stormser | 6b71964648da0605b280ea8a30a74380772f421bff9e1199423778965106ad8f

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe
Size 59KB
Sample260713-e227lady5s
SHA256 6b71964648da0605b280ea8a30a74380772f421bff9e1199423778965106ad8f
MD5 6b0a872f8b83bb653fe89ee4162ecc84
SHA1 ad6c0aa6e7bf3b0aaa9c65fc729ab57656cc29c6
SHA512 a399ba27ca5ceffe18d31c44e3fd7a747b355e0f391702aac0565b17b2987bf330dd12f44244849f4f0b0abafabd38f2a2bc8f47f882f022f19037bc3ce522c6
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwz5cY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroNq4/CFsrd
TLSH
T1184308834BEE9CF2F791117108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024659-2.dat	family_stormser
behavioral1/files/0x0002000000022bd2-6.dat	family_stormser
behavioral1/files/0x000800000002465c-10.dat	family_stormser
behavioral1/files/0x0007000000024660-14.dat	family_stormser
behavioral1/files/0x000700000002466b-18.dat	family_stormser
behavioral1/files/0x001000000002466d-22.dat	family_stormser
behavioral1/files/0x00050000000006d3-26.dat	family_stormser
behavioral1/files/0x00030000000006d5-31.dat	family_stormser
behavioral1/files/0x00060000000006d3-35.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2755F31-864E-4171-B260-9B9B4A0285C3}	{692CD037-9430-4920-B858-8503FCD890CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2755F31-864E-4171-B260-9B9B4A0285C3}\stubpath = "C:\\Windows\\{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe"	{692CD037-9430-4920-B858-8503FCD890CF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}	{792FA1DC-AF54-4937-9F93-996EA5958403}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}\stubpath = "C:\\Windows\\{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe"	{792FA1DC-AF54-4937-9F93-996EA5958403}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7D46299-E7C8-4d14-B7B1-098196D55308}	{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85874DCF-81EB-41cc-9106-391BAECE5F5C}	{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{692CD037-9430-4920-B858-8503FCD890CF}\stubpath = "C:\\Windows\\{692CD037-9430-4920-B858-8503FCD890CF}.exe"	{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7D46299-E7C8-4d14-B7B1-098196D55308}\stubpath = "C:\\Windows\\{F7D46299-E7C8-4d14-B7B1-098196D55308}.exe"	{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}	2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}	{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{792FA1DC-AF54-4937-9F93-996EA5958403}	{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}\stubpath = "C:\\Windows\\{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe"	2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85874DCF-81EB-41cc-9106-391BAECE5F5C}\stubpath = "C:\\Windows\\{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe"	{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BFDC527-80EE-4adb-833D-06BA938547D4}	{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BFDC527-80EE-4adb-833D-06BA938547D4}\stubpath = "C:\\Windows\\{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe"	{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{792FA1DC-AF54-4937-9F93-996EA5958403}\stubpath = "C:\\Windows\\{792FA1DC-AF54-4937-9F93-996EA5958403}.exe"	{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}\stubpath = "C:\\Windows\\{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe"	{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{692CD037-9430-4920-B858-8503FCD890CF}	{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe

Executes dropped EXE 9 IoCs

pid	Process
5912	{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe
1472	{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe
1636	{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe
2360	{692CD037-9430-4920-B858-8503FCD890CF}.exe
2068	{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe
5772	{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe
3524	{792FA1DC-AF54-4937-9F93-996EA5958403}.exe
3608	{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe
224	{F7D46299-E7C8-4d14-B7B1-098196D55308}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe	2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe
File created	C:\Windows\{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe	{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe
File created	C:\Windows\{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe	{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe
File created	C:\Windows\{692CD037-9430-4920-B858-8503FCD890CF}.exe	{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe
File created	C:\Windows\{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe	{692CD037-9430-4920-B858-8503FCD890CF}.exe
File created	C:\Windows\{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe	{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe
File created	C:\Windows\{792FA1DC-AF54-4937-9F93-996EA5958403}.exe	{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe
File created	C:\Windows\{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe	{792FA1DC-AF54-4937-9F93-996EA5958403}.exe
File created	C:\Windows\{F7D46299-E7C8-4d14-B7B1-098196D55308}.exe	{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{792FA1DC-AF54-4937-9F93-996EA5958403}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{692CD037-9430-4920-B858-8503FCD890CF}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F7D46299-E7C8-4d14-B7B1-098196D55308}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4776	2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	5912	{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe
Token: SeIncBasePriorityPrivilege	1472	{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe
Token: SeIncBasePriorityPrivilege	1636	{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe
Token: SeIncBasePriorityPrivilege	2360	{692CD037-9430-4920-B858-8503FCD890CF}.exe
Token: SeIncBasePriorityPrivilege	2068	{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe
Token: SeIncBasePriorityPrivilege	5772	{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe
Token: SeIncBasePriorityPrivilege	3524	{792FA1DC-AF54-4937-9F93-996EA5958403}.exe
Token: SeIncBasePriorityPrivilege	3608	{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 5912	4776	2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe	89
PID 4776 wrote to memory of 1580	4776	2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe	90
PID 5912 wrote to memory of 1472	5912	{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe	91
PID 5912 wrote to memory of 5904	5912	{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe	92
PID 1472 wrote to memory of 1636	1472	{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe	96
PID 1472 wrote to memory of 5968	1472	{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe	97
PID 1636 wrote to memory of 2360	1636	{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe	104
PID 1636 wrote to memory of 552	1636	{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe	105
PID 2360 wrote to memory of 2068	2360	{692CD037-9430-4920-B858-8503FCD890CF}.exe	109
PID 2360 wrote to memory of 452	2360	{692CD037-9430-4920-B858-8503FCD890CF}.exe	110
PID 2068 wrote to memory of 5772	2068	{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe	112
PID 2068 wrote to memory of 5856	2068	{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe	113
PID 5772 wrote to memory of 3524	5772	{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe	114
PID 5772 wrote to memory of 2104	5772	{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe	115
PID 3524 wrote to memory of 3608	3524	{792FA1DC-AF54-4937-9F93-996EA5958403}.exe	116
PID 3524 wrote to memory of 5636	3524	{792FA1DC-AF54-4937-9F93-996EA5958403}.exe	117
PID 3608 wrote to memory of 224	3608	{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe	118
PID 3608 wrote to memory of 2240	3608	{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe
  C:\Windows\{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe
    C:\Windows\{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Windows\{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe
      C:\Windows\{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Windows\{692CD037-9430-4920-B858-8503FCD890CF}.exe
        
        C:\Windows\{692CD037-9430-4920-B858-8503FCD890CF}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2360
      - C:\Windows\{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe
        
        C:\Windows\{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe
        
        C:\Windows\{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5772
        
        C:\Windows\{792FA1DC-AF54-4937-9F93-996EA5958403}.exe
        
        C:\Windows\{792FA1DC-AF54-4937-9F93-996EA5958403}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe
        
        C:\Windows\{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\{F7D46299-E7C8-4d14-B7B1-098196D55308}.exe
        
        C:\Windows\{F7D46299-E7C8-4d14-B7B1-098196D55308}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F4DE0~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{792FA~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3BFDC~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A2755~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{692CD~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:452
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3CD5C~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:552
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{85874~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:5968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F5EF6~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe

Path C:\Windows\{3BFDC527-80EE-4adb-833D-06BA938547D4}.exe
Size 59KB
SHA256 a3d4d5b95d8546bb45bd28d2bf44305a72a15099763d435d25a73e785149650a
MD5 97ca42585065176d945ed094dd5abadb
SHA1 a98cd6014726f5944f26b6f6d16ec8762eeaf91d
SHA512 3ba8551f187cb61f5688e1a2fe22a70bb1c31f4b5bb42a14272b8d989451850d9e182238e3837402717cdd645522a3f9531fd3627077e7a5a18b500bace0a005
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwIY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroW4/CFsrd
TLSH
T1CB4308834BEE9CF2F791113108798AB9927B99D4910EBEDFBF90CD550037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe

Path C:\Windows\{3CD5C954-216C-475b-A085-8F3F4F8AC2E8}.exe
Size 59KB
SHA256 ab1f8328137abfbfb4ff872c8421aa138e3277d90a459c460ea40381d7128766
MD5 5d9487b27776ec691335607b5cf35696
SHA1 68101b1aa0e99c62e786e6b37180c085352aef7a
SHA512 b353843d439667005e951ac45014d167817f455342420c2e88b540bf7e0d0392349cea41877e59d68d3f98faf93cbb6f1d4e8ae7e25e27dc108231553aad1cea
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwEY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroy4/CFsrd
TLSH
T1A74308834BEE5CF2F791113108794AB9927B99D4910EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{692CD037-9430-4920-B858-8503FCD890CF}.exe

Path C:\Windows\{692CD037-9430-4920-B858-8503FCD890CF}.exe
Size 59KB
SHA256 f20c0f8fc1006f96b532facb687750fae026d7a507e01d1fcdbb091f39b8f446
MD5 8b3bf1ce5c6a93ee860162e3f40606b4
SHA1 abf86fa6765a3db53c6e7eabe0a51ab36bf9f5e8
SHA512 1ad545959669939f41e1daa070e494faa087ffb3425085183f58101822ba01aa12929e0ae7d5e3e696b3294ad462dfd0b1a3c3866a8da32880e1ec40967ed960
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwZY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLror4/CFsrd
TLSH
T1EC43F7834BEE9CF2F791113108798AB9927B99D4950EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{792FA1DC-AF54-4937-9F93-996EA5958403}.exe

Path C:\Windows\{792FA1DC-AF54-4937-9F93-996EA5958403}.exe
Size 59KB
SHA256 e160fdedf7dcc54f58b2dc81e397914f3500e6fc99c9a8762c43ce0cad0a1e9e
MD5 338124ba659798b70c75a8b317abf62c
SHA1 ac57194be0299b01dff69805c0e4a5e74cfd5753
SHA512 bd7c0ba5aa195b07eda0e2f2a020dcacf31c3bb5caf453bbceba01f02d7a7d8c219b564e969d65f32d94864e4120c882bb0ad6a6232d34895b9a0b4464e16c81
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw+YY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLro34/CFsrd
TLSH
T1F04308834BEE9CF2F791117108798AB9927B99D4910EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe

Path C:\Windows\{85874DCF-81EB-41cc-9106-391BAECE5F5C}.exe
Size 59KB
SHA256 d62137a226aec2efbad98f572adefbf1443584303cb47027b5d27c5ade1bc59b
MD5 117cc68844077de6f9ee9cfa9bdad6e1
SHA1 730f7c6c1904365298fac4c05ff294c8c0990ae7
SHA512 3caa14c90dcf07530ac6bd1eb3bdf5e1dc8334114e82b3cfe275bcee074f9ff0d4c2c3afac6d19de20954ddc9cd756743b6ea34493847ca862f5ec7a9e0a278d
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw4Y04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLrom4/CFsrd
TLSH
T1244307834BEE9CF2F7911171087D8AB9927B99D4910EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe

Path C:\Windows\{A2755F31-864E-4171-B260-9B9B4A0285C3}.exe
Size 59KB
SHA256 fa7cafaa6e641484d83ba8093f15f5d2bdf505973e6c4962552099cf74793f64
MD5 f5c81effc5919759b83536354b4933f2
SHA1 842dc9869b8a8c69dc7ad69712199bc9088161a0
SHA512 6d7f3da1a2efe1c49f5e59d498579f6eff5d59457781bffdd4d447ce9a7ac26c11144dc60335bc36fd794a5d11b0fe34f9eea98cbf4b9249f0cc8b3d7e983fa1
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwCY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLro44/CFsrd
TLSH
T13E4308834BEE9CF2F791113108798AB9927B99D4910EBEDFBF90CD150037292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe

Path C:\Windows\{F4DE09E0-3F72-422e-A8AC-5B63E31ACDE3}.exe
Size 59KB
SHA256 75ba418a40e5429a20b8a609656c46c951fd04d6de8fa0ea253f1c04b2cdc014
MD5 7d8d342bcad58f07912c29402017e5e7
SHA1 94a1b965278f6ed09e14d41c0a9082a8f90c4112
SHA512 dac0323c1a2062a6424276c7ce44e0f57660de95be9f9fb5ee4def7bc9403d1722a58d43ab4328699fbd58d4b236a1fe91ab11b1bc523b6fc6f10bc77a8b70a7
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwCY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLro44/CFsrd
TLSH
T1CE43F7834BEE9CF2F791117108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe

Path C:\Windows\{F5EF6852-AC7E-4a91-9DF7-DB2BCF378A83}.exe
Size 59KB
SHA256 ababf4a88ae098298500d5c2ff6cfd0a2731c35569006bc89884af2d7063c6e2
MD5 e3dbf4c6efbf5f92099d30f2ffd54a54
SHA1 08283d35ddc4bc6eb26b3901daa92ce848ad037a
SHA512 ff722d4aeb2f4769c201fed7b711732b1fba49d47eba0f8abef2d46168ef5bf0c29a06e77c3823c0e46b679a6e890c469a761eaf6e4eae3fceb4a7f11e1f608f
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwGaY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroGQ4/CFsrd
TLSH
T18943F9834BEE9CF2F791117108794AB9927B99D4950EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F7D46299-E7C8-4d14-B7B1-098196D55308}.exe

Path C:\Windows\{F7D46299-E7C8-4d14-B7B1-098196D55308}.exe
Size 59KB
SHA256 8c6cb5e286696d17db947fe757ceb37947d852187af79183b45e55075928cb90
MD5 6a7151c50e41892db3dd582874a9187c
SHA1 1ff4622f5b5c7f53b129ba8c61c4cc3faceb8270
SHA512 cb1026b078d4f9b8b0d7cde11a5732fb3a3a3dc5e491202c309ea086b59eb2cff7dfb46e769d267b34c7005cc7a7d4660b57a248fbd4b41438e26b87077f1b9f
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwJY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLro74/CFsrd
TLSH
T1FF43F7834BEE9CF2F7911171087D8AB9927B99D4950EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads