256	{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe	108
PID 4912 wrote to memory of 1536	4912	{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe	109
PID 4912 wrote to memory of 4500	4912	{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe	110
PID 1536 wrote to memory of 868	1536	{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe	111
PID 1536 wrote to memory of 5020	1536	{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe	112
PID 868 wrote to memory of 4084	868	{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe	113
PID 868 wrote to memory of 2420	868	{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-07-09_19b272fbfc4ac90cc98b2a111dc9accb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_19b272fbfc4ac90cc98b2a111dc9accb_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe
  C:\Windows\{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe
    C:\Windows\{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe
      C:\Windows\{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Windows\{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe
        
        C:\Windows\{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3112
      - C:\Windows\{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe
        
        C:\Windows\{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe
        
        C:\Windows\{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe
        
        C:\Windows\{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe
        
        C:\Windows\{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\{BA8EF2F9-02DE-4448-B1B8-E63A88414462}.exe
        
        C:\Windows\{BA8EF2F9-02DE-4448-B1B8-E63A88414462}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{482AE~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EE8B1~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9C7E3~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BC4A8~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{44BB9~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{04B5C~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1220
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{93E37~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7DAFD~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe

Path C:\Windows\{04B5C1CC-A781-4043-9406-10541D0AAC5D}.exe
Size 372KB
SHA256 4cedc66bf9dc645d84f235710fa9f404db976108123e35b25625792a94b06543
MD5 6f11a69ec75ecfbd52d3948d743e735d
SHA1 c7697349b7c3fbe9c7c2c437d5b340783efbf98d
SHA512 7ac657b233bc2a9398fedffcd1c4681e6274a2fc595bb7a395134483e1886aff57414b909023fccb816e6cab538dbdc78ee1308bb29ec2142c5bb79b0145f4a4
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroDcx4/CFsrdb:Gvw9816vhKQLroDcx4/wQR
TLSH
T1768409835BDE9CF2FB91113009798AB9927B99C4910EBEDFBF90CD550037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe

Path C:\Windows\{44BB9A07-5439-471e-B710-C30D0CF98C33}.exe
Size 372KB
SHA256 2a558db919cb0d065c7cafe26b5a49494a091d5671d44e3458d5999fce09ddc3
MD5 78fd2e705df9df7de935b8090088f3cc
SHA1 ac0ed570c79864ae09d0cdcbdeaa39c3006d800a
SHA512 76afdfd9d8fa5d9e77b96d02dfb9b8bfc3ecc0fd3165be2c360adc5cbfae9512c547c941cd4de3d938be1f860cf34115171791e5f0a352cbf0b987fa805921e4
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrotx4/CFsrdb:Gvw9816vhKQLrotx4/wQR
TLSH
T1788419835BDE9CF2FB91113009798AB9927B9AC4910EBEDFBF90CD150037252D93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe

Path C:\Windows\{482AECDC-F4A2-4ac9-976B-74C17846575B}.exe
Size 372KB
SHA256 cc4851d5d2904e752ddc006d3400432e911fc31063f6bd073a93f262debd0ba1
MD5 76e4faaff73ce7d15036da7ace8a3ad6
SHA1 8c25024a37e4ea38a7eccfc356bc857c3b6bf93b
SHA512 0e85e75c3bf7b5ccd7ad5d040b4cfcc8b1e9e54d3d520923d0ff8f371745f4f7c26af23da72e6fa560df67bf5817e5852a073bb387f9ce44012a08cf13bc6adf
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroZWx4/CFsrdb:Gvw9816vhKQLroZWx4/wQR
TLSH
T1738409835BDE9CF2FB91113009798AB9927B9AD4914EBEDFBF90CD150037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe

Path C:\Windows\{7DAFD627-19B5-4bae-8A00-65D082243E68}.exe
Size 372KB
SHA256 bb277da81d5bc0e07f527a167e1e5711283e9503e22df198ced9a9cc03d1ffc7
MD5 ab7c9337eaf47512787c99446d7336cf
SHA1 febd4bde98b32e5a34e319ff26bb0054c51cbfb8
SHA512 cf850400f28637595f17788f27252513c25cc63befb2e8323d7915e91a7754d53de236e073d9337d13439fb0c48d134ecb82deff4fb9796b4991cfef114ea581
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroLx4/CFsrdb:Gvw9816vhKQLroLx4/wQR
TLSH
T1B48408835BDE9CF2FB91113009798AB9927B9AD4914EBEDFBF90CD150037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe

Path C:\Windows\{93E3753D-4F7D-4eb7-A276-D92FE95A947A}.exe
Size 372KB
SHA256 8ec50ff75a595dbf6028c69bb69b997d57774f7a659612bc4a2323483fca4dcb
MD5 035fa345b00832930b9774a1661d93f5
SHA1 28e59881a6e41f299ce5f9dfc550d91954e7bf76
SHA512 f9b9ea35dd08d103588743f1f93a2868b5206a72631aeb966e5e3b972799bf879501e0989a35917b93c7e0421a21ac3784e59a1295d93b8cd8a8d014a2ceba28
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroNx4/CFsrdb:Gvw9816vhKQLroNx4/wQR
TLSH
T1178408835BDA9CF2FA91113109798AB9926B9AC4910EBEDFBF90CD550037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe

Path C:\Windows\{9C7E3A7F-14B1-4565-A56B-7DBE39C741AF}.exe
Size 372KB
SHA256 028c905e7fe50e90dcc6e202a71e4f8204106e18236a0ea01504ab77445c1fa2
MD5 57e1933aeb5fa3aec0b0d0cfb42b48d1
SHA1 173a6a5d7d0ba9cd354f6e98126baee15f7372f1
SHA512 65196b4c4f12da7f1e2069421f4c8636d60a7b8a27252cd7bdaa2c448bcb93da095dbe35fe5b1e9bc91f1e8cfaf1a24e8ff57644a1a531ff566c275c78c861b8
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroQx4/CFsrdb:Gvw9816vhKQLroQx4/wQR
TLSH
T1CB8409835BDA9CF2FB91113009798AB9927B99D4914EBEDFBF90CD150037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BA8EF2F9-02DE-4448-B1B8-E63A88414462}.exe

Path C:\Windows\{BA8EF2F9-02DE-4448-B1B8-E63A88414462}.exe
Size 372KB
SHA256 4981ecafa7953fdbd6d66d1d6afeba25cabe1383fd0b9fc2190fdf773b53a1ed
MD5 5f92611d45a9196e9790132843f0cdae
SHA1 69002435538f12296f7ad02add3cc30db8d088c6
SHA512 d3ac193e0788466784eb0a6b610b58918499f1a7dc5b7e9bba7b46f2f466639e5d7bdb9b9ae61edb004bc3955e119de9d16198d082b102c3348a4e8857795ffe
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroIx4/CFsrdb:Gvw9816vhKQLroIx4/wQR
TLSH
T1668408835BDE9CF2FB91113009798AB9927B9AC4910EBEDFBF90CD150437252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe

Path C:\Windows\{BC4A8194-8F21-4f51-892C-EEA5717E1430}.exe
Size 372KB
SHA256 19a9744dc1b1e66486ec7f3f2c56c2d761298821acd2eacc66e42969a9c06f5e
MD5 0206e0b7b24f40ba8d07964f9e136be7
SHA1 30b71f1307e84cb6a0a4a83add5ca276379af17b
SHA512 6f016c0b4e13a3741a00150e1362f0ee5878365c97428559cac280ab1b7ea0fd5c296c125ebda64617adf6a11535ca14d3f210325771f8f2e1b54b2251bd43b9
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrogx4/CFsrdb:Gvw9816vhKQLrogx4/wQR
TLSH
T1668408835BDE9CF2FB91113009798AB9927B9AD4910EBEDFBF90CD250437252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe

Path C:\Windows\{EE8B1C0E-6CB5-488d-8EC5-39FDE9983F5B}.exe
Size 372KB
SHA256 4ee3843fdf869afe176cc4d72e43a934d55231f9331bc9a42f8da7c359cd1120
MD5 be9152811bb8bd571641e6bba5660d2e
SHA1 3c3ad5eda1eb20b57c25ca489cdc5f192e1010e3
SHA512 78d29e3ee43d17259f9b8682858f6cb6b1e605361161f97004aacb4e5389086eac2756930365429becf9ed0411e36376c686079957dbf1d00fd8dd951e4bf829
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrojWx4/CFsrdb:Gvw9816vhKQLrojWx4/wQR
TLSH
T11A8409835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD550037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads