stormser | a698ef421e17edc9e9307d3293100044a27340fc8c4f5bcf65776bddca9fac4b

General

Target
2026-08-10_30e376e3aafe98765c84158ed3ca49d0_elex_wannacry.exe
Size 90KB
Sample260810-v397layzew
SHA256 a698ef421e17edc9e9307d3293100044a27340fc8c4f5bcf65776bddca9fac4b
MD5 30e376e3aafe98765c84158ed3ca49d0
SHA1 f6fd4fe455e757db22961fec105fcca87fa85117
SHA512 b2757fbe8e0d76828effbc44bd4471dbbc4971e10cccfdb89cb91756a09c4dfe5cc7b3213e1feeca3e106ecc757111c1283adbc1adb3b983072905c48cc1d5b7
SSDEEP 768:Qvw9816vhKQLror4/wQRNrfrunMxVFA3b7glw6:YEGh0orl2unMxVS3Hgl
TLSH
T14193C53D5DDA103BE2B7D6B585F126E3FE66B98336095D0E05D243428C23B53AD86C1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 6 IoCs

resource	yara_rule
behavioral1/files/0x000500000001e4ea-2.dat	family_stormser
behavioral1/files/0x00080000000243eb-6.dat	family_stormser
behavioral1/files/0x000f0000000243fd-10.dat	family_stormser
behavioral1/files/0x00080000000243fe-14.dat	family_stormser
behavioral1/files/0x0002000000021eb2-18.dat	family_stormser
behavioral1/files/0x0002000000021eb3-23.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87136EF5-656F-4c0e-A697-17B3D5920338}	{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{339C6600-0C4E-484a-849E-A9706BD165A4}	2026-08-10_30e376e3aafe98765c84158ed3ca49d0_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{339C6600-0C4E-484a-849E-A9706BD165A4}\stubpath = "C:\\Windows\\{339C6600-0C4E-484a-849E-A9706BD165A4}.exe"	2026-08-10_30e376e3aafe98765c84158ed3ca49d0_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75ECCE20-43AA-4ab2-97F1-CB4946640025}\stubpath = "C:\\Windows\\{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe"	{339C6600-0C4E-484a-849E-A9706BD165A4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}	{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{792381D0-AA90-4365-A059-4F3CBB7C95E3}\stubpath = "C:\\Windows\\{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe"	{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87136EF5-656F-4c0e-A697-17B3D5920338}\stubpath = "C:\\Windows\\{87136EF5-656F-4c0e-A697-17B3D5920338}.exe"	{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CA92846-A180-4ce7-8A96-C2DA553CEBDC}	{87136EF5-656F-4c0e-A697-17B3D5920338}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CA92846-A180-4ce7-8A96-C2DA553CEBDC}\stubpath = "C:\\Windows\\{7CA92846-A180-4ce7-8A96-C2DA553CEBDC}.exe"	{87136EF5-656F-4c0e-A697-17B3D5920338}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75ECCE20-43AA-4ab2-97F1-CB4946640025}	{339C6600-0C4E-484a-849E-A9706BD165A4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}\stubpath = "C:\\Windows\\{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe"	{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{792381D0-AA90-4365-A059-4F3CBB7C95E3}	{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe

Executes dropped EXE 6 IoCs

pid	Process
4336	{339C6600-0C4E-484a-849E-A9706BD165A4}.exe
4212	{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe
4920	{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe
4376	{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe
4312	{87136EF5-656F-4c0e-A697-17B3D5920338}.exe
4316	{7CA92846-A180-4ce7-8A96-C2DA553CEBDC}.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\{339C6600-0C4E-484a-849E-A9706BD165A4}.exe	2026-08-10_30e376e3aafe98765c84158ed3ca49d0_elex_wannacry.exe
File created	C:\Windows\{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe	{339C6600-0C4E-484a-849E-A9706BD165A4}.exe
File created	C:\Windows\{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe	{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe
File created	C:\Windows\{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe	{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe
File created	C:\Windows\{87136EF5-656F-4c0e-A697-17B3D5920338}.exe	{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe
File created	C:\Windows\{7CA92846-A180-4ce7-8A96-C2DA553CEBDC}.exe	{87136EF5-656F-4c0e-A697-17B3D5920338}.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1664	cmd.exe
4628	cmd.exe
3692	cmd.exe
3920	cmd.exe
3904	cmd.exe
2096	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{87136EF5-656F-4c0e-A697-17B3D5920338}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_30e376e3aafe98765c84158ed3ca49d0_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{339C6600-0C4E-484a-849E-A9706BD165A4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7CA92846-A180-4ce7-8A96-C2DA553CEBDC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4600	2026-08-10_30e376e3aafe98765c84158ed3ca49d0_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4336	{339C6600-0C4E-484a-849E-A9706BD165A4}.exe
Token: SeIncBasePriorityPrivilege	4212	{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe
Token: SeIncBasePriorityPrivilege	4920	{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe
Token: SeIncBasePriorityPrivilege	4376	{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe
Token: SeIncBasePriorityPrivilege	4312	{87136EF5-656F-4c0e-A697-17B3D5920338}.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4336	4600	2026-08-10_30e376e3aafe98765c84158ed3ca49d0_elex_wannacry.exe	87
PID 4600 wrote to memory of 4628	4600	2026-08-10_30e376e3aafe98765c84158ed3ca49d0_elex_wannacry.exe	88
PID 4336 wrote to memory of 4212	4336	{339C6600-0C4E-484a-849E-A9706BD165A4}.exe	93
PID 4336 wrote to memory of 3692	4336	{339C6600-0C4E-484a-849E-A9706BD165A4}.exe	94
PID 4212 wrote to memory of 4920	4212	{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe	101
PID 4212 wrote to memory of 3920	4212	{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe	102
PID 4920 wrote to memory of 4376	4920	{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe	103
PID 4920 wrote to memory of 3904	4920	{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe	104
PID 4376 wrote to memory of 4312	4376	{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe	105
PID 4376 wrote to memory of 2096	4376	{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe	106
PID 4312 wrote to memory of 4316	4312	{87136EF5-656F-4c0e-A697-17B3D5920338}.exe	107
PID 4312 wrote to memory of 1664	4312	{87136EF5-656F-4c0e-A697-17B3D5920338}.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_30e376e3aafe98765c84158ed3ca49d0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_30e376e3aafe98765c84158ed3ca49d0_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\{339C6600-0C4E-484a-849E-A9706BD165A4}.exe
  C:\Windows\{339C6600-0C4E-484a-849E-A9706BD165A4}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe
    C:\Windows\{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe
      C:\Windows\{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\Windows\{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe
        
        C:\Windows\{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4376
      - C:\Windows\{87136EF5-656F-4c0e-A697-17B3D5920338}.exe
        
        C:\Windows\{87136EF5-656F-4c0e-A697-17B3D5920338}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\{7CA92846-A180-4ce7-8A96-C2DA553CEBDC}.exe
        
        C:\Windows\{7CA92846-A180-4ce7-8A96-C2DA553CEBDC}.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{87136~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1664
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79238~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2096
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CE239~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{75ECC~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{339C6~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{339C6600-0C4E-484a-849E-A9706BD165A4}.exe

Path C:\Windows\{339C6600-0C4E-484a-849E-A9706BD165A4}.exe
Size 90KB
SHA256 578eefa9565cfc13d6512821de677a1d1268f77da0d8eb9630905136d56f7592
MD5 6970e2fd9208203a8f7032530917cd33
SHA1 183d6d42856f5c24c60c595d1809e2cac22b938e
SHA512 d6df1190810f6261211fca769e1cba4cc451e42c8519814c5db5e0cf7fa77188d92f1f7898ab290a8b7feaac89ee2c6634f23aba2ce265102673c559d45c98e2
SSDEEP 768:Qvw9816vhKQLroT4/wQRNrfrunMxVFA3b7glw6:YEGh0oTl2unMxVS3Hgl
TLSH
T13193C53D5DDA103BE2B7D6B585F125E3FE66B98336095D0E06D243428C23B53AD86C1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe

Path C:\Windows\{75ECCE20-43AA-4ab2-97F1-CB4946640025}.exe
Size 90KB
SHA256 2182d0f350e7e6ed33650a7850995fc302cf08c82fe56b16a6a868475289582e
MD5 eb546e33745f0716da751d9496d433ba
SHA1 2bd44f4414c81fa4837317825cb3246ae55b98a3
SHA512 a6e9d250e45453c63fe7246d89f00f063ca90775b38b1c984f4ac22e1a2f46a7f116513e1bafee4633bf5ded28d161a364a2ec70c995050f9951a8a3764f9b33
SSDEEP 768:Qvw9816vhKQLroq4/wQRNrfrunMxVFA3b7glw6:YEGh0oql2unMxVS3Hgl
TLSH
T14993C53D5DDA103BE2B7D6B585F126E3FE66B983360A5D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe

Path C:\Windows\{792381D0-AA90-4365-A059-4F3CBB7C95E3}.exe
Size 90KB
SHA256 17edd16da8493c0fcd56ac92d342ff46e3574a2de7cb66f8a19e68a617f13dc4
MD5 4f683e6e2aa2a9010af4c61daede6fe0
SHA1 ddde1090290154c6fa9e236f8276cf1ea31f65af
SHA512 1f95604d5dd574c13bf4e27e115078aa5edddf90b559547a5eb594adeaf9f78e549a840931fe9010d62bf47f06302e60b48a5dd44a5b3b4f961db6649c81718d
SSDEEP 768:Qvw9816vhKQLrou4/wQRNrfrunMxVFA3b7glw6:YEGh0oul2unMxVS3Hgl
TLSH
T12893C53D5DDA103BE2B7D6B585F126E3FE66B983360A5D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7CA92846-A180-4ce7-8A96-C2DA553CEBDC}.exe

Path C:\Windows\{7CA92846-A180-4ce7-8A96-C2DA553CEBDC}.exe
Size 90KB
SHA256 09ba8393a627b985eb8204dfa6294bdca7b269e1a554b90719ccc3b1e9474a02
MD5 6c63aefc62d4b99db9d0bb74d72d2ced
SHA1 4558071064c5b0e99dd2cef722f4a1a9b2d0452c
SHA512 ee4abe999104793266b918c9f15456e352814ded8e9b0852c7d81d3137cc83d84f835bc839284b1df823d1d848c60e9f84bd7e90dbc7ea220425b5cb0063c96a
SSDEEP 768:Qvw9816vhKQLrowC4/wQRNrfrunMxVFA3b7glw6:YEGh0onl2unMxVS3Hgl
TLSH
T18493C53D5DDA103BE2B7D6B585F126E3FE66B9833A095D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{87136EF5-656F-4c0e-A697-17B3D5920338}.exe

Path C:\Windows\{87136EF5-656F-4c0e-A697-17B3D5920338}.exe
Size 90KB
SHA256 11eedad5fa9d9cee80ba6de7a9e07bcfd249be6a610f023e02523371df666d48
MD5 12c27900b7cee60fb01b26e8f48b8ed9
SHA1 660bea5404dbffb6cc79ff39706d789b5d47c8f0
SHA512 aea29fc7a3e6124589f2370870856a6d368acfa50d23bc9ca1b0fedd72fd296166a401f6f6dc97a47b3bc064cc885787fa14d6161064612c5ee8ab32edc134e9
SSDEEP 768:Qvw9816vhKQLroi4/wQRNrfrunMxVFA3b7glw6:YEGh0oil2unMxVS3Hgl
TLSH
T16293C53D5DDA103BE2B7D6B585F126E3FE66B983360A5D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe

Path C:\Windows\{CE239E76-AE36-458b-BDCB-EF5A913B8CE1}.exe
Size 90KB
SHA256 b529f921d3c75bed371216b811ead358e5369e7aa592f774c2b9fd0c6d608327
MD5 58d802a44d76e6e8d8eba22d3c10ce72
SHA1 9b04c045ecd3220508e9098b1571f1388bd5b93c
SHA512 38c159b9f6d9e60eee6c8193fb65d63843f395a7075e141f71ef4dd9acd7dd9baf0d28d83a80071c0dd2d3f4d7e3db6e79c1f0d2ebce89af6939cea045a7cc3b
SSDEEP 768:Qvw9816vhKQLro+4/wQRNrfrunMxVFA3b7glw6:YEGh0o+l2unMxVS3Hgl
TLSH
T18393C53D5DDA103BE2B7D6B585F126E3FE66B98336095D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads