stormser | c2dd89718e254d5e69a394389875067b279eb8f3b1c9b5cbb7cede31b51faad8

General

Target
2026-10-22_fbc40cba841229bd10891faf267759ad_elex_goldeneye_wannacry.exe
Size 168KB
Sample261023-azew3agy8s
SHA256 c2dd89718e254d5e69a394389875067b279eb8f3b1c9b5cbb7cede31b51faad8
MD5 fbc40cba841229bd10891faf267759ad
SHA1 db5b52951b5332029713ab35f58d495bb1744c65
SHA512 0051e8523052c0ca44e6f4611b29a0cdeb99843b198b6ce71ddea30b775209561eac44980dc79535221d3eff7623d1e743c239fb6945a0ad54c4da26db9702a7
SSDEEP 1536:1EGh0orli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0orliOPOe2MUVg3Ve+rX
TLSH
T108F36B666B93E8E1D0D302340E65C5129A33FEE441B2962339D8C19DCDD59B0DEBE72E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 8 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243c4-2.dat	family_stormser
behavioral1/files/0x00080000000243b4-6.dat	family_stormser
behavioral1/files/0x00080000000243cc-10.dat	family_stormser
behavioral1/files/0x00090000000243b4-14.dat	family_stormser
behavioral1/files/0x0002000000021d2b-18.dat	family_stormser
behavioral1/files/0x0002000000021d2c-22.dat	family_stormser
behavioral1/files/0x00050000000006d3-27.dat	family_stormser
behavioral1/files/0x00030000000006d5-30.dat	family_stormser

Custom signature

Auto-generated rule 8 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243c4-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00080000000243b4-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00080000000243cc-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000243b4-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0002000000021d2b-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0002000000021d2c-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00050000000006d3-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00030000000006d5-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 16 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}	2026-10-22_fbc40cba841229bd10891faf267759ad_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}	{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}\stubpath = "C:\\Windows\\{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe"	{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}	{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}\stubpath = "C:\\Windows\\{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe"	{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}	{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}\stubpath = "C:\\Windows\\{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe"	2026-10-22_fbc40cba841229bd10891faf267759ad_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D76D564-1DB5-4f0b-9041-C6F7128653E1}	{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D76D564-1DB5-4f0b-9041-C6F7128653E1}\stubpath = "C:\\Windows\\{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe"	{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4D5CEE9-B428-46a2-AB84-A478A536F47F}	{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4D5CEE9-B428-46a2-AB84-A478A536F47F}\stubpath = "C:\\Windows\\{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe"	{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CFD061F-F7C1-4691-9BAF-B110854ED10E}	{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CFD061F-F7C1-4691-9BAF-B110854ED10E}\stubpath = "C:\\Windows\\{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe"	{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A82BDD97-3D68-4a53-B2FE-D7B1AB9A7A8E}	{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A82BDD97-3D68-4a53-B2FE-D7B1AB9A7A8E}\stubpath = "C:\\Windows\\{A82BDD97-3D68-4a53-B2FE-D7B1AB9A7A8E}.exe"	{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}\stubpath = "C:\\Windows\\{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe"	{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe

Executes dropped EXE 8 IoCs

pid	Process
4400	{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe
3200	{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe
4052	{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe
1636	{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe
4204	{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe
884	{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe
4332	{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe
4148	{A82BDD97-3D68-4a53-B2FE-D7B1AB9A7A8E}.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe	{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe
File created	C:\Windows\{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe	{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe
File created	C:\Windows\{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe	{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe
File created	C:\Windows\{A82BDD97-3D68-4a53-B2FE-D7B1AB9A7A8E}.exe	{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe
File created	C:\Windows\{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe	2026-10-22_fbc40cba841229bd10891faf267759ad_elex_goldeneye_wannacry.exe
File created	C:\Windows\{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe	{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe
File created	C:\Windows\{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe	{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe
File created	C:\Windows\{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe	{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2968	cmd.exe
4060	cmd.exe
2680	cmd.exe
828	cmd.exe
1680	cmd.exe
2416	cmd.exe
3744	cmd.exe
4776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A82BDD97-3D68-4a53-B2FE-D7B1AB9A7A8E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_fbc40cba841229bd10891faf267759ad_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	368	2026-10-22_fbc40cba841229bd10891faf267759ad_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	4400	{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe
Token: SeIncBasePriorityPrivilege	3200	{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe
Token: SeIncBasePriorityPrivilege	4052	{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe
Token: SeIncBasePriorityPrivilege	1636	{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe
Token: SeIncBasePriorityPrivilege	4204	{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe
Token: SeIncBasePriorityPrivilege	884	{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe
Token: SeIncBasePriorityPrivilege	4332	{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4400	368	2026-10-22_fbc40cba841229bd10891faf267759ad_elex_goldeneye_wannacry.exe	93
PID 368 wrote to memory of 4776	368	2026-10-22_fbc40cba841229bd10891faf267759ad_elex_goldeneye_wannacry.exe	94
PID 4400 wrote to memory of 3200	4400	{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe	95
PID 4400 wrote to memory of 2968	4400	{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe	96
PID 3200 wrote to memory of 4052	3200	{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe	99
PID 3200 wrote to memory of 4060	3200	{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe	100
PID 4052 wrote to memory of 1636	4052	{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe	101
PID 4052 wrote to memory of 2680	4052	{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe	102
PID 1636 wrote to memory of 4204	1636	{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe	103
PID 1636 wrote to memory of 828	1636	{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe	104
PID 4204 wrote to memory of 884	4204	{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe	105
PID 4204 wrote to memory of 1680	4204	{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe	106
PID 884 wrote to memory of 4332	884	{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe	107
PID 884 wrote to memory of 2416	884	{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe	108
PID 4332 wrote to memory of 4148	4332	{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe	109
PID 4332 wrote to memory of 3744	4332	{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-22_fbc40cba841229bd10891faf267759ad_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_fbc40cba841229bd10891faf267759ad_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe
  C:\Windows\{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe
    C:\Windows\{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe
      C:\Windows\{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Windows\{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe
        
        C:\Windows\{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1636
      - C:\Windows\{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe
        
        C:\Windows\{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe
        
        C:\Windows\{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:884
        
        C:\Windows\{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe
        
        C:\Windows\{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\{A82BDD97-3D68-4a53-B2FE-D7B1AB9A7A8E}.exe
        
        C:\Windows\{A82BDD97-3D68-4a53-B2FE-D7B1AB9A7A8E}.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A4D5C~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6D76D~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A19D7~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1680
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2CFD0~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:828
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{65F1B~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{6534E~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{88629~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe

Path C:\Windows\{2CFD061F-F7C1-4691-9BAF-B110854ED10E}.exe
Size 168KB
SHA256 ef6cef8ddee4c0e503cb516ccd7e779dbee9bd8e09ea2ae898e7747c1dddc6d6
MD5 26d653d48ba301c9aba55b012ec4379d
SHA1 7c1965620630c6d948ad5494a25b97031ce128ee
SHA512 0d5bb1fd225927d986c775d765da9c34d2cd08bd974b7b928b740531b985596bbd8f7789e19bff1f3c2992f2b89606676dab67e371838304677296f3f4373a4b
SSDEEP 1536:1EGh0o7li5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o7liOPOe2MUVg3Ve+rX
TLSH
T17BF36B666B93E8E1D0D302340E65C5129A33FEE441B2962339D8C19DCDD59B0DE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe

Path C:\Windows\{6534E837-3994-46ec-8DBE-7AB4EBA0F78F}.exe
Size 168KB
SHA256 03003d6969d09c413cba190cf61ae12ee9a05f6c2e3353990e7e49b9d8877195
MD5 ce05f30a8d3beddd4310dd4b3f73b6cb
SHA1 5bfe0c735bf98d4d5f0f84f815ffd94947aa1f34
SHA512 61d14183cd34eacbab2c777d488cd42914ae12612ec7c426be224efa6204c08a1df1b4d9c35d8e587e3c202ea40d81e56a3e84d190f3a7e7f40a4dd8675859c7
SSDEEP 1536:1EGh0oKli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oKliOPOe2MUVg3Ve+rX
TLSH
T153F36B666B93E8E1D0D302340E65C5129A33FEE441B2962339D8C19DCDD59B0DEBE72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe

Path C:\Windows\{65F1B3B3-BF13-4fbf-BC55-78651A8BB96A}.exe
Size 168KB
SHA256 325fad5cf832446be562d0c5db92756d381d6988335cab4c485ba31f9e7757e0
MD5 815ca5e4a040d4d505d66addbb81697e
SHA1 a77e67fb8908e711d65342c488a3f51ab4f819c9
SHA512 ba4aacf865a9590fb00bdfb7faa8cfcb4a72a4fca9490d5d91a86b5b65889c00585fd03e66bcf65234c2578ee350f4962b48a09866ed7c18b6725d391e791c66
SSDEEP 1536:1EGh0o5li5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o5liOPOe2MUVg3Ve+rX
TLSH
T145F36B666B93E8E1D0D302340E65C5129A33FEE441B2962239DCC19DCDD59B0DEBE72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe

Path C:\Windows\{6D76D564-1DB5-4f0b-9041-C6F7128653E1}.exe
Size 168KB
SHA256 dbd25a5078db5fcc257e3a4e63210013d9798c045fe352f1fa5bf262cf6aa74b
MD5 6fe75053e4b05b230fa978683c81db11
SHA1 514a07069f6386ad6691486c58ea858d7fc9def8
SHA512 9eb96c3074114f4e28c461353bef78f94eda407f1790abcf659e3f16783f963a6d13207c735533da4c46306d0d052217ee5c6f6088767e8cadd1d88b67c3a4bb
SSDEEP 1536:1EGh0orli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0orliOPOe2MUVg3Ve+rX
TLSH
T1A8F36B666B93E8E1D0D302340F65C5129A33FEE441B2962239D8C19DCDD59B0DEBE72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe

Path C:\Windows\{88629F8E-E16E-4e2a-896A-F4ECD5370ED1}.exe
Size 168KB
SHA256 79c2e83163860364d920e559ebd5254f4cc86e6f192bc5fd10436d09e6e4339f
MD5 d2466e9e2bbb4d6b7e86598faf45a561
SHA1 945d858f677310df26d92e7310166948781d8371
SHA512 5077c417d5b380ef3691b9ac2fca3d6ff6c09066b7075dbb46b02f82f89fd636bd417edbd3eb124fb681f6a21add125daa90262c9c8cba818a845e081f89f7b3
SSDEEP 1536:1EGh0ouli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ouliOPOe2MUVg3Ve+rX
TLSH
T1DDF36B666B93E8E1D0D302340F64C5129A33FEE441B2962239D8C19DCDD59B0DEBE72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe

Path C:\Windows\{A19D7F83-C764-4f43-A29E-6A253C1DDA3C}.exe
Size 168KB
SHA256 634ab3cf20e268bb3216bd1959e5dbde7b53643ca77f3b44a17954ce5c9ed7f0
MD5 a40b418b7b7a73728ed5e48b79828f89
SHA1 d69b818c7a59ac520da2053da0e0c6e8bd1c45e6
SHA512 423a6f7a14be8eab79d13dc86f2cca1a97930d652b69a40b020a8ee263f4feb65e62ab59beac51d284b09421015591ddcd3a8ead8d9858c271a22f819681fb84
SSDEEP 1536:1EGh0o7li5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o7liOPOe2MUVg3Ve+rX
TLSH
T123F36B666B93E8E1D0D302340E65C5129A33FEE441B2962239D8C19DCDD59B0DEBE72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe

Path C:\Windows\{A4D5CEE9-B428-46a2-AB84-A478A536F47F}.exe
Size 168KB
SHA256 6e156b8c5aec6b03bad9bfddab2d20cc96bf6b96320303278b1b145ae1a8dc1a
MD5 acfc8d50736d6c69869260d69b827bb3
SHA1 42565e44472f71c8064526e4206464dfd840d856
SHA512 2a0fc5e2c721717ed20e5cfe453126667c0f2abc68479c1368ef96cf1e02f15540126d4ab67bdca7c23f6e0c5dd8c34d25f64210085770a799c2e3851eae5710
SSDEEP 1536:1EGh0o+li5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o+liOPOe2MUVg3Ve+rX
TLSH
T1EBF36B666B93E8E1D0D302340E65C5129A33FEE441B2962339D8C19DCDD59B0DEBE72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A82BDD97-3D68-4a53-B2FE-D7B1AB9A7A8E}.exe

Path C:\Windows\{A82BDD97-3D68-4a53-B2FE-D7B1AB9A7A8E}.exe
Size 168KB
SHA256 33684429f0ede5d5f7d884a88c6649c91c44aec90e4367089bacd67975fc4789
MD5 9f90811d5c089cf1efd29b474c5cf782
SHA1 8d0508628205dc48bd1b0ef3acde9e6c0f55ed4a
SHA512 b85f2f2b306ac1a3f3586914bbcb553fa0c0b0a2ae45fe561a4fa5661d4f955d095589eece0d56daf13c6f9e438780a57a7235cdb82a55cbe053dfa10ed42bda
SSDEEP 1536:1EGh0oAli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oAliOPOe2MUVg3Ve+rX
TLSH
T14BF36B666B93E8E1D0D302340E65C5129A33FEE441B2962339D8C19DCDD59B0DEBE72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads