stormser | c94c1426dc1645776ba5a62e383d8b2e15cbc241c38d11aeb1c371ec5516c8a1

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_9da71b9fbe14e40a62e3339a0eab9c01_elex_wannacry.exe
Size 60KB
Sample260810-evpmxsaq7v
SHA256 c94c1426dc1645776ba5a62e383d8b2e15cbc241c38d11aeb1c371ec5516c8a1
MD5 9da71b9fbe14e40a62e3339a0eab9c01
SHA1 51395b4eb15b0713c56944b055c81d39f1238f66
SHA512 435888025ba61c836e3ae3a5676dfb5a6badd277d473cab316ebe09efc2814682b0593f772c0d654541e9262e321a86012bf333e1bbfa4493a7ef380798ca8cd
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw/Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrox4/CFsrd
TLSH
T1915309834BEE9CF2F791123108794AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral1/files/0x000700000002430c-2.dat	family_stormser
behavioral1/files/0x000d00000001daa2-6.dat	family_stormser
behavioral1/files/0x001200000001dabb-8.dat	family_stormser
behavioral1/files/0x000700000001e0fb-14.dat	family_stormser
behavioral1/files/0x000a00000001e73a-18.dat	family_stormser
behavioral1/files/0x000500000001e0f2-22.dat	family_stormser
behavioral1/files/0x00030000000006fd-26.dat	family_stormser
behavioral1/files/0x000500000000072b-30.dat	family_stormser
behavioral1/files/0x00040000000006fd-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9728728E-191E-4275-A748-AFC2E23E08CD}\stubpath = "C:\\Windows\\{9728728E-191E-4275-A748-AFC2E23E08CD}.exe"	2026-08-10_9da71b9fbe14e40a62e3339a0eab9c01_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}	{9728728E-191E-4275-A748-AFC2E23E08CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{119701F6-A6DC-494b-961F-344FF178C58C}	{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9728728E-191E-4275-A748-AFC2E23E08CD}	2026-08-10_9da71b9fbe14e40a62e3339a0eab9c01_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}\stubpath = "C:\\Windows\\{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe"	{9728728E-191E-4275-A748-AFC2E23E08CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}	{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}\stubpath = "C:\\Windows\\{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe"	{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{119701F6-A6DC-494b-961F-344FF178C58C}\stubpath = "C:\\Windows\\{119701F6-A6DC-494b-961F-344FF178C58C}.exe"	{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84B35226-C18A-4e6f-912B-7E881FB4EC2D}	{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84B35226-C18A-4e6f-912B-7E881FB4EC2D}\stubpath = "C:\\Windows\\{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe"	{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{756741D5-C35F-4e50-A563-27A171792CB3}	{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{756741D5-C35F-4e50-A563-27A171792CB3}\stubpath = "C:\\Windows\\{756741D5-C35F-4e50-A563-27A171792CB3}.exe"	{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC203B24-4644-45b1-A2AD-478E1741DB7B}	{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5B9204C-FE43-4aa9-B973-307310642A2F}	{119701F6-A6DC-494b-961F-344FF178C58C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5B9204C-FE43-4aa9-B973-307310642A2F}\stubpath = "C:\\Windows\\{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe"	{119701F6-A6DC-494b-961F-344FF178C58C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97F2C978-67DE-41d2-9188-3CD03C606F20}	{756741D5-C35F-4e50-A563-27A171792CB3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97F2C978-67DE-41d2-9188-3CD03C606F20}\stubpath = "C:\\Windows\\{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe"	{756741D5-C35F-4e50-A563-27A171792CB3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC203B24-4644-45b1-A2AD-478E1741DB7B}\stubpath = "C:\\Windows\\{EC203B24-4644-45b1-A2AD-478E1741DB7B}.exe"	{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe

Executes dropped EXE 9 IoCs

pid	Process
4536	{9728728E-191E-4275-A748-AFC2E23E08CD}.exe
4828	{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe
708	{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe
556	{119701F6-A6DC-494b-961F-344FF178C58C}.exe
4056	{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe
372	{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe
3332	{756741D5-C35F-4e50-A563-27A171792CB3}.exe
3508	{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe
680	{EC203B24-4644-45b1-A2AD-478E1741DB7B}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{9728728E-191E-4275-A748-AFC2E23E08CD}.exe	2026-08-10_9da71b9fbe14e40a62e3339a0eab9c01_elex_wannacry.exe
File created	C:\Windows\{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe	{9728728E-191E-4275-A748-AFC2E23E08CD}.exe
File created	C:\Windows\{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe	{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe
File created	C:\Windows\{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe	{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe
File created	C:\Windows\{119701F6-A6DC-494b-961F-344FF178C58C}.exe	{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe
File created	C:\Windows\{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe	{119701F6-A6DC-494b-961F-344FF178C58C}.exe
File created	C:\Windows\{756741D5-C35F-4e50-A563-27A171792CB3}.exe	{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe
File created	C:\Windows\{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe	{756741D5-C35F-4e50-A563-27A171792CB3}.exe
File created	C:\Windows\{EC203B24-4644-45b1-A2AD-478E1741DB7B}.exe	{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3596	cmd.exe
4888	cmd.exe
4812	cmd.exe
3536	cmd.exe
2660	cmd.exe
3352	cmd.exe
2704	cmd.exe
4208	cmd.exe
2684	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{756741D5-C35F-4e50-A563-27A171792CB3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EC203B24-4644-45b1-A2AD-478E1741DB7B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9728728E-191E-4275-A748-AFC2E23E08CD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{119701F6-A6DC-494b-961F-344FF178C58C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_9da71b9fbe14e40a62e3339a0eab9c01_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2800	2026-08-10_9da71b9fbe14e40a62e3339a0eab9c01_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4536	{9728728E-191E-4275-A748-AFC2E23E08CD}.exe
Token: SeIncBasePriorityPrivilege	4828	{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe
Token: SeIncBasePriorityPrivilege	708	{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe
Token: SeIncBasePriorityPrivilege	556	{119701F6-A6DC-494b-961F-344FF178C58C}.exe
Token: SeIncBasePriorityPrivilege	4056	{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe
Token: SeIncBasePriorityPrivilege	372	{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe
Token: SeIncBasePriorityPrivilege	3332	{756741D5-C35F-4e50-A563-27A171792CB3}.exe
Token: SeIncBasePriorityPrivilege	3508	{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4536	2800	2026-08-10_9da71b9fbe14e40a62e3339a0eab9c01_elex_wannacry.exe	94
PID 2800 wrote to memory of 3596	2800	2026-08-10_9da71b9fbe14e40a62e3339a0eab9c01_elex_wannacry.exe	95
PID 4536 wrote to memory of 4828	4536	{9728728E-191E-4275-A748-AFC2E23E08CD}.exe	101
PID 4536 wrote to memory of 3352	4536	{9728728E-191E-4275-A748-AFC2E23E08CD}.exe	102
PID 4828 wrote to memory of 708	4828	{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe	103
PID 4828 wrote to memory of 4888	4828	{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe	104
PID 708 wrote to memory of 556	708	{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe	107
PID 708 wrote to memory of 4812	708	{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe	108
PID 556 wrote to memory of 4056	556	{119701F6-A6DC-494b-961F-344FF178C58C}.exe	110
PID 556 wrote to memory of 3536	556	{119701F6-A6DC-494b-961F-344FF178C58C}.exe	111
PID 4056 wrote to memory of 372	4056	{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe	113
PID 4056 wrote to memory of 2704	4056	{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe	114
PID 372 wrote to memory of 3332	372	{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe	115
PID 372 wrote to memory of 2660	372	{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe	116
PID 3332 wrote to memory of 3508	3332	{756741D5-C35F-4e50-A563-27A171792CB3}.exe	118
PID 3332 wrote to memory of 4208	3332	{756741D5-C35F-4e50-A563-27A171792CB3}.exe	119
PID 3508 wrote to memory of 680	3508	{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe	120
PID 3508 wrote to memory of 2684	3508	{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-10_9da71b9fbe14e40a62e3339a0eab9c01_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_9da71b9fbe14e40a62e3339a0eab9c01_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\{9728728E-191E-4275-A748-AFC2E23E08CD}.exe
  C:\Windows\{9728728E-191E-4275-A748-AFC2E23E08CD}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe
    C:\Windows\{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe
      C:\Windows\{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:708
    - - C:\Windows\{119701F6-A6DC-494b-961F-344FF178C58C}.exe
        
        C:\Windows\{119701F6-A6DC-494b-961F-344FF178C58C}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:556
      - C:\Windows\{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe
        
        C:\Windows\{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe
        
        C:\Windows\{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\{756741D5-C35F-4e50-A563-27A171792CB3}.exe
        
        C:\Windows\{756741D5-C35F-4e50-A563-27A171792CB3}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe
        
        C:\Windows\{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\{EC203B24-4644-45b1-A2AD-478E1741DB7B}.exe
        
        C:\Windows\{EC203B24-4644-45b1-A2AD-478E1741DB7B}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{97F2C~1.EXE > nul
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{75674~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{84B35~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F5B92~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2704
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{11970~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3536
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9F8F2~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{0FAE6~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{97287~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe

Path C:\Windows\{0FAE6B3B-B7A9-4e7d-B35B-350646F11DA5}.exe
Size 60KB
SHA256 4f82066cb04a5f988bf4c1107db62b9b494278cd051cba541b3a430dd561a141
MD5 fbc356fc475bd302ce5aaffbc7385b2f
SHA1 edc88b79190c92387bc1b3e789892e6a76a11f95
SHA512 2494296814827215579de39e044151a370e2b47ed40602446c284ba74e6dda19015abe907c0728145e201fb7c13211e5f2fbac6bfdccffa5830a0e22b57ccd12
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwMY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro64/CFsrd
TLSH
T19D5309834BEE5CF2F791117108798AB9927B99C4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{119701F6-A6DC-494b-961F-344FF178C58C}.exe

Path C:\Windows\{119701F6-A6DC-494b-961F-344FF178C58C}.exe
Size 60KB
SHA256 cbbf1082a09239e9e3fd8f5d0ff0bf5138a69ce5378576c3381e7714d1440b27
MD5 b05ca0d6c60c35e39913186db0d9b37d
SHA1 b2d0fe55b9149f23f03b568d8d19b7d5f0c22d49
SHA512 70b9cc67bb5cda76c5c90cda09de7f106eab2d61b98c8b354a182b804c6ab181243894b7595a5940a31f2e4ceba9eef5cc3db6a5e0c946aab4e342338029b883
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqweLY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroS4/CFsrd
TLSH
T13E5308834BEE5CF2F791127108798AB9927B99C4910EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{756741D5-C35F-4e50-A563-27A171792CB3}.exe

Path C:\Windows\{756741D5-C35F-4e50-A563-27A171792CB3}.exe
Size 60KB
SHA256 27f3d96da3ab72019a6cc61fe8a1807bf5667bf8c723577d01c3837c1d8b0f49
MD5 5fcb3f92131cc6b3297116d6a002e02c
SHA1 f28279b629a878c75f2f3f4fc35e528a76a9324e
SHA512 914ea4c7db64eea594f472b96ae06fec19610fa353f1f5d2ed32c7db75f25fe3f5d6c97d111015ef4b2a21cf46ba5fecfd4be97aea56f042d568ea25dcb23787
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwMY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro64/CFsrd
TLSH
T1C35308834BEE5CF2F791117108798AB9927B99D4910EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe

Path C:\Windows\{84B35226-C18A-4e6f-912B-7E881FB4EC2D}.exe
Size 60KB
SHA256 2b6f7708052a3590b858b7950fb2b1be3ea20205de27cff44ad7ec5066674079
MD5 71763b14ee78d7c7d471777c2218c394
SHA1 9991d42beb545ee3354c447647a49c445566b98c
SHA512 3967e3314343408e6b878e86f447d4ffa9596830742969a65ddab0bf69c918b34a99517946621ed1ae3ede5b59a836be48087321aeb4b93c8149355f51d3867c
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwBnY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroBZ4/CFsrd
TLSH
T17253F8834BEE5CF2F691123108798AB9927B99D4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9728728E-191E-4275-A748-AFC2E23E08CD}.exe

Path C:\Windows\{9728728E-191E-4275-A748-AFC2E23E08CD}.exe
Size 60KB
SHA256 fd150efcd846a357f07e649944dbc001e9bad0c6c06cd5eba1a34254c77925dd
MD5 d310971353e014b4524c1600abe9cfca
SHA1 aac8a3068580d161549e6f1c663d665362369b34
SHA512 918ca4054f89be91b89bf942069256066c53084ef4f5461874841d31fc9201f4099573c32994dbf4529c5d983a94dd435dfeb215aea06f43e26ae383bc249e72
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwt+Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroG4/CFsrd
TLSH
T1665308834BEE5CF2F791117108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe

Path C:\Windows\{97F2C978-67DE-41d2-9188-3CD03C606F20}.exe
Size 60KB
SHA256 4ec65a077199ec3339a76ec5f00e050854c7154781095ced3cc512bce9ecacf7
MD5 37e2113c263159ce15b8d43fcca8d8e0
SHA1 6dfa9171e7d1f05bdb7cb1fddd29993ea0ae0037
SHA512 e6e22605f3c8207c69e4ff7fa5541570bf8728c81bdff9a190201854916d22e6f4f03226273e1d0e00d53d13cbe27dd553d52aa86b93c809b6d0a21c0f57880c
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwNqY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroa4/CFsrd
TLSH
T1915308834BEE5CF2F791127108798AB9927B99C4950EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe

Path C:\Windows\{9F8F2EFB-D78E-4af1-B317-099BB31E46B8}.exe
Size 60KB
SHA256 c944f8a39dd54f8a02977adf731ed6139b70cac8e2f9593e2c04e76adbf2eec6
MD5 458f7c0c85aa00474a99486d74650b73
SHA1 e222f97c6ca1298d63cbb90d61e5afd25fbdd60f
SHA512 5b251f8284b38a00b9a5ee7b434af72ba604eec9c6656a32abf2d4474eb15cebcaf5f1de8a37cea30f112b5bebfdfdeb0433071a389cd3f11b0e1a7367b5a96d
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw8Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroK4/CFsrd
TLSH
T1C553F8834BEE9CF2F791113108798AB9927B99C4950EBEDFBB90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{EC203B24-4644-45b1-A2AD-478E1741DB7B}.exe

Path C:\Windows\{EC203B24-4644-45b1-A2AD-478E1741DB7B}.exe
Size 60KB
SHA256 23656518b2704228920ae2adc25da0efa622aa096d81c82f7bccdb21e7069be0
MD5 9cebcaaa890ad6606722ede31d07d6cf
SHA1 f2f59aedeae3d50bf6883c0cf2129b65a518af38
SHA512 fca2239b5398e72095e288b066ddce1615aeca631fa81e39b3e2e1ba6fafd2d401166c198fb045688b80e3468b2d8eaee2bcbd9b4b7430de9e3dad02c4c317a8
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw3Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroJ4/CFsrd
TLSH
T1355308834BEE9CF2F791113108798AB9927B99C4950EBEDFBB90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe

Path C:\Windows\{F5B9204C-FE43-4aa9-B973-307310642A2F}.exe
Size 60KB
SHA256 2b28134f72303873698a02967769204696cef87c0d9eb00ca99421982311b8fd
MD5 ada0ea5bca26e42f94e62a23b1d4507e
SHA1 08d575b78f85cf955d7bdfaf7a6b990531d6490d
SHA512 565a8a2b925b736d915ca75c1b31b7b470819e551ba898cd123fd3a70c5f3b1ce8a86bf3bd620dd9240a2b1894374b2305eca58de41fca0b50d99595d5342278
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw4Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrom4/CFsrd
TLSH
T14D53F8835BEE5CF2F691117108794BB9927B99C4950EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads