f601965a5cdbec4dc7fec55f48692e55c98ff34e29dc3b278f014ba2155c24fc

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_dc9a8b7ed8e0ce00d5a60e5c3eb8aed9_elex_wannacry.exe
Size 60KB
Sample260804-fwttpssaje
SHA256 f601965a5cdbec4dc7fec55f48692e55c98ff34e29dc3b278f014ba2155c24fc
MD5 dc9a8b7ed8e0ce00d5a60e5c3eb8aed9
SHA1 7c1af38c35bbae9ba0199c4fcde2cf82fa754765
SHA512 1ffac3011407ace6edf986fa67173a93e4a281c3e36e8ac802cdca1c7e56bbde63a76a7a6472237e95cefbb5ce4ddcac9f535e1bf91fe1dad7c38fc4550ff722
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwf404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLrox4/Clsrul
TLSH
T13D5329835BEE5CF2F7950231087C8BB9927B99D4950DBEEFAB50CD544037292E83A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1688	w5543BA89fF836v412e280A4862C3072F0CFCl.exe
1368	wB864702AfDA10v4fa6286E087BE002D73DA0l.exe
3892	wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe
3752	w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe
4040	wB24211AEf9CD3v415d2AB3881C45760500C2l.exe
4620	wEC4D8049fD625v4fa528028898524E490918l.exe
2828	wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe
1864	w67D563BEf8506v48182818F84EB1FB62D7F2l.exe
680	w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe
4216	w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe
5028	w5151963Ff9592v4dd72AF468E712DBDA5258l.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\w5543BA89fF836v412e280A4862C3072F0CFCl.exe	2026-08-04_dc9a8b7ed8e0ce00d5a60e5c3eb8aed9_elex_wannacry.exe
File created	C:\Windows\wB864702AfDA10v4fa6286E087BE002D73DA0l.exe	w5543BA89fF836v412e280A4862C3072F0CFCl.exe
File created	C:\Windows\wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe	wB864702AfDA10v4fa6286E087BE002D73DA0l.exe
File created	C:\Windows\w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe	wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe
File created	C:\Windows\wEC4D8049fD625v4fa528028898524E490918l.exe	wB24211AEf9CD3v415d2AB3881C45760500C2l.exe
File created	C:\Windows\wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe	wEC4D8049fD625v4fa528028898524E490918l.exe
File created	C:\Windows\w67D563BEf8506v48182818F84EB1FB62D7F2l.exe	wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe
File created	C:\Windows\w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe	w67D563BEf8506v48182818F84EB1FB62D7F2l.exe
File created	C:\Windows\wB24211AEf9CD3v415d2AB3881C45760500C2l.exe	w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe
File created	C:\Windows\w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe	w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe
File created	C:\Windows\w5151963Ff9592v4dd72AF468E712DBDA5258l.exe	w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5068	cmd.exe
4272	cmd.exe
2676	cmd.exe
4684	cmd.exe
4856	cmd.exe
444	cmd.exe
2396	cmd.exe
4988	cmd.exe
4884	cmd.exe
3232	cmd.exe
1264	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_dc9a8b7ed8e0ce00d5a60e5c3eb8aed9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wB864702AfDA10v4fa6286E087BE002D73DA0l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wB24211AEf9CD3v415d2AB3881C45760500C2l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wEC4D8049fD625v4fa528028898524E490918l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w5543BA89fF836v412e280A4862C3072F0CFCl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w67D563BEf8506v48182818F84EB1FB62D7F2l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w5151963Ff9592v4dd72AF468E712DBDA5258l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4348	2026-08-04_dc9a8b7ed8e0ce00d5a60e5c3eb8aed9_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	1688	w5543BA89fF836v412e280A4862C3072F0CFCl.exe
Token: SeIncBasePriorityPrivilege	1368	wB864702AfDA10v4fa6286E087BE002D73DA0l.exe
Token: SeIncBasePriorityPrivilege	3892	wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe
Token: SeIncBasePriorityPrivilege	3752	w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe
Token: SeIncBasePriorityPrivilege	4040	wB24211AEf9CD3v415d2AB3881C45760500C2l.exe
Token: SeIncBasePriorityPrivilege	4620	wEC4D8049fD625v4fa528028898524E490918l.exe
Token: SeIncBasePriorityPrivilege	2828	wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe
Token: SeIncBasePriorityPrivilege	1864	w67D563BEf8506v48182818F84EB1FB62D7F2l.exe
Token: SeIncBasePriorityPrivilege	680	w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe
Token: SeIncBasePriorityPrivilege	4216	w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1688	4348	2026-08-04_dc9a8b7ed8e0ce00d5a60e5c3eb8aed9_elex_wannacry.exe	95
PID 4348 wrote to memory of 4684	4348	2026-08-04_dc9a8b7ed8e0ce00d5a60e5c3eb8aed9_elex_wannacry.exe	96
PID 1688 wrote to memory of 1368	1688	w5543BA89fF836v412e280A4862C3072F0CFCl.exe	97
PID 1688 wrote to memory of 4988	1688	w5543BA89fF836v412e280A4862C3072F0CFCl.exe	98
PID 1368 wrote to memory of 3892	1368	wB864702AfDA10v4fa6286E087BE002D73DA0l.exe	100
PID 1368 wrote to memory of 4856	1368	wB864702AfDA10v4fa6286E087BE002D73DA0l.exe	101
PID 3892 wrote to memory of 3752	3892	wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe	104
PID 3892 wrote to memory of 4884	3892	wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe	105
PID 3752 wrote to memory of 4040	3752	w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe	106
PID 3752 wrote to memory of 3232	3752	w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe	107
PID 4040 wrote to memory of 4620	4040	wB24211AEf9CD3v415d2AB3881C45760500C2l.exe	111
PID 4040 wrote to memory of 444	4040	wB24211AEf9CD3v415d2AB3881C45760500C2l.exe	112
PID 4620 wrote to memory of 2828	4620	wEC4D8049fD625v4fa528028898524E490918l.exe	114
PID 4620 wrote to memory of 2396	4620	wEC4D8049fD625v4fa528028898524E490918l.exe	115
PID 2828 wrote to memory of 1864	2828	wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe	116
PID 2828 wrote to memory of 1264	2828	wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe	117
PID 1864 wrote to memory of 680	1864	w67D563BEf8506v48182818F84EB1FB62D7F2l.exe	118
PID 1864 wrote to memory of 5068	1864	w67D563BEf8506v48182818F84EB1FB62D7F2l.exe	119
PID 680 wrote to memory of 4216	680	w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe	125
PID 680 wrote to memory of 4272	680	w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe	126
PID 4216 wrote to memory of 5028	4216	w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe	127
PID 4216 wrote to memory of 2676	4216	w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe	128

C:\Users\Admin\AppData\Local\Temp\2026-08-04_dc9a8b7ed8e0ce00d5a60e5c3eb8aed9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_dc9a8b7ed8e0ce00d5a60e5c3eb8aed9_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\w5543BA89fF836v412e280A4862C3072F0CFCl.exe
  C:\Windows\w5543BA89fF836v412e280A4862C3072F0CFCl.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\wB864702AfDA10v4fa6286E087BE002D73DA0l.exe
    C:\Windows\wB864702AfDA10v4fa6286E087BE002D73DA0l.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe
      C:\Windows\wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Windows\w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe
        
        C:\Windows\w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3752
      - C:\Windows\wB24211AEf9CD3v415d2AB3881C45760500C2l.exe
        
        C:\Windows\wB24211AEf9CD3v415d2AB3881C45760500C2l.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\wEC4D8049fD625v4fa528028898524E490918l.exe
        
        C:\Windows\wEC4D8049fD625v4fa528028898524E490918l.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe
        
        C:\Windows\wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\w67D563BEf8506v48182818F84EB1FB62D7F2l.exe
        
        C:\Windows\w67D563BEf8506v48182818F84EB1FB62D7F2l.exe
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe
        
        C:\Windows\w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe
        10⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:680
        
        C:\Windows\w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe
        
        C:\Windows\w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\w5151963Ff9592v4dd72AF468E712DBDA5258l.exe
        
        C:\Windows\w5151963Ff9592v4dd72AF468E712DBDA5258l.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W45EEB~1.EXE > nul
        12⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W669F3~1.EXE > nul
        11⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W67D56~1.EXE > nul
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\WB1E86~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\WEC4D8~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\WB2421~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:444
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W2794E~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3232
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\WDED7D~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4884
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\WB8647~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\W5543B~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe

Path C:\Windows\w2794EE9Af1FD1v4a2829EF683B5DAAD6D9F7l.exe
Size 60KB
SHA256 7b002071c84731d634e71651db2bbbb89c1ee8e41de66e9454055924183942b3
MD5 c417c13e61cf5e7b0decd058bfc99ccf
SHA1 f7a4347e79c20d66386aa4b6a7c3f48b3457d956
SHA512 c827cceedec3e3ea49e85e4035d06a6c5aa5122c090963b049184810963c3bc3d5b14d96ae169b0b61f7cfad265c839cfdbbb3e27eb90d3a63840343de453ec8
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwi404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLro44/Clsrul
TLSH
T12D5319835BEE5CF2F7911231087C8BB9927B99D4950DBEEFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe

Path C:\Windows\w45EEBD99f0D5Fv425d2B70A807B62F6869F5l.exe
Size 60KB
SHA256 0490e25849740413e55c5ef42f98219bd4dc5c27e4608d045a6f80a2c4465735
MD5 9321123984c7b87cdc6fba7e1dbe02e8
SHA1 1109d32bb626bdee34f67e43ebdcfd8f3cff8de3
SHA512 1c223dfd5e053d560b2dccbf3fb702e613db644859ad65b21305117c781d4c97862cfd7d157d1ced1993a18473c66894986254445cbdf4435468ea3582744ead
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwt404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLrof4/Clsrul
TLSH
T1485318835BEE5CF2F7911231087C8BB9927B99D4950DBEDFAB50CE544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w5151963Ff9592v4dd72AF468E712DBDA5258l.exe

Path C:\Windows\w5151963Ff9592v4dd72AF468E712DBDA5258l.exe
Size 60KB
SHA256 f52b005fb4ffb68d0bb96c87d5ea4831b88f9e737c2f47ee81d5585b2711d198
MD5 0c1e9e20ccafee9653841ee245e7a768
SHA1 9de8bce1cd3abb384d89cf552e585da6b5a78826
SHA512 4592c0ae7108ebedf94a95a7dbb18953d8f459be35a4bd3c21c8056aa1cc00587f8c5dbd068e3a6456769f1e425723fe1c68103960bad953cd89b005019e654d
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwo404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroW4/Clsrul
TLSH
T1835319835BEE5CF2F7951231087C8BB9927B9AD4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w5543BA89fF836v412e280A4862C3072F0CFCl.exe

Path C:\Windows\w5543BA89fF836v412e280A4862C3072F0CFCl.exe
Size 60KB
SHA256 5fe5bb85fa96f4508d9fff4c485ab466f6b2486f6091bbcedb4952b5922dea7f
MD5 5796ce484265bf941e426bcfebe4be68
SHA1 9bb229b388d763882313b5afc63837027884c037
SHA512 94c3a4a78050db733d225f372cd85325205a20664bfc32d3e02cf59101860bd819b5ca07b034cf0b0e4c7a0fb64929a80efa77b1141c6e2bff98b6b810465a93
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwZ404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroL4/Clsrul
TLSH
T16E5319835BEE5CF2F7911231087C8BB9927B99D4950DBEDFAB50CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe

Path C:\Windows\w669F3CE4f7842v48e52AC8F8EEFCBA723F6Fl.exe
Size 60KB
SHA256 35bfe52693ca7528f5cb47119693177642062fa7a9074f9881dc0da1d47abd3d
MD5 9442d7bf3753a12bd579726a2476afe5
SHA1 9276afc1a781bfa7221a5e8e3ef8f6a09af07b4d
SHA512 1b2aabef06d19e8433f334338bf514dc99bff048459937c2e526cc0bd1a6807eb817fdd3eb27e2b8520514c6623ccfe2d4c296dc063f8fed62241959df487916
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro4v4/Clsrul:vvw9816vhKQLroS4/QQ
TLSH
T1AD5319835BEE5CF2F7911131087C8BB9927B99D4950EBEEFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w67D563BEf8506v48182818F84EB1FB62D7F2l.exe

Path C:\Windows\w67D563BEf8506v48182818F84EB1FB62D7F2l.exe
Size 60KB
SHA256 77fdb0e2a2e0d489f46d186bf3ebb78e7ad084c83e57157fdebf16f4d8e346b4
MD5 8c216d705fc60448825a60a9506bb5dd
SHA1 4eef093642a71387291a1faf6cd20b745399af79
SHA512 07b07be2a613898d1a8172d02f017e30394426a6a087398c26ba307e594f1b168786fac21c5d518797d33919d7c2ad87ad816cb0e134d57b28899d22c462febf
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwh404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroz4/Clsrul
TLSH
T1065319835BEE5CF2F7951131087C8BB9927B9AD4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe

Path C:\Windows\wB1E86CB6fDD64v4cdc2900985CE528DBBCA1l.exe
Size 60KB
SHA256 bf3da326c6091fa2f77f1c4244cd3627efaa29715b08e2bf3f27e51a2077c398
MD5 18049f580cddb3c86f72a748934884e8
SHA1 877b0b73e7955073f46f5f54b0fdee837c5f0037
SHA512 b28d183959e8e3269f272f1cd594507ebce23b96334486bb7457b64be718e0dcd4e00803702f715418e74000131b64a32a5a2e72411b1cef9be86dc40eae9660
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwl404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLro34/Clsrul
TLSH
T1F15318835BEE5CF2F7951231087C8BB9927B99D4950EBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wB24211AEf9CD3v415d2AB3881C45760500C2l.exe

Path C:\Windows\wB24211AEf9CD3v415d2AB3881C45760500C2l.exe
Size 60KB
SHA256 7bee14b6c03562b283908fc6fbe5156550f58bc6b0cf43d43b8b29f2adbe1c4b
MD5 3fa1e7311b618eb65978984078085a6f
SHA1 7ce30b60c71287c67642b49be0900f18cf632bfa
SHA512 bfd0d7660c43d08aeb4d198eafb93567fb12633e6b15f48f04c1764c2eb5d37e04fb0c8d253de290fbc6010773e556729d1a5beb097a4a35c95c2166eeff421b
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwc404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroK4/Clsrul
TLSH
T1485319835BEE5CF2F7911131087C8BB9927B99D4950DBEEFAB40CD584037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wB864702AfDA10v4fa6286E087BE002D73DA0l.exe

Path C:\Windows\wB864702AfDA10v4fa6286E087BE002D73DA0l.exe
Size 60KB
SHA256 d45529102085a2ca6519ebf78d410f0c37d3d66340834a42d960cb7ba2171f93
MD5 03471e7740d5735e2bb9fba1ee528d46
SHA1 4deb6aab011e749431a6a0ac7e3c0117aa0041ef
SHA512 f361d6dcc34227a8a4099686674a2fd1d3913593e6e5c135cbbf9ebb61ea13a2478c1602cd2aed0d638d78155a2858e58d0ab6a561e949ffcba37a1224bc16ab
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro4v4/Clsrul:vvw9816vhKQLro4v4/QQ
TLSH
T1A85319835BEE5CF2F7951231087C8BB9927B99D4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe

Path C:\Windows\wDED7DF0AfFDFAv44282866C8E384E0752E6Al.exe
Size 60KB
SHA256 bd013707efe9c5f82f5c93ccfa01fb95c25cec551c1da718198dd821c7ea8378
MD5 aca4c711f96d8d4911f01682fb63206c
SHA1 f131bff20acec4496a5110c5c5d74b7cd7777fca
SHA512 522de50c692d5ed745eb08708352f587f59e18142ad1d70966b7920b08574f10b9d0013a0de7c11f93e07966bbef34965d535c7d80d05b02b6eb9b2f917a8bcf
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwL404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroN4/Clsrul
TLSH
T1FD5319835BEE5CF2F7911231087C8BB9927B99D4950DBEEFAB50CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wEC4D8049fD625v4fa528028898524E490918l.exe

Path C:\Windows\wEC4D8049fD625v4fa528028898524E490918l.exe
Size 60KB
SHA256 968a385f3b95157bd5f7156cd5adcac61dc50e32b4308952927c8a182d092810
MD5 82d086894cd09eda9d576e229bcf8962
SHA1 cd62347435077c132590f7c6c7335e602d15591b
SHA512 3b2bfdb5cd2ab742ec339ba7bd5c5ab516c0644fa1355e8d3c072c0d218c930150034ac2a44383e858a36a960fc6c5cd2607c3e88e1494eebabc3071f5f47727
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro0c4/Clsrul:vvw9816vhKQLroH4/QQ
TLSH
T1595319835BEE5CF2F7911231087C8BB9927B99D4950DBEEFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads