stormser | 392eade876c0fe76102598daec2b724b5b669b562a68fa89cbdf6ad6abb02467

General

Target
2026-08-09_a7fe6d0db8d2a8705e8b1ad9db891e39_elex_remcos_wannacry.exe
Size 59KB
Sample260809-tpwlls1fre
SHA256 392eade876c0fe76102598daec2b724b5b669b562a68fa89cbdf6ad6abb02467
MD5 a7fe6d0db8d2a8705e8b1ad9db891e39
SHA1 d90acb92c49acd9e81309bc670bcac87600fd512
SHA512 d7fbd0481af2232251e4311cc998559df740805b1c25939a2f8bcea39036d8d27e4a907f384eee30bcb2f2b946283636a235349f682d042e8c1bf18a4157a162
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLro+4/CFsrdHWMZ:Mvw9816vhKQLro+4/wQpWMZ
TLSH
T13F433B834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 8 IoCs

resource	yara_rule
behavioral1/files/0x00020000000233b2-2.dat	family_stormser
behavioral1/files/0x0007000000024606-7.dat	family_stormser
behavioral1/files/0x0008000000024481-10.dat	family_stormser
behavioral1/files/0x001000000002460b-15.dat	family_stormser
behavioral1/files/0x0009000000024481-19.dat	family_stormser
behavioral1/files/0x0002000000021fd4-23.dat	family_stormser
behavioral1/files/0x0003000000000729-26.dat	family_stormser
behavioral1/files/0x00050000000006d3-31.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 8 IoCs

resource	yara_rule
behavioral1/files/0x00020000000233b2-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0007000000024606-7.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024481-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x001000000002460b-15.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0009000000024481-19.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0002000000021fd4-23.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0003000000000729-26.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00050000000006d3-31.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 16 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}	{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}\stubpath = "C:\\Windows\\{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe"	{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}\stubpath = "C:\\Windows\\{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe"	{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE6F9B98-A02A-44d5-94C8-2772450F43A1}	{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE6F9B98-A02A-44d5-94C8-2772450F43A1}\stubpath = "C:\\Windows\\{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe"	{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}	{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0847E77-37EB-4053-8ADD-CBD06C0C3989}	{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0847E77-37EB-4053-8ADD-CBD06C0C3989}\stubpath = "C:\\Windows\\{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe"	{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB49CE81-C754-492f-9FC7-F72B9144CC31}\stubpath = "C:\\Windows\\{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe"	2026-08-09_a7fe6d0db8d2a8705e8b1ad9db891e39_elex_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}	{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}\stubpath = "C:\\Windows\\{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe"	{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}	{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}\stubpath = "C:\\Windows\\{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe"	{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06C7092B-EB68-4c3d-8D09-CA6DD3E5C102}	{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06C7092B-EB68-4c3d-8D09-CA6DD3E5C102}\stubpath = "C:\\Windows\\{06C7092B-EB68-4c3d-8D09-CA6DD3E5C102}.exe"	{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB49CE81-C754-492f-9FC7-F72B9144CC31}	2026-08-09_a7fe6d0db8d2a8705e8b1ad9db891e39_elex_remcos_wannacry.exe

Executes dropped EXE 8 IoCs

pid	Process
3552	{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe
5232	{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe
1644	{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe
3616	{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe
2880	{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe
8	{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe
4276	{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe
1848	{06C7092B-EB68-4c3d-8D09-CA6DD3E5C102}.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe	{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe
File created	C:\Windows\{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe	{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe
File created	C:\Windows\{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe	{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe
File created	C:\Windows\{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe	{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe
File created	C:\Windows\{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe	{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe
File created	C:\Windows\{06C7092B-EB68-4c3d-8D09-CA6DD3E5C102}.exe	{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe
File created	C:\Windows\{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe	2026-08-09_a7fe6d0db8d2a8705e8b1ad9db891e39_elex_remcos_wannacry.exe
File created	C:\Windows\{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe	{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5044	cmd.exe
5212	cmd.exe
5692	cmd.exe
5696	cmd.exe
5492	cmd.exe
5324	cmd.exe
1080	cmd.exe
896	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{06C7092B-EB68-4c3d-8D09-CA6DD3E5C102}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_a7fe6d0db8d2a8705e8b1ad9db891e39_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4800	2026-08-09_a7fe6d0db8d2a8705e8b1ad9db891e39_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	3552	{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe
Token: SeIncBasePriorityPrivilege	5232	{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe
Token: SeIncBasePriorityPrivilege	1644	{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe
Token: SeIncBasePriorityPrivilege	3616	{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe
Token: SeIncBasePriorityPrivilege	2880	{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe
Token: SeIncBasePriorityPrivilege	8	{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe
Token: SeIncBasePriorityPrivilege	4276	{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3552	4800	2026-08-09_a7fe6d0db8d2a8705e8b1ad9db891e39_elex_remcos_wannacry.exe	92
PID 4800 wrote to memory of 5044	4800	2026-08-09_a7fe6d0db8d2a8705e8b1ad9db891e39_elex_remcos_wannacry.exe	93
PID 3552 wrote to memory of 5232	3552	{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe	98
PID 3552 wrote to memory of 5212	3552	{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe	99
PID 5232 wrote to memory of 1644	5232	{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe	102
PID 5232 wrote to memory of 5692	5232	{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe	103
PID 1644 wrote to memory of 3616	1644	{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe	104
PID 1644 wrote to memory of 5696	1644	{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe	105
PID 3616 wrote to memory of 2880	3616	{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe	106
PID 3616 wrote to memory of 5492	3616	{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe	107
PID 2880 wrote to memory of 8	2880	{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe	108
PID 2880 wrote to memory of 5324	2880	{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe	109
PID 8 wrote to memory of 4276	8	{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe	111
PID 8 wrote to memory of 1080	8	{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe	112
PID 4276 wrote to memory of 1848	4276	{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe	113
PID 4276 wrote to memory of 896	4276	{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-09_a7fe6d0db8d2a8705e8b1ad9db891e39_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_a7fe6d0db8d2a8705e8b1ad9db891e39_elex_remcos_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe
  C:\Windows\{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe
    C:\Windows\{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5232
  - - C:\Windows\{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe
      C:\Windows\{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Windows\{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe
        
        C:\Windows\{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3616
      - C:\Windows\{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe
        
        C:\Windows\{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe
        
        C:\Windows\{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe
        
        C:\Windows\{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\{06C7092B-EB68-4c3d-8D09-CA6DD3E5C102}.exe
        
        C:\Windows\{06C7092B-EB68-4c3d-8D09-CA6DD3E5C102}.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0094C~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A0847~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{10015~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5324
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4F70E~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5492
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EE6F9~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{FC8CF~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{FB49C~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe

Path C:\Windows\{0094C57C-E2D9-4962-9F06-B97D7DF46F1E}.exe
Size 59KB
SHA256 0a3e3dfec0d99537fe798dc5b4f1374b87d0b3dbfeba61594d4fc79c50b3152d
MD5 8ac9eeb90867a9952eb5559303205539
SHA1 f0ad8b7fe0f8d225db687f22ce73c93937e5f7fa
SHA512 0acbcf157e385d05915cdd1bed1fb785a2d5c60ba99638ff1269effbc0cb9d765b372a3f56494189c588ebbf25c68546c8e9c31cba4283b97b5423e0100437ea
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrox4/CFsrdHWMZ:Mvw9816vhKQLrox4/wQpWMZ
TLSH
T1F3433A834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{06C7092B-EB68-4c3d-8D09-CA6DD3E5C102}.exe

Path C:\Windows\{06C7092B-EB68-4c3d-8D09-CA6DD3E5C102}.exe
Size 59KB
SHA256 97f8c9844ecc1bddf798bc6cbf2fd27f0b5532a76d439505b24df60f6aa81485
MD5 52bb59e3ee1546028ceb124d30e6aab2
SHA1 52cdc07ec36fcf96e3a830ee78923cc15feb541b
SHA512 02c1ad2071868d176bfdaee44526737d80931af0f8b60b8614d6e3fbf5a7b0b410b10ec840764292d2a9f6b691825357cb4e8dcf1c773240050ef3a636687c59
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroj4/CFsrdHWMZ:Mvw9816vhKQLroj4/wQpWMZ
TLSH
T1AF433A834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe

Path C:\Windows\{10015395-DCA2-45f6-BFF3-4E7ECDDF5478}.exe
Size 59KB
SHA256 41d74ffc4239274afddb79dcf69c2a4790ac38952f5f4a1f104e1fb7ab7eb649
MD5 3089bc1dd3ef0bfce7e328e2c7239ff6
SHA1 355592726b6b066f1ee587044cb0903419e05044
SHA512 9972e68c813b69533f8c52b088d25e0d23c798d2498eb3895cfdc168e798184e5ebe80ee6d751074f56cc43ae8a42ef98cb4b56cc958b972447ceb0507d3d289
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrof4/CFsrdHWMZ:Mvw9816vhKQLrof4/wQpWMZ
TLSH
T142434B834F997CF2FB810175043A8B7992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe

Path C:\Windows\{4F70E395-A404-4ea5-955F-A6C3C3DF3D16}.exe
Size 59KB
SHA256 2a4aa51be5009c1e36142b60b5beb6ea4f2a582db323f9ba9afbd1c2f8a61e4c
MD5 bf8dfba836fdff7af02658aee9755b9c
SHA1 118a6c2b55f35dce6720f45d946520ff72708a7e
SHA512 446f4607ffcfbaf73fd82bed62ca3d18ae67586c9e26bcdd3fc0dfeede1f4e91b0d97b466058547530a3ba133a03c7bda1394f3095a37fab16bfb454914ff086
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroK4/CFsrdHWMZ:Mvw9816vhKQLroK4/wQpWMZ
TLSH
T105433B834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe

Path C:\Windows\{A0847E77-37EB-4053-8ADD-CBD06C0C3989}.exe
Size 59KB
SHA256 aed100809ed3ee7991aed1975d1625ff4ebd9c09a7543707f9123e95a03a844a
MD5 2170ab2e93a4fbd4727e7e84b1d5d548
SHA1 133d7d770bd2eded003b49ed769ee22d9b14c16a
SHA512 2f8f17b83123773cc24281e4a1527dfbf098d16da029f46fb6dd163cc6bd56c890787f608493fd04c3ab1284af27311189c198422abae24af150033935d27f96
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroQ4/CFsrdHWMZ:Mvw9816vhKQLroQ4/wQpWMZ
TLSH
T120433B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe

Path C:\Windows\{EE6F9B98-A02A-44d5-94C8-2772450F43A1}.exe
Size 59KB
SHA256 959158fe8e5e5486a399077c324e9236a76d1f2231128ac69bdaf32737fdcceb
MD5 1b8c1ccf78884477eca9d09d97d77b8b
SHA1 4e2e908acef409b160c3f27b65af79f26b1ee06f
SHA512 25fbc48355fe8e0185a4416ab681b89dad066dd2450ad2427a17b8fdc4537036bf7d494f90e071758a4caec0794cc6e1415b51900feacadaa96c21d93bc4cfd7
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLros4/CFsrdHWMZ:Mvw9816vhKQLros4/wQpWMZ
TLSH
T1D6433B834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe

Path C:\Windows\{FB49CE81-C754-492f-9FC7-F72B9144CC31}.exe
Size 59KB
SHA256 79697a4d9834f0dd129ac1aef8245615f35b81749e2347b128dcc4fc02a3dd04
MD5 8200ebe5f4e7f817d5430f83bf2b5e88
SHA1 63255b17acb31db3298e7ea41cb4c3ca2719eabd
SHA512 e6bfd8c4ce0c190408b2a5b7098dbca709b0f3c0f11f8038ae017c85457f03aff302e9a373423556f44ef1008d1f643c6a3ba1e161a3ecab3f76479c36dd3957
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroh4/CFsrdHWMZ:Mvw9816vhKQLroh4/wQpWMZ
TLSH
T184433B834F997CF2FB810175043A8B7992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe

Path C:\Windows\{FC8CF9E5-0EF4-41d8-8890-89F1C54AE97E}.exe
Size 59KB
SHA256 f3912b77b1323b63d5e5ff3b0dad039fe9cac3347e566872b7fbf9766daae37d
MD5 e01cbc2c51718e2d937fd4d1546e7a73
SHA1 12263257fe0bcd7a723e5a38c47a6bdb585f69a5
SHA512 40ca6cc3b9c821cfe351a3d60772a1b05dd52eb9d436b8a0aebd0ccdeba93317d3b837a5b13fecc897847dd5020e7a384e9b05c91347cf70972955f1dd041016
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLro04/CFsrdHWMZ:Mvw9816vhKQLro04/wQpWMZ
TLSH
T15A433B834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads