stormser | 8abe0ed680f82b03812a33593c54c27fc2683fe1cfe3794829e6caccd7ed855e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_f0341b7edd9d1ee735a7bf630b2f3320_elex_wannacry.exe
Size 60KB
Sample260730-ph86xahd34
SHA256 8abe0ed680f82b03812a33593c54c27fc2683fe1cfe3794829e6caccd7ed855e
MD5 f0341b7edd9d1ee735a7bf630b2f3320
SHA1 c0ace962fa48a8dd8354bdd8b66b5155adfcc56a
SHA512 cf13efd9858873d1c58cb19f14c9ad01d7086df8cb822c5c63aa61c20d15c87c226cadcd61dbf9476c0601d94e11d798050831c7d06e89dba1fd91e369eb7f56
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw1Y04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroH4/CFsrd
TLSH
T1485309834BDE9CF2F795127108794AB9927B9AD4910EBE9FBF90CD140037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024435-2.dat	family_stormser
behavioral1/files/0x0007000000024440-6.dat	family_stormser
behavioral1/files/0x0007000000024446-8.dat	family_stormser
behavioral1/files/0x000800000002444a-14.dat	family_stormser
behavioral1/files/0x001000000002429e-18.dat	family_stormser
behavioral1/files/0x00030000000006d1-22.dat	family_stormser
behavioral1/files/0x00030000000006fd-26.dat	family_stormser
behavioral1/files/0x00040000000006d1-31.dat	family_stormser
behavioral1/files/0x00040000000006fd-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}	{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}\stubpath = "C:\\Windows\\{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe"	{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}	{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}	{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16A4A443-577A-4a32-AFF3-884FD2D01020}	{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1A72D1E-AFAC-48db-B708-382480B19D6B}	{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1A72D1E-AFAC-48db-B708-382480B19D6B}\stubpath = "C:\\Windows\\{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe"	{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}\stubpath = "C:\\Windows\\{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe"	{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93C4C6FF-E4E9-4505-B806-7D3CB016EA9B}	{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B1E04B8-FE90-44e1-A86C-868975E96208}	2026-07-30_f0341b7edd9d1ee735a7bf630b2f3320_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}\stubpath = "C:\\Windows\\{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe"	{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}\stubpath = "C:\\Windows\\{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe"	{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}	{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}	{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93C4C6FF-E4E9-4505-B806-7D3CB016EA9B}\stubpath = "C:\\Windows\\{93C4C6FF-E4E9-4505-B806-7D3CB016EA9B}.exe"	{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B1E04B8-FE90-44e1-A86C-868975E96208}\stubpath = "C:\\Windows\\{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe"	2026-07-30_f0341b7edd9d1ee735a7bf630b2f3320_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16A4A443-577A-4a32-AFF3-884FD2D01020}\stubpath = "C:\\Windows\\{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe"	{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}\stubpath = "C:\\Windows\\{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe"	{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe

Executes dropped EXE 9 IoCs

pid	Process
1684	{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe
1756	{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe
220	{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe
1740	{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe
2020	{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe
976	{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe
2556	{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe
1968	{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe
3444	{93C4C6FF-E4E9-4505-B806-7D3CB016EA9B}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe	2026-07-30_f0341b7edd9d1ee735a7bf630b2f3320_elex_wannacry.exe
File created	C:\Windows\{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe	{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe
File created	C:\Windows\{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe	{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe
File created	C:\Windows\{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe	{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe
File created	C:\Windows\{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe	{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe
File created	C:\Windows\{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe	{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe
File created	C:\Windows\{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe	{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe
File created	C:\Windows\{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe	{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe
File created	C:\Windows\{93C4C6FF-E4E9-4505-B806-7D3CB016EA9B}.exe	{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1876	cmd.exe
1744	cmd.exe
3808	cmd.exe
2772	cmd.exe
5000	cmd.exe
4764	cmd.exe
4512	cmd.exe
2692	cmd.exe
1240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_f0341b7edd9d1ee735a7bf630b2f3320_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{93C4C6FF-E4E9-4505-B806-7D3CB016EA9B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4308	2026-07-30_f0341b7edd9d1ee735a7bf630b2f3320_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	1684	{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe
Token: SeIncBasePriorityPrivilege	1756	{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe
Token: SeIncBasePriorityPrivilege	220	{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe
Token: SeIncBasePriorityPrivilege	1740	{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe
Token: SeIncBasePriorityPrivilege	2020	{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe
Token: SeIncBasePriorityPrivilege	976	{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe
Token: SeIncBasePriorityPrivilege	2556	{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe
Token: SeIncBasePriorityPrivilege	1968	{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 1684	4308	2026-07-30_f0341b7edd9d1ee735a7bf630b2f3320_elex_wannacry.exe	93
PID 4308 wrote to memory of 1876	4308	2026-07-30_f0341b7edd9d1ee735a7bf630b2f3320_elex_wannacry.exe	94
PID 1684 wrote to memory of 1756	1684	{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe	98
PID 1684 wrote to memory of 3808	1684	{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe	99
PID 1756 wrote to memory of 220	1756	{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe	103
PID 1756 wrote to memory of 2772	1756	{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe	104
PID 220 wrote to memory of 1740	220	{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe	106
PID 220 wrote to memory of 5000	220	{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe	107
PID 1740 wrote to memory of 2020	1740	{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe	108
PID 1740 wrote to memory of 1744	1740	{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe	109
PID 2020 wrote to memory of 976	2020	{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe	111
PID 2020 wrote to memory of 4764	2020	{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe	112
PID 976 wrote to memory of 2556	976	{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe	113
PID 976 wrote to memory of 4512	976	{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe	114
PID 2556 wrote to memory of 1968	2556	{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe	115
PID 2556 wrote to memory of 2692	2556	{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe	116
PID 1968 wrote to memory of 3444	1968	{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe	117
PID 1968 wrote to memory of 1240	1968	{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-07-30_f0341b7edd9d1ee735a7bf630b2f3320_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_f0341b7edd9d1ee735a7bf630b2f3320_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe
  C:\Windows\{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe
    C:\Windows\{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe
      C:\Windows\{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:220
    - - C:\Windows\{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe
        
        C:\Windows\{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1740
      - C:\Windows\{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe
        
        C:\Windows\{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe
        
        C:\Windows\{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe
        
        C:\Windows\{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe
        
        C:\Windows\{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\{93C4C6FF-E4E9-4505-B806-7D3CB016EA9B}.exe
        
        C:\Windows\{93C4C6FF-E4E9-4505-B806-7D3CB016EA9B}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E88F1~1.EXE > nul
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0DBA~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6F1B~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1A72~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4764
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{16A4A~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1744
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F3231~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5BAE1~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{6B1E0~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe

Path C:\Windows\{16A4A443-577A-4a32-AFF3-884FD2D01020}.exe
Size 60KB
SHA256 9a26c616bbab8eccceb9ec61d4e09a5dcf93b1bdf79dd95d8ee5ecf3ae12ef12
MD5 790164d9ffc93d3f5aea465c642d3550
SHA1 7d5ede0d1b1b4a115cfb9bf0aa7e0f8a15e5a0a6
SHA512 b48433aeee2bd8cb41e5bf913c07813ecd5a9f5bd46d8a84433d2ddcdc90c9bdfcd8689f1a6fd42c82132f8cc8be63882b37ffc762c4178d953c27bd17693d64
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwxY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroD4/CFsrd
TLSH
T1485309834BDE5CF2F791127108794AB9927B9AC4910EBE9FBF90CD540037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe

Path C:\Windows\{5BAE168C-7559-4df0-A72B-AF0EB1DADB91}.exe
Size 60KB
SHA256 c25e810ebc09dc6aba2d46cd55a1de10adf1683d03fe99096fe8e2d223fcacc7
MD5 c513770138687b24988c62ff94c1b604
SHA1 aadf07b959cf8ed80c8f99f576a2579318695d33
SHA512 3994de15732fec6b39daf712b29b88acea3e039ae82a9498571c44486130a04d1023034c5e3a8b34c17795da2bbb5b96dddbfd76a9fdfc94fa485b4b24828ead
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwIaY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLro94/CFsrd
TLSH
T17D5309834BDE9CF2F791127108794AB9927B9AD4910EBE9FBF90CD540037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe

Path C:\Windows\{6B1E04B8-FE90-44e1-A86C-868975E96208}.exe
Size 60KB
SHA256 cb76a4100a4832767f471ef76aeeb267e38ec99da4eb069d5e0af05905202812
MD5 947b1e964d8554b13bd1b1900e635351
SHA1 21c3167ecae0fa1db1de8a19def5a6972916939c
SHA512 f23f25eb4e365472e4a60162fae935ff40842f809107d59d12a0673b64e44190969860ce38fe9046c191b89d3ed7197a23b64ffbabef76369d6faf234a293ca8
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw1Y04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroH4/CFsrd
TLSH
T1D45309835BDE9CF2F791123108794AB9927B9AC4910EBE9FBF90CD540037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{93C4C6FF-E4E9-4505-B806-7D3CB016EA9B}.exe

Path C:\Windows\{93C4C6FF-E4E9-4505-B806-7D3CB016EA9B}.exe
Size 60KB
SHA256 7ff521add218c17984486d9368da96251c10047e8a9e1fbbf23dd9b2dd4fa342
MD5 fd64a0777e4f1e0d37c637d1b01d0ac6
SHA1 7e5cb079ac4621f054557b4973d4cc1cfafc790c
SHA512 6f536dc89cd8f5a73c2c1ab1ec9db6d2226497fc9cc18237f5bd57d83085e65dd95db04e2a8abd851e0f6d64932bb73aa8949e9df7f0d5f44eca9b8ffdccd790
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwqY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroA4/CFsrd
TLSH
T19D5309834BDE9CF2F791127108794AB9927B9AC4910EBE9FBF90CD140037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe

Path C:\Windows\{B1A72D1E-AFAC-48db-B708-382480B19D6B}.exe
Size 60KB
SHA256 4964804e250ff28d0a0dff171a45ce77bfc8002a83cba65da9e2290e4f44d91d
MD5 aec02010ce59b3c24cc4da9bb17131df
SHA1 50ec4ef749ad3e6368471435379b8da80bb01119
SHA512 0d7fc0b63cb1f45cdb16ab8637ca3a8db0e8bf21f22853d4473c55b856c0fd2ae5c9f83e43d2c664dcb90923514571ae8b7ab5ac6664f6282a34f824d6d1834b
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw2Y04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLro84/CFsrd
TLSH
T1EF5309834BDE9CF2F791127118794AB9927B9AC4910EBE9FBF90CD140037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe

Path C:\Windows\{C6F1BA09-4C1D-4dfe-9010-2666D8D8D601}.exe
Size 60KB
SHA256 102cdf242146f281d92f1a9424062567c7712cfe71c5fa41559a276201e80ffa
MD5 ab54f174ecfbfa6e0d704d6ef34fa91d
SHA1 5f8a4c3606ef231316c211cfdd40ae19a42047e9
SHA512 3bf40b83ca06ddcdc1417ecb19d2178d8358a4b56a221623c49a2382288036d5ba2be79cf2403e4515dd258eaba989238a40ec3cd7273a6a97db9192c36d8886
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwCY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLro44/CFsrd
TLSH
T1EA5319834BDE5CF2F791123108794AB9927B9AD4910EBE9FBF90CD140037292E43E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe

Path C:\Windows\{E0DBA5D1-4DA0-4467-AAB0-860679742DE7}.exe
Size 60KB
SHA256 1ee3de42fc4ac5a241a0a16584c6803ae867526d0b3128798284060bae94c136
MD5 39752c2894481c13190456948128d11a
SHA1 9ada4dcde44f964811961d2e1a81e644163c0ae4
SHA512 f2c3cfdc288a414a82b1de177ab30369b5a40151fdd0d52ddd62609ae84211cec82c90fb0e1e1a6af864af9f035e4ed1d5eb307eaa64310bfcdac326270a192a
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwhY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroT4/CFsrd
TLSH
T1D05309834BDE9CF2F791123108794AB9927B9AD4910EBE9FBF90CD140037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe

Path C:\Windows\{E88F19B9-D117-4d8e-8682-DB4E8A4BF6C4}.exe
Size 60KB
SHA256 ff74e2e69a15231bd94edeed0da9dd7ff5055138ea8e7c2aa8477366f5e3b5c6
MD5 dce59ab604115fa66c269d61e5b36312
SHA1 1b24bbf17a1d3d13438dea2d83f66e1f63874049
SHA512 9959ce9f1da403ae18e03e52c8a61ac4073c4af8aa692e989ec026f31f7fb4f2a0ae38777da4daab5fe76a32856d0ca0db60dfbebdb5f94b5e409a49d430fdb4
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwHY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLro54/CFsrd
TLSH
T1D65308834BDE9CF2F791127108794AB9927B9AD4910EBE9FBF90CD140037692E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe

Path C:\Windows\{F3231EFC-47FC-4f39-8C8A-829B1E1AFF1A}.exe
Size 60KB
SHA256 fa3fc17fefd799a93eb1850cc53c9c9840be2686aaa3220e22d7fe9857dbd8b4
MD5 4e297c773a732ad43ffe0694a1405041
SHA1 a194c1dded5b33e5a40d00b5145cf4825ab27ac4
SHA512 47230f2cbfd537614366e799fb911885e4857a532e22a5075babd5ac23db2a84583a0dfda2156a8f07f2c1dbd7c5a9d9d53480dd94a92b99958c2482ee37dc63
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwEY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroy4/CFsrd
TLSH
T1215309834BDE9CF2F791123108794AB9927B9AC4910EBE9FBF90CD544037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads