stormser | db8f477368540347acfdd28fd7207caef22a7590e1c982af1a86a90d765eb5f0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_2603b4e9ea90e9e6a3150e878613c66c_elex_wannacry.exe
Size 59KB
Sample260731-pff3caseke
SHA256 db8f477368540347acfdd28fd7207caef22a7590e1c982af1a86a90d765eb5f0
MD5 2603b4e9ea90e9e6a3150e878613c66c
SHA1 58e8dc2ce5b1a7fa67bd83115f68142b26e1d246
SHA512 47683628fb7157083dbfcbca8cca840de8a70d88b28dec0cc7969dc016e3c9783494cbb381de57e2ab15be051a6fbec50f55803adf7906a7a2c352bb5fad5799
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwFY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLro34/CFsrd
TLSH
T1164308834BDE9CF2F791127108794AB9927B9AC4910EBE9FBF90CD550037292E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral1/files/0x000700000001d8b2-2.dat	family_stormser
behavioral1/files/0x001700000001db63-6.dat	family_stormser
behavioral1/files/0x000800000001db41-8.dat	family_stormser
behavioral1/files/0x001500000001db5e-14.dat	family_stormser
behavioral1/files/0x000c00000001e6a1-18.dat	family_stormser
behavioral1/files/0x000500000000072f-23.dat	family_stormser
behavioral1/files/0x0004000000000733-26.dat	family_stormser
behavioral1/files/0x000300000000073d-30.dat	family_stormser
behavioral1/files/0x000500000000073b-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E5A2101-C393-4dad-988C-44BF8E7B0AED}	2026-07-31_2603b4e9ea90e9e6a3150e878613c66c_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E5A2101-C393-4dad-988C-44BF8E7B0AED}\stubpath = "C:\\Windows\\{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe"	2026-07-31_2603b4e9ea90e9e6a3150e878613c66c_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}\stubpath = "C:\\Windows\\{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe"	{52496927-01CA-4943-8A1A-1B9404B202A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAA499C0-5DED-4e5e-86BC-B81269F46A08}	{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAA499C0-5DED-4e5e-86BC-B81269F46A08}\stubpath = "C:\\Windows\\{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe"	{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28D8B867-33C5-4775-8D3C-42646A6AC199}\stubpath = "C:\\Windows\\{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe"	{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}	{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}\stubpath = "C:\\Windows\\{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe"	{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B67AF3A0-4927-4d7d-BE7A-F8DD9028C8D8}\stubpath = "C:\\Windows\\{B67AF3A0-4927-4d7d-BE7A-F8DD9028C8D8}.exe"	{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52496927-01CA-4943-8A1A-1B9404B202A0}\stubpath = "C:\\Windows\\{52496927-01CA-4943-8A1A-1B9404B202A0}.exe"	{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}	{52496927-01CA-4943-8A1A-1B9404B202A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28D8B867-33C5-4775-8D3C-42646A6AC199}	{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}	{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}\stubpath = "C:\\Windows\\{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe"	{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}\stubpath = "C:\\Windows\\{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe"	{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52496927-01CA-4943-8A1A-1B9404B202A0}	{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}	{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B67AF3A0-4927-4d7d-BE7A-F8DD9028C8D8}	{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe

Executes dropped EXE 9 IoCs

pid	Process
4748	{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe
4352	{52496927-01CA-4943-8A1A-1B9404B202A0}.exe
1032	{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe
2592	{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe
3156	{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe
1936	{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe
1732	{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe
5024	{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe
4756	{B67AF3A0-4927-4d7d-BE7A-F8DD9028C8D8}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe	{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe
File created	C:\Windows\{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe	{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe
File created	C:\Windows\{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe	{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe
File created	C:\Windows\{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe	{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe
File created	C:\Windows\{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe	{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe
File created	C:\Windows\{B67AF3A0-4927-4d7d-BE7A-F8DD9028C8D8}.exe	{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe
File created	C:\Windows\{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe	2026-07-31_2603b4e9ea90e9e6a3150e878613c66c_elex_wannacry.exe
File created	C:\Windows\{52496927-01CA-4943-8A1A-1B9404B202A0}.exe	{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe
File created	C:\Windows\{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe	{52496927-01CA-4943-8A1A-1B9404B202A0}.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2872	cmd.exe
1240	cmd.exe
4420	cmd.exe
4732	cmd.exe
1220	cmd.exe
3360	cmd.exe
820	cmd.exe
4608	cmd.exe
1704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B67AF3A0-4927-4d7d-BE7A-F8DD9028C8D8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{52496927-01CA-4943-8A1A-1B9404B202A0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_2603b4e9ea90e9e6a3150e878613c66c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4924	2026-07-31_2603b4e9ea90e9e6a3150e878613c66c_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4748	{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe
Token: SeIncBasePriorityPrivilege	4352	{52496927-01CA-4943-8A1A-1B9404B202A0}.exe
Token: SeIncBasePriorityPrivilege	1032	{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe
Token: SeIncBasePriorityPrivilege	2592	{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe
Token: SeIncBasePriorityPrivilege	3156	{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe
Token: SeIncBasePriorityPrivilege	1936	{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe
Token: SeIncBasePriorityPrivilege	1732	{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe
Token: SeIncBasePriorityPrivilege	5024	{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4748	4924	2026-07-31_2603b4e9ea90e9e6a3150e878613c66c_elex_wannacry.exe	96
PID 4924 wrote to memory of 2872	4924	2026-07-31_2603b4e9ea90e9e6a3150e878613c66c_elex_wannacry.exe	97
PID 4748 wrote to memory of 4352	4748	{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe	100
PID 4748 wrote to memory of 3360	4748	{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe	101
PID 4352 wrote to memory of 1032	4352	{52496927-01CA-4943-8A1A-1B9404B202A0}.exe	106
PID 4352 wrote to memory of 820	4352	{52496927-01CA-4943-8A1A-1B9404B202A0}.exe	107
PID 1032 wrote to memory of 2592	1032	{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe	108
PID 1032 wrote to memory of 1240	1032	{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe	109
PID 2592 wrote to memory of 3156	2592	{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe	111
PID 2592 wrote to memory of 4420	2592	{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe	112
PID 3156 wrote to memory of 1936	3156	{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe	113
PID 3156 wrote to memory of 4732	3156	{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe	114
PID 1936 wrote to memory of 1732	1936	{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe	115
PID 1936 wrote to memory of 1220	1936	{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe	116
PID 1732 wrote to memory of 5024	1732	{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe	117
PID 1732 wrote to memory of 4608	1732	{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe	118
PID 5024 wrote to memory of 4756	5024	{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe	125
PID 5024 wrote to memory of 1704	5024	{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-07-31_2603b4e9ea90e9e6a3150e878613c66c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2603b4e9ea90e9e6a3150e878613c66c_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe
  C:\Windows\{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\{52496927-01CA-4943-8A1A-1B9404B202A0}.exe
    C:\Windows\{52496927-01CA-4943-8A1A-1B9404B202A0}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe
      C:\Windows\{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1032
    - - C:\Windows\{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe
        
        C:\Windows\{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2592
      - C:\Windows\{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe
        
        C:\Windows\{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe
        
        C:\Windows\{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe
        
        C:\Windows\{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe
        
        C:\Windows\{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\{B67AF3A0-4927-4d7d-BE7A-F8DD9028C8D8}.exe
        
        C:\Windows\{B67AF3A0-4927-4d7d-BE7A-F8DD9028C8D8}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{22DAD~1.EXE > nul
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{92E3C~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D903C~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{28D8B~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4732
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AAA49~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4420
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1845C~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{52496~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{4E5A2~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe

Path C:\Windows\{1845CE7F-6D2C-437b-A38F-BF0D20CD7B31}.exe
Size 59KB
SHA256 2de8697522964a2a1bb8e70c1c7cc8d36951a18173a76163fa5cee1ae83c8703
MD5 e7bb2c140acdf4f5c6897cc1d74a4537
SHA1 70b1d9198b91edaeaf60b2069d8c3f057ce281f9
SHA512 a0e1619da8cdf299aa59e6d3a72ae77fde82fbd330ad940c4bf9e1b845ab7144155ae695678dd0f39062c0d697c9797581a561b93ab08d14ca6e7066307ffd31
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwKrY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLroKN4/CFsrd
TLSH
T1EB4309834BDE9CF2F791123118794AB9927B9AC4910EBE9FBF90CD550037292E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe

Path C:\Windows\{22DAD708-7434-46ac-A91C-8A3A82A7D1AC}.exe
Size 59KB
SHA256 5f433170e9294d4c1037364109fb50fdaeb2530467ba366866dfdeb25cb4f2c9
MD5 d53edd1f294a3442b9fdc4e93f95bf61
SHA1 5e104554022217dd7b3083507c423b2930f83ed7
SHA512 f4a29da7f1bac720705e537ef61f92a1874856ead57bbbee00ede35c0cb8e490e2d694050cd7c49a9810bf4d7bb67cd7aa80e11903b892ab36553f088ff3e863
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwE9Y04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLroy4/CFsrd
TLSH
T1404308834BDE9CF2F795123108794BB9927B9AC4910EBE9FBB90CD540037292E43E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe

Path C:\Windows\{28D8B867-33C5-4775-8D3C-42646A6AC199}.exe
Size 59KB
SHA256 dc2289e3c756a0f373ec93f059a649bf78f3fe7801529ff60d237aef32702ee9
MD5 2c23c307798a31c5e3c0c7be6accf15d
SHA1 253765d396e97b0f4eddb4e3f4793dfc6f66db62
SHA512 f6409084856663de4f7f54dd5c78855fb1bb5301b8251a47e3a9f570fe19beb6a9231a533885d0e01b60dc1fb816f32f17d9421b10969758260a7fe8e682d22e
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwE35Y04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLroeL4/CFsrd
TLSH
T1654309834BDE9CF2F791127108794AB9927B9AC4910EBE9FBF90CD550037292E53A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe

Path C:\Windows\{4E5A2101-C393-4dad-988C-44BF8E7B0AED}.exe
Size 59KB
SHA256 54631c819ceb76373267f37388d2ad3ad08834be369699dba081bae1f1322929
MD5 e83eed7c560da9b8851707cfcb025a47
SHA1 ff94e1303fbc223fe5e6c033607efc6b0f735a29
SHA512 98bacd1c638dc07da305e21f659eda084163f867864dd74e5ae9c250201427dd03b1ed3747429c4c1ceb8bbc03f702ba9565c6e21fd4fba7e32bfca12596b3ee
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwstY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLroi4/CFsrd
TLSH
T1FC4309834BDE9CF2F791123108794AB9927B9AD4910EBE9FBF90CD550037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{52496927-01CA-4943-8A1A-1B9404B202A0}.exe

Path C:\Windows\{52496927-01CA-4943-8A1A-1B9404B202A0}.exe
Size 59KB
SHA256 e8df328fbd99411536d52c95a7f8af92fc6571d96ec44acc4026e4edef537309
MD5 d72aa30f03a99c662b5d5615c0f06723
SHA1 5383b9cb3d312ae8a418ce9cf962bf756770b874
SHA512 28337625f66eb7428bf7d5ecca1cd206a2c12ad5e3832b17b24b453b4e90825a714edf7a3da4c06f4d0c6aaa940d2413ea28bb6525b187feff45876ccd156084
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwkqY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLro/4/CFsrd
TLSH
T1004308834BDE9CF2F795123108794AB9927B9AC4910EBE9FBF90CD540037292E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe

Path C:\Windows\{92E3CFE5-E1F1-49f7-A00F-E7FA749BB527}.exe
Size 59KB
SHA256 3c15ac7b019f71eb408a11de85db9a8793c32166c1704650b0bba7efd4465156
MD5 2ab77d7c067c96514c7ff2386b1020c6
SHA1 dfe5040ded25e0ac2ab36150d2ee919a478a66f7
SHA512 8a4dfba6dcbd96f5133e3cb5e92af5b1efe1d5c9a79d8a6a81b4e0093d7f2e30c9489c3ef80f06de9d6ac233a29e71b5791f59a2e6f0d11855314190e78139c8
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw1oGY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLro114/CFsrd
TLSH
T1A843F8834BDE9CF2F791123108794AB9927B9AC4910EBE9FBF90CD550037292E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe

Path C:\Windows\{AAA499C0-5DED-4e5e-86BC-B81269F46A08}.exe
Size 59KB
SHA256 c64bc7159de09bc113b0edaf599df15f3f7857e2b5ffeb270dca728f9f42ee5d
MD5 0e51ffcb7e82887665e521fe01b3df24
SHA1 882687c26af17d18c9621407fcdd2ee621fe33e0
SHA512 2cb49816c7a1175c57225c91e86dd28ac3b9c1b85bc565c881659a42547ffeafc8fd2f294fe8ed604b4ed2999265be2517fe7be20c1b0ca99dde379ac70eb69c
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwlY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLroX4/CFsrd
TLSH
T1894309834BDE9CF2F791123108794AB9927B9AD4910EBE9FBF90CD540037292E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B67AF3A0-4927-4d7d-BE7A-F8DD9028C8D8}.exe

Path C:\Windows\{B67AF3A0-4927-4d7d-BE7A-F8DD9028C8D8}.exe
Size 59KB
SHA256 1cb823a9c2941d173f03565c8dbda8aaa1046a52ce298dd8caf7edca1e85df9b
MD5 8e73ccdca05244730d2ea3019cc5a32a
SHA1 178cb884244000a3323ce4d3e60bb17a6d8f1a05
SHA512 1f0709d6b819c0f218f44baf5cc81a556c7fdedb7571b9f7ce5cdb024568ffd9f0a7b2543ebad24ad5f8d9169f0a63f73133a2552935b9980e3a1f164a45ef6e
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwkY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLroS4/CFsrd
TLSH
T19443F9834BDE5CF2F795123108794AB9927B9AC4910EBE9FBF90CD540037692E53A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe

Path C:\Windows\{D903CE4C-8D1B-4922-A2FB-0E573CBCA0FB}.exe
Size 59KB
SHA256 0aa40cbeb0fac57cd748db707ff18b0c494443f92aaeb71ebdc41bbe091d2bbb
MD5 e0f95a976853612f3256ea609d36acc4
SHA1 a54941e37e95d9429c790f0186784ff5fba780a6
SHA512 14f50555d4e32621f2cd733b5d204a27202ff8f6f8fa2a10ed1bb442b9ae745e565dcf4c8dd04dd525a51f4539ce62f160f827b6a17c4dab53d4847e5f1cbf27
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwPlY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLro/4/CFsrd
TLSH
T1D94309834BDE9CF2F791123118794AB9927B9AC4910EBE9FBF90CD540037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads