stormser | 2920efcfbf4c5893a74c9528b8a59a02e128b778ef23c2ffcc5ee3341cb99bf7

General

Target
2026-07-30_04da39fe79052b6eb8a1e091e20b7e64_elex_wannacry.exe
Size 60KB
Sample260730-te2pwacq21
SHA256 2920efcfbf4c5893a74c9528b8a59a02e128b778ef23c2ffcc5ee3341cb99bf7
MD5 04da39fe79052b6eb8a1e091e20b7e64
SHA1 0a184048797460b34e382a4da7e6f734e064fd76
SHA512 9a4c9a2d15a86024aaf4cf5e13b5eae4fe0323f6eae8148f849758aa95c47de6c230374af1234b406387cdac5b314099746c2a5726a57b07acdca62675134767
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLron4/CFsrdHWMZo:vvw9816vhKQLron4/wQpWMZo
TLSH
T138534C830F997CF2F7810175047A8B7992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 6 IoCs

resource	yara_rule
behavioral1/files/0x000800000002420b-2.dat	family_stormser
behavioral1/files/0x000900000001da97-7.dat	family_stormser
behavioral1/files/0x000d00000001e6cd-10.dat	family_stormser
behavioral1/files/0x000300000001e73a-14.dat	family_stormser
behavioral1/files/0x000200000001e742-18.dat	family_stormser
behavioral1/files/0x00030000000006fd-22.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 6 IoCs

resource	yara_rule
behavioral1/files/0x000800000002420b-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000900000001da97-7.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000d00000001e6cd-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000300000001e73a-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000200000001e742-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00030000000006fd-22.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}	{A4C00948-0B84-4073-8E06-0908D0700037}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}\stubpath = "C:\\Windows\\{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe"	{A4C00948-0B84-4073-8E06-0908D0700037}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6975C07-232A-4538-813B-F649C279D699}	{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6975C07-232A-4538-813B-F649C279D699}\stubpath = "C:\\Windows\\{A6975C07-232A-4538-813B-F649C279D699}.exe"	{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}	{A6975C07-232A-4538-813B-F649C279D699}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}\stubpath = "C:\\Windows\\{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe"	{A6975C07-232A-4538-813B-F649C279D699}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A098012-9F8B-47e5-A03B-D51ABB57F645}	{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A098012-9F8B-47e5-A03B-D51ABB57F645}\stubpath = "C:\\Windows\\{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe"	{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BAC4746-2E37-4756-96F4-BA5A3A5B4FD9}	{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BAC4746-2E37-4756-96F4-BA5A3A5B4FD9}\stubpath = "C:\\Windows\\{6BAC4746-2E37-4756-96F4-BA5A3A5B4FD9}.exe"	{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4C00948-0B84-4073-8E06-0908D0700037}	2026-07-30_04da39fe79052b6eb8a1e091e20b7e64_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4C00948-0B84-4073-8E06-0908D0700037}\stubpath = "C:\\Windows\\{A4C00948-0B84-4073-8E06-0908D0700037}.exe"	2026-07-30_04da39fe79052b6eb8a1e091e20b7e64_elex_wannacry.exe

Executes dropped EXE 6 IoCs

pid	Process
3272	{A4C00948-0B84-4073-8E06-0908D0700037}.exe
2700	{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe
2980	{A6975C07-232A-4538-813B-F649C279D699}.exe
2384	{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe
964	{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe
1064	{6BAC4746-2E37-4756-96F4-BA5A3A5B4FD9}.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe	{A6975C07-232A-4538-813B-F649C279D699}.exe
File created	C:\Windows\{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe	{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe
File created	C:\Windows\{6BAC4746-2E37-4756-96F4-BA5A3A5B4FD9}.exe	{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe
File created	C:\Windows\{A4C00948-0B84-4073-8E06-0908D0700037}.exe	2026-07-30_04da39fe79052b6eb8a1e091e20b7e64_elex_wannacry.exe
File created	C:\Windows\{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe	{A4C00948-0B84-4073-8E06-0908D0700037}.exe
File created	C:\Windows\{A6975C07-232A-4538-813B-F649C279D699}.exe	{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4832	cmd.exe
4180	cmd.exe
3416	cmd.exe
1936	cmd.exe
2496	cmd.exe
2272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6BAC4746-2E37-4756-96F4-BA5A3A5B4FD9}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_04da39fe79052b6eb8a1e091e20b7e64_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A4C00948-0B84-4073-8E06-0908D0700037}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A6975C07-232A-4538-813B-F649C279D699}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4732	2026-07-30_04da39fe79052b6eb8a1e091e20b7e64_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3272	{A4C00948-0B84-4073-8E06-0908D0700037}.exe
Token: SeIncBasePriorityPrivilege	2700	{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe
Token: SeIncBasePriorityPrivilege	2980	{A6975C07-232A-4538-813B-F649C279D699}.exe
Token: SeIncBasePriorityPrivilege	2384	{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe
Token: SeIncBasePriorityPrivilege	964	{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 3272	4732	2026-07-30_04da39fe79052b6eb8a1e091e20b7e64_elex_wannacry.exe	89
PID 4732 wrote to memory of 3416	4732	2026-07-30_04da39fe79052b6eb8a1e091e20b7e64_elex_wannacry.exe	90
PID 3272 wrote to memory of 2700	3272	{A4C00948-0B84-4073-8E06-0908D0700037}.exe	101
PID 3272 wrote to memory of 1936	3272	{A4C00948-0B84-4073-8E06-0908D0700037}.exe	102
PID 2700 wrote to memory of 2980	2700	{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe	108
PID 2700 wrote to memory of 2496	2700	{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe	109
PID 2980 wrote to memory of 2384	2980	{A6975C07-232A-4538-813B-F649C279D699}.exe	110
PID 2980 wrote to memory of 2272	2980	{A6975C07-232A-4538-813B-F649C279D699}.exe	111
PID 2384 wrote to memory of 964	2384	{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe	113
PID 2384 wrote to memory of 4832	2384	{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe	114
PID 964 wrote to memory of 1064	964	{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe	115
PID 964 wrote to memory of 4180	964	{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-07-30_04da39fe79052b6eb8a1e091e20b7e64_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_04da39fe79052b6eb8a1e091e20b7e64_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\{A4C00948-0B84-4073-8E06-0908D0700037}.exe
  C:\Windows\{A4C00948-0B84-4073-8E06-0908D0700037}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe
    C:\Windows\{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\{A6975C07-232A-4538-813B-F649C279D699}.exe
      C:\Windows\{A6975C07-232A-4538-813B-F649C279D699}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Windows\{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe
        
        C:\Windows\{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2384
      - C:\Windows\{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe
        
        C:\Windows\{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\{6BAC4746-2E37-4756-96F4-BA5A3A5B4FD9}.exe
        
        C:\Windows\{6BAC4746-2E37-4756-96F4-BA5A3A5B4FD9}.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A098~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4180
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2544A~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A6975~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A0DEE~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A4C00~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe

Path C:\Windows\{2544ABCB-ECEC-42d4-8BCB-2053C91B6125}.exe
Size 60KB
SHA256 fbad8d06ddc9709009aca4337f807add4fee64b0d5baebde2ac6739adf8fb5b3
MD5 c89c71fa61f193fbf638fb7badf4f571
SHA1 7c22b67d90198493d7f79878cdfcaea5c129af4d
SHA512 9cf23a7e408f4309840f13b212c0050b493410a1c86fcfb64fa8c818aa81053da540af1b58efdafe516f4ee4a3271a94a5924a1f59eae91892f88e00d834b5f9
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroo4/CFsrdHWMZo:vvw9816vhKQLroo4/wQpWMZo
TLSH
T1DC533B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6BAC4746-2E37-4756-96F4-BA5A3A5B4FD9}.exe

Path C:\Windows\{6BAC4746-2E37-4756-96F4-BA5A3A5B4FD9}.exe
Size 60KB
SHA256 8572ab9235ffc65700f0176885976a78a6525d75054485a4aa73c1ce943b8a05
MD5 4660fbd2d1486303f2027ff12f4da4b6
SHA1 472ad4d8b59a3dc96e104d60f624bb732f2147e8
SHA512 0af18cfcd5faa3deca3c665fc69cb59f0bc0acfd688431c31a05280ad7a8485df43cc66342e44bcf60f6b7c8afe729963c4058ab59719e0da9340c3cb3b865da
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroR4/CFsrdHWMZo:vvw9816vhKQLroR4/wQpWMZo
TLSH
T150533B830F997CF2F7810175047A8B7992AB59D4D14FFE9BBF90CC194436691E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe

Path C:\Windows\{7A098012-9F8B-47e5-A03B-D51ABB57F645}.exe
Size 60KB
SHA256 4890bfac1894ac61fb35b2d76c272038d7467efb9e0c4fd72f9e0a2f2c4b54d8
MD5 b39a56be160fe07f3b2c81abf40ed0dc
SHA1 79577ba0855bfe49a87201af06c054eea157c531
SHA512 e79beb47139a04a9c97761d73f290e22a0c0f12b691e60de4d59062ce18b81e4dadb79733ca99f0fdd83874c6bf29dd9f0073b1f1e91250098f6749c0ba1f269
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroB4/CFsrdHWMZo:vvw9816vhKQLroB4/wQpWMZo
TLSH
T153534B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe

Path C:\Windows\{A0DEE21A-0CBF-47e8-81D5-F5A564DE9C8E}.exe
Size 60KB
SHA256 12ac213a9204c8edf2db4ecfc800b5a4c39976fe51c06ef8e6582be927f5ba08
MD5 d441630767e35038471b33cc87c8b037
SHA1 9eae5862179e15447e8386c5c9d091c7c790cba2
SHA512 27be673fb79b0ffe35c5e87fe0ec474e2f3fc8d7c246a029187d9af374da0560fc43879e8ce5828ab767e1526b897e3723b2d70573c00e29ccc16fbc48fe3917
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroU4/CFsrdHWMZo:vvw9816vhKQLroU4/wQpWMZo
TLSH
T136534B834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A4C00948-0B84-4073-8E06-0908D0700037}.exe

Path C:\Windows\{A4C00948-0B84-4073-8E06-0908D0700037}.exe
Size 60KB
SHA256 4e93882e76244ab6fbccab6c4851b18bd06f592d2ce943d948f61d733942c53a
MD5 c4fb7beba2d6c7b319c9158f0dc22e26
SHA1 19e2dde63f4aa5ac095bef15222362889b06912a
SHA512 7248b056cd3dd2d689f8341d9ecef295259d7096c70af2fbd5b367709de15ee88685b8fe0ba4cfaa2455df5b0379883325c65cf25ca4707e76248ccd765ab79b
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrov4/CFsrdHWMZo:vvw9816vhKQLrov4/wQpWMZo
TLSH
T126534B830F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A6975C07-232A-4538-813B-F649C279D699}.exe

Path C:\Windows\{A6975C07-232A-4538-813B-F649C279D699}.exe
Size 60KB
SHA256 8bdd96fc7ea401f94069e38d1ae197de017b877b12d50603af9d7f62794a5c50
MD5 4e54134677021362fa3c0aa19032fe14
SHA1 7ffbabf75a329da2cebd03d23b6fd0a7f0bec76a
SHA512 97695e071857aaf899f94d99a4b8fd1725c2f47ad52e2a5ff9728c311e774b9b4975d2253982907c2e73f48bbbc27764b61e949f6505e29c2fc53700a462bae5
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLror4/CFsrdHWMZo:vvw9816vhKQLror4/wQpWMZo
TLSH
T13A534C834F997CF2F7810175043A8B7992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads