stormser | 6374407a091fbe340bbb426a05f78bce6da7941410e49f0801c72b407f37c04b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_e9b2f3e8f26e53df88d641d5b79b228e_elex_wannacry.exe
Size 89KB
Sample260720-rdb2qact6r
SHA256 6374407a091fbe340bbb426a05f78bce6da7941410e49f0801c72b407f37c04b
MD5 e9b2f3e8f26e53df88d641d5b79b228e
SHA1 3d46eb0da1c56975d4ec0b776787d3d829f9b7bf
SHA512 221ff7fc32ad50f5e9e14d0af76ec04b57ff4017c97e9fc45ba72e2aced187d937836e6ab293e1d66147757f921cd3ec7c209a03216c9ef86968d4b5ee6f8357
SSDEEP 768:Qvw9816vhKQLrot4/wQRNrfrunMxVFA3b7glL:YEGh0otl2unMxVS3Hg9
TLSH
T1BC93A33D5DDA103BE277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244e3-3.dat	family_stormser
behavioral1/files/0x000300000001e6dd-6.dat	family_stormser
behavioral1/files/0x00070000000244f8-8.dat	family_stormser
behavioral1/files/0x00080000000244f9-14.dat	family_stormser
behavioral1/files/0x00080000000244f8-18.dat	family_stormser
behavioral1/files/0x00090000000244f9-22.dat	family_stormser
behavioral1/files/0x0003000000000727-27.dat	family_stormser
behavioral1/files/0x00050000000006d1-31.dat	family_stormser
behavioral1/files/0x00030000000006d3-35.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17A22ACB-30D1-429f-84DF-46E21079D7D2}\stubpath = "C:\\Windows\\{17A22ACB-30D1-429f-84DF-46E21079D7D2}.exe"	{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}	2026-07-20_e9b2f3e8f26e53df88d641d5b79b228e_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4376401F-798D-4699-9DB6-C352A95430D3}	{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}\stubpath = "C:\\Windows\\{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe"	{38564B8E-8877-4842-97C1-36A82983C2E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{710F389C-9792-4c61-9DB1-05C3130101AC}	{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17A22ACB-30D1-429f-84DF-46E21079D7D2}	{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}	{710F389C-9792-4c61-9DB1-05C3130101AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4376401F-798D-4699-9DB6-C352A95430D3}\stubpath = "C:\\Windows\\{4376401F-798D-4699-9DB6-C352A95430D3}.exe"	{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38564B8E-8877-4842-97C1-36A82983C2E1}\stubpath = "C:\\Windows\\{38564B8E-8877-4842-97C1-36A82983C2E1}.exe"	{4376401F-798D-4699-9DB6-C352A95430D3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}	{38564B8E-8877-4842-97C1-36A82983C2E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}\stubpath = "C:\\Windows\\{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe"	{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}	{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}\stubpath = "C:\\Windows\\{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe"	{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}\stubpath = "C:\\Windows\\{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe"	{710F389C-9792-4c61-9DB1-05C3130101AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}\stubpath = "C:\\Windows\\{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe"	2026-07-20_e9b2f3e8f26e53df88d641d5b79b228e_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38564B8E-8877-4842-97C1-36A82983C2E1}	{4376401F-798D-4699-9DB6-C352A95430D3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}	{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{710F389C-9792-4c61-9DB1-05C3130101AC}\stubpath = "C:\\Windows\\{710F389C-9792-4c61-9DB1-05C3130101AC}.exe"	{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe

Executes dropped EXE 9 IoCs

pid	Process
2280	{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe
4708	{4376401F-798D-4699-9DB6-C352A95430D3}.exe
4284	{38564B8E-8877-4842-97C1-36A82983C2E1}.exe
1168	{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe
3592	{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe
3852	{710F389C-9792-4c61-9DB1-05C3130101AC}.exe
632	{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe
3284	{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe
904	{17A22ACB-30D1-429f-84DF-46E21079D7D2}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe	2026-07-20_e9b2f3e8f26e53df88d641d5b79b228e_elex_wannacry.exe
File created	C:\Windows\{38564B8E-8877-4842-97C1-36A82983C2E1}.exe	{4376401F-798D-4699-9DB6-C352A95430D3}.exe
File created	C:\Windows\{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe	{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe
File created	C:\Windows\{710F389C-9792-4c61-9DB1-05C3130101AC}.exe	{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe
File created	C:\Windows\{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe	{710F389C-9792-4c61-9DB1-05C3130101AC}.exe
File created	C:\Windows\{17A22ACB-30D1-429f-84DF-46E21079D7D2}.exe	{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe
File created	C:\Windows\{4376401F-798D-4699-9DB6-C352A95430D3}.exe	{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe
File created	C:\Windows\{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe	{38564B8E-8877-4842-97C1-36A82983C2E1}.exe
File created	C:\Windows\{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe	{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4808	cmd.exe
3988	cmd.exe
1300	cmd.exe
4816	cmd.exe
4388	cmd.exe
4132	cmd.exe
996	cmd.exe
3056	cmd.exe
4840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{17A22ACB-30D1-429f-84DF-46E21079D7D2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_e9b2f3e8f26e53df88d641d5b79b228e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4376401F-798D-4699-9DB6-C352A95430D3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{38564B8E-8877-4842-97C1-36A82983C2E1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{710F389C-9792-4c61-9DB1-05C3130101AC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1708	2026-07-20_e9b2f3e8f26e53df88d641d5b79b228e_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2280	{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe
Token: SeIncBasePriorityPrivilege	4708	{4376401F-798D-4699-9DB6-C352A95430D3}.exe
Token: SeIncBasePriorityPrivilege	4284	{38564B8E-8877-4842-97C1-36A82983C2E1}.exe
Token: SeIncBasePriorityPrivilege	1168	{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe
Token: SeIncBasePriorityPrivilege	3592	{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe
Token: SeIncBasePriorityPrivilege	3852	{710F389C-9792-4c61-9DB1-05C3130101AC}.exe
Token: SeIncBasePriorityPrivilege	632	{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe
Token: SeIncBasePriorityPrivilege	3284	{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2280	1708	2026-07-20_e9b2f3e8f26e53df88d641d5b79b228e_elex_wannacry.exe	86
PID 1708 wrote to memory of 3056	1708	2026-07-20_e9b2f3e8f26e53df88d641d5b79b228e_elex_wannacry.exe	87
PID 2280 wrote to memory of 4708	2280	{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe	88
PID 2280 wrote to memory of 4840	2280	{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe	89
PID 4708 wrote to memory of 4284	4708	{4376401F-798D-4699-9DB6-C352A95430D3}.exe	98
PID 4708 wrote to memory of 4808	4708	{4376401F-798D-4699-9DB6-C352A95430D3}.exe	99
PID 4284 wrote to memory of 1168	4284	{38564B8E-8877-4842-97C1-36A82983C2E1}.exe	101
PID 4284 wrote to memory of 3988	4284	{38564B8E-8877-4842-97C1-36A82983C2E1}.exe	102
PID 1168 wrote to memory of 3592	1168	{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe	103
PID 1168 wrote to memory of 4132	1168	{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe	104
PID 3592 wrote to memory of 3852	3592	{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe	105
PID 3592 wrote to memory of 996	3592	{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe	106
PID 3852 wrote to memory of 632	3852	{710F389C-9792-4c61-9DB1-05C3130101AC}.exe	107
PID 3852 wrote to memory of 1300	3852	{710F389C-9792-4c61-9DB1-05C3130101AC}.exe	108
PID 632 wrote to memory of 3284	632	{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe	109
PID 632 wrote to memory of 4816	632	{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe	110
PID 3284 wrote to memory of 904	3284	{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe	111
PID 3284 wrote to memory of 4388	3284	{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-20_e9b2f3e8f26e53df88d641d5b79b228e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_e9b2f3e8f26e53df88d641d5b79b228e_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe
  C:\Windows\{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\{4376401F-798D-4699-9DB6-C352A95430D3}.exe
    C:\Windows\{4376401F-798D-4699-9DB6-C352A95430D3}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\{38564B8E-8877-4842-97C1-36A82983C2E1}.exe
      C:\Windows\{38564B8E-8877-4842-97C1-36A82983C2E1}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe
        
        C:\Windows\{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1168
      - C:\Windows\{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe
        
        C:\Windows\{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\{710F389C-9792-4c61-9DB1-05C3130101AC}.exe
        
        C:\Windows\{710F389C-9792-4c61-9DB1-05C3130101AC}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe
        
        C:\Windows\{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:632
        
        C:\Windows\{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe
        
        C:\Windows\{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\{17A22ACB-30D1-429f-84DF-46E21079D7D2}.exe
        
        C:\Windows\{17A22ACB-30D1-429f-84DF-46E21079D7D2}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A00C5~1.EXE > nul
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D0FD5~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{710F3~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DF899~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:996
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D4F29~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4132
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{38564~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{43764~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{36FDA~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{17A22ACB-30D1-429f-84DF-46E21079D7D2}.exe

Path C:\Windows\{17A22ACB-30D1-429f-84DF-46E21079D7D2}.exe
Size 89KB
SHA256 7f93d0786ee2b4498f92a73b9bde5b7acb60553432417c9186d5069f80c8f96e
MD5 2b7fe182768b3a8f5af6157f9e11c536
SHA1 af75b4e4b75eb5e459274ce3fbeea98354e66585
SHA512 8f71e882d2ad66ab06ecc8e69eb3409060da2aeebcee20108ca6407ba9428aaf55ecf5b5f3c1e11bb281127cf276f1e4e2fc2cdb844876e9a84c487b93e3c116
SSDEEP 768:Qvw9816vhKQLro34/wQRNrfrunMxVFA3b7glL:YEGh0o3l2unMxVS3Hg9
TLSH
T1C393A33D5DDA103BE277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe

Path C:\Windows\{36FDA470-86C7-4d4a-8722-CCAC833BD5C1}.exe
Size 89KB
SHA256 57fd72c1b671678fe3a59e861d4ebef4e9942cd16cbb54b3e87da80f94f9b6f4
MD5 df75df9cddd6a44e608ff048b8947e21
SHA1 22ca12aa2ed3992db76af760ec9f96fb89c2fbb0
SHA512 87be5a67be7f3c9fdeae33b62d0e37174dd03a8b282239f96c25ab4eff04b1082efef68549e0ac722e93fd8032e8a1f489456418b93420aee18162fa66ba0a44
SSDEEP 768:Qvw9816vhKQLroG4/wQRNrfrunMxVFA3b7glL:YEGh0oGl2unMxVS3Hg9
TLSH
T13193A33D5DDA103BE277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{38564B8E-8877-4842-97C1-36A82983C2E1}.exe

Path C:\Windows\{38564B8E-8877-4842-97C1-36A82983C2E1}.exe
Size 89KB
SHA256 f209913ba94e8d67ba704705c33ff8e8d6c59409acf379434970405349bf96d2
MD5 cbb518c41fadc7ef2cafe6ac37baf953
SHA1 7f9f6d01b5b0410d03e5cd3d4e9e56107052919f
SHA512 301d490520fa540d341a4aa0904fb68d2d1a49e67ee7cbfc587df97474005eadf2f7b62a41f330e0b07218981442ecf365b6bfd7e477644964e1438ec5c372c3
SSDEEP 768:Qvw9816vhKQLroU4/wQRNrfrunMxVFA3b7glL:YEGh0oUl2unMxVS3Hg9
TLSH
T13893A33D5DDA103BE277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4376401F-798D-4699-9DB6-C352A95430D3}.exe

Path C:\Windows\{4376401F-798D-4699-9DB6-C352A95430D3}.exe
Size 89KB
SHA256 59c8026e90d03e52a36ad0a84f62babbae93ec36694aed583808a440ce8b47e2
MD5 f3c5204798f6580aa312c366e52757c2
SHA1 b422270f1c152d0f66f8b0f7716e70d10bfa5373
SHA512 6c923e151c040c39266e16ff7c6e03b74d212f6f6fb8c01e50bb5f707208de79262024ac0a9cd098fd8266aae21680aa37fc2d4e650233e3cb4e15d9c2986461
SSDEEP 768:Qvw9816vhKQLro64/wQRNrfrunMxVFA3b7glL:YEGh0o6l2unMxVS3Hg9
TLSH
T1D393A33D5DDA103BE277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{710F389C-9792-4c61-9DB1-05C3130101AC}.exe

Path C:\Windows\{710F389C-9792-4c61-9DB1-05C3130101AC}.exe
Size 89KB
SHA256 da1d7b0886b5b84ca64af1b12fec3b626576e526c4e64c2414edaa1721cc974f
MD5 e95f00d4baf65f088431fcfcd5e42bdc
SHA1 a1e35b960f5a471e604739f9072a750c6c2d8465
SHA512 d60c1f0af9cf19adf504ac33884940fab9345f900c63ffa04aff9f63e6485233cc143d2380212ec33693679797673548ba73aa30f04e945b9aa5099735d5f91a
SSDEEP 768:Qvw9816vhKQLroV4/wQRNrfrunMxVFA3b7glL:YEGh0oVl2unMxVS3Hg9
TLSH
T16993B33D5DDA103BE277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe

Path C:\Windows\{A00C55B5-80C8-4c9c-AEAA-29ECCBE1F96F}.exe
Size 89KB
SHA256 9070335e0b4b28bc9b31b06bccec68b380ec11c12446074f51d4303518291c63
MD5 6d23435374347339815bd9d5e2c16649
SHA1 a2562a59d77a8b355a18cdd44955ff6c5697d588
SHA512 5b5caf76a4186193ebc687070c26163c56bea819e945add9b6c1f88dd92c009060e707f1993d0a264c8fcb898f41e0fc1aae4b3058affec9be69bada108d550e
SSDEEP 768:Qvw9816vhKQLroq4/wQRNrfrunMxVFA3b7glL:YEGh0oql2unMxVS3Hg9
TLSH
T1F993A33D5DDA103BE277D6B585F126E3FE66B983360A1D0E469343428D23B53AD86C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe

Path C:\Windows\{D0FD5AD8-7D07-4d87-96C4-808EB897DE5F}.exe
Size 89KB
SHA256 d2f55a00e8142d5777ef90cbd253e5f3ccacdb7e08e93ea18a9c9687fd0b9a46
MD5 533333e0b12bb1522c2a9974d3902fe0
SHA1 472539f4865131699dd9ca8a1a478599fce28cca
SHA512 b24d64be033ec4ae7c4612c5ba8c4b16ae4d27d488ddca2153cbf66af43e972db6751ad7e70a3b72c3651ec20a541ecb16a0c42226250769d0474a1a3e6668f0
SSDEEP 768:Qvw9816vhKQLroM4/wQRNrfrunMxVFA3b7glL:YEGh0oMl2unMxVS3Hg9
TLSH
T18493A33D5DDA103BE277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe

Path C:\Windows\{D4F29FFE-0FC7-4837-8B75-D4FDD3A20665}.exe
Size 89KB
SHA256 c0c161c6512a8b2fda3c1fe9f2c2f6777f1025d04955491aa01c0dcb5534cb73
MD5 adc61b85960d3d2b26d4813fc455be0b
SHA1 19b20941a45c7950a0895b657ec8c9129afbd6c9
SHA512 5d08e5d8aa946339a316220bb04f0f71d6aec4c78fc0d10c09c0de3a7daaca17abab553150bddb1638223f9f05a80e9ac879f91176a039d1949716cac903ab80
SSDEEP 768:Qvw9816vhKQLro14/wQRNrfrunMxVFA3b7glL:YEGh0o1l2unMxVS3Hg9
TLSH
T13893A33D5DDA103BE277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe

Path C:\Windows\{DF8997EA-FBDF-4d0c-98FF-A13339AE4DB4}.exe
Size 89KB
SHA256 51bbb8f4f52cb3b31f0b826fcc69e4840f9b1c052b6b530f0ee007f541fc7b98
MD5 e1ee4e850a08f241885552030e905606
SHA1 0cd63e4dbbf1e9db1556953d576377c019db67c5
SHA512 3339658c7a0c3cd3e58dc8c692437af3bd74047d1590009d0b8b1fca5e3dd9e5781ec55a8fb1d4c1a6d7d517012e6b60a6a5ffc942be2014f111dd5453d7abf2
SSDEEP 768:Qvw9816vhKQLro34/wQRNrfrunMxVFA3b7glL:YEGh0o3l2unMxVS3Hg9
TLSH
T1DA93B33D5DDA103BE277D6B585F126E3FE66B983350A1D0E469343428D23B53AD86C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads