stormser | 424a05242875410e182d8e886bd1f11c15abf7a0533fd175eccb47f4e65a3f9e

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_ed8f7aa4288044d7ad40839d4df3b5b3_elex_wannacry.exe
Size 79KB
Sample261027-dmv93ace75
SHA256 424a05242875410e182d8e886bd1f11c15abf7a0533fd175eccb47f4e65a3f9e
MD5 ed8f7aa4288044d7ad40839d4df3b5b3
SHA1 0c71e1e5748f0b783e0add70372ebdd18173343a
SHA512 9be2f8451cd294fd6c7111441f741911f4f022e66f6f0d387bd7f58549ae4af942e8b466d762bd6d2359e66ea91187ac07a1c9e2d6a118b37b7b4c65e4531965
SSDEEP 768:4vw9816vhKQLro144/wQzXOQ69zbjlAAX5e9zz:wEGh0o6lGizbR9Xwzz
TLSH
T1F6835CD38EAC4483FDD6697012B8D9A77C3E97C61604B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243e4-2.dat	family_stormser
behavioral1/files/0x00080000000243d4-5.dat	family_stormser
behavioral1/files/0x00080000000243ec-10.dat	family_stormser
behavioral1/files/0x00030000000006d5-14.dat	family_stormser
behavioral1/files/0x0004000000000703-18.dat	family_stormser
behavioral1/files/0x00040000000006d5-22.dat	family_stormser
behavioral1/files/0x00050000000006f1-26.dat	family_stormser
behavioral1/files/0x00050000000006d5-30.dat	family_stormser
behavioral1/files/0x00060000000006f1-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0854D463-2126-4f64-A283-1E8BBF5F8B6A}	{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3E9D803-0DA7-488e-BF54-22FFC089FACA}	{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}	{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}\stubpath = "C:\\Windows\\{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe"	{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{14535B62-B8EA-45c6-B39D-DCC5D948657B}	{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}	2026-10-26_ed8f7aa4288044d7ad40839d4df3b5b3_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}	{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}\stubpath = "C:\\Windows\\{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe"	{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF635538-CC09-4c26-8D13-9969A9668C85}	{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF635538-CC09-4c26-8D13-9969A9668C85}\stubpath = "C:\\Windows\\{AF635538-CC09-4c26-8D13-9969A9668C85}.exe"	{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{14535B62-B8EA-45c6-B39D-DCC5D948657B}\stubpath = "C:\\Windows\\{14535B62-B8EA-45c6-B39D-DCC5D948657B}.exe"	{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0854D463-2126-4f64-A283-1E8BBF5F8B6A}\stubpath = "C:\\Windows\\{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe"	{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36E94945-F46D-4bb8-BF17-EE17C4A344AD}	{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3E9D803-0DA7-488e-BF54-22FFC089FACA}\stubpath = "C:\\Windows\\{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe"	{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA482AA2-7F2E-4393-98F2-4C2561D5898D}	{AF635538-CC09-4c26-8D13-9969A9668C85}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA482AA2-7F2E-4393-98F2-4C2561D5898D}\stubpath = "C:\\Windows\\{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe"	{AF635538-CC09-4c26-8D13-9969A9668C85}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}\stubpath = "C:\\Windows\\{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe"	2026-10-26_ed8f7aa4288044d7ad40839d4df3b5b3_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36E94945-F46D-4bb8-BF17-EE17C4A344AD}\stubpath = "C:\\Windows\\{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe"	{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe

Executes dropped EXE 9 IoCs

pid	Process
4320	{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe
2724	{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe
5116	{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe
1608	{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe
3364	{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe
4664	{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe
4972	{AF635538-CC09-4c26-8D13-9969A9668C85}.exe
1744	{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe
3980	{14535B62-B8EA-45c6-B39D-DCC5D948657B}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe	{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe
File created	C:\Windows\{AF635538-CC09-4c26-8D13-9969A9668C85}.exe	{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe
File created	C:\Windows\{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe	{AF635538-CC09-4c26-8D13-9969A9668C85}.exe
File created	C:\Windows\{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe	2026-10-26_ed8f7aa4288044d7ad40839d4df3b5b3_elex_wannacry.exe
File created	C:\Windows\{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe	{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe
File created	C:\Windows\{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe	{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe
File created	C:\Windows\{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe	{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe
File created	C:\Windows\{14535B62-B8EA-45c6-B39D-DCC5D948657B}.exe	{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe
File created	C:\Windows\{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe	{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
808	cmd.exe
1924	cmd.exe
3832	cmd.exe
1872	cmd.exe
3224	cmd.exe
4200	cmd.exe
4680	cmd.exe
4296	cmd.exe
3388	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_ed8f7aa4288044d7ad40839d4df3b5b3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{14535B62-B8EA-45c6-B39D-DCC5D948657B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AF635538-CC09-4c26-8D13-9969A9668C85}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1504	2026-10-26_ed8f7aa4288044d7ad40839d4df3b5b3_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4320	{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe
Token: SeIncBasePriorityPrivilege	2724	{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe
Token: SeIncBasePriorityPrivilege	5116	{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe
Token: SeIncBasePriorityPrivilege	1608	{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe
Token: SeIncBasePriorityPrivilege	3364	{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe
Token: SeIncBasePriorityPrivilege	4664	{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe
Token: SeIncBasePriorityPrivilege	4972	{AF635538-CC09-4c26-8D13-9969A9668C85}.exe
Token: SeIncBasePriorityPrivilege	1744	{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4320	1504	2026-10-26_ed8f7aa4288044d7ad40839d4df3b5b3_elex_wannacry.exe	91
PID 1504 wrote to memory of 1924	1504	2026-10-26_ed8f7aa4288044d7ad40839d4df3b5b3_elex_wannacry.exe	92
PID 4320 wrote to memory of 2724	4320	{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe	93
PID 4320 wrote to memory of 4680	4320	{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe	94
PID 2724 wrote to memory of 5116	2724	{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe	97
PID 2724 wrote to memory of 3832	2724	{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe	98
PID 5116 wrote to memory of 1608	5116	{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe	99
PID 5116 wrote to memory of 4296	5116	{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe	100
PID 1608 wrote to memory of 3364	1608	{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe	101
PID 1608 wrote to memory of 1872	1608	{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe	102
PID 3364 wrote to memory of 4664	3364	{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe	103
PID 3364 wrote to memory of 3388	3364	{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe	104
PID 4664 wrote to memory of 4972	4664	{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe	105
PID 4664 wrote to memory of 3224	4664	{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe	106
PID 4972 wrote to memory of 1744	4972	{AF635538-CC09-4c26-8D13-9969A9668C85}.exe	107
PID 4972 wrote to memory of 808	4972	{AF635538-CC09-4c26-8D13-9969A9668C85}.exe	108
PID 1744 wrote to memory of 3980	1744	{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe	109
PID 1744 wrote to memory of 4200	1744	{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-26_ed8f7aa4288044d7ad40839d4df3b5b3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_ed8f7aa4288044d7ad40839d4df3b5b3_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe
  C:\Windows\{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe
    C:\Windows\{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe
      C:\Windows\{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\Windows\{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe
        
        C:\Windows\{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1608
      - C:\Windows\{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe
        
        C:\Windows\{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe
        
        C:\Windows\{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\{AF635538-CC09-4c26-8D13-9969A9668C85}.exe
        
        C:\Windows\{AF635538-CC09-4c26-8D13-9969A9668C85}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe
        
        C:\Windows\{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\{14535B62-B8EA-45c6-B39D-DCC5D948657B}.exe
        
        C:\Windows\{14535B62-B8EA-45c6-B39D-DCC5D948657B}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA482~1.EXE > nul
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AF635~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A1A1D~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D3E9D~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3388
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7915F~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1872
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{36E94~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4296
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{0854D~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{3B708~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe

Path C:\Windows\{0854D463-2126-4f64-A283-1E8BBF5F8B6A}.exe
Size 79KB
SHA256 8ffb66e1868108cc39740245e491f5f69bb0230cbb6a9a079eff8d97025fdcb5
MD5 db3d52248b80c1d726700b21db83e97b
SHA1 c485cbe7fca43c712cc2796f2acc6f177060419d
SHA512 ac8c18c40603cd7e06d2178c80a534c8df6061d046c65833fe44a9f0f075267be995a078f569b0f7261077e0fe019d5b617bca627a6897971c00b1525f1d82bc
SSDEEP 768:4vw9816vhKQLrob4/wQzXOQ69zbjlAAX5e9zz:wEGh0oblGizbR9Xwzz
TLSH
T134835CD38EAC4483FDE6697012B8D9A77C3E97C61604B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{14535B62-B8EA-45c6-B39D-DCC5D948657B}.exe

Path C:\Windows\{14535B62-B8EA-45c6-B39D-DCC5D948657B}.exe
Size 79KB
SHA256 7f0701d09b84e6174066d8ea5ba8ac4770578699310e2abca62d108825c553b6
MD5 6204f1860fafcd80231ae17eb9b462d4
SHA1 a40d63d7bddd552d5897154d36a09d3682cfe3e1
SHA512 f0419d082c36ee7b20a912a18a5296a0ed6e43a938d623eb9e2b19ca6ef2f535b26165d6dea2e351ac817b4a5eeb0f8b66c5974548ddac3f9b9730ca413b7ad2
SSDEEP 768:4vw9816vhKQLroq4/wQzXOQ69zbjlAAX5e9zz:wEGh0oqlGizbR9Xwzz
TLSH
T19F835CC38EAC4483FDD6697012B8D9A77C3E97C61604799B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe

Path C:\Windows\{36E94945-F46D-4bb8-BF17-EE17C4A344AD}.exe
Size 79KB
SHA256 ffc2a9b30428193345a3e5801089f48b09e03748b6dcc5479d923f07c9e813e3
MD5 d3cda8e49eaee4b5bc98da172c7dc9f3
SHA1 ad19f7b927a9281f77de6d95030095ec6fa2109e
SHA512 6bf7f16afc35e011bdc892be088d95299d281dc82746655e26e22f12b695047882428514d213038164578da153a39950418b09812b9fe08f7c72518c187e0e78
SSDEEP 768:4vw9816vhKQLrof4/wQzXOQ69zbjlAAX5e9zz:wEGh0oflGizbR9Xwzz
TLSH
T136835CD38EAC4483FDE6697012B8D9A77C3E97C61604B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe

Path C:\Windows\{3B7088E9-B17D-476e-9D7A-C9A34DE26EBB}.exe
Size 79KB
SHA256 c1efa28f808be25a0aa671003bc1cbac00bddca5ae3e81633b3c3b6b5c5ebc30
MD5 afed88de3bc1792cd7237c5f4e0fa9d2
SHA1 0983f8bdfd87288b1eef9a1eb61953f6ad2efb77
SHA512 7f33aa6af52e9d9f9cb7b9af58725d03a6738003802100134c32ec9fba206e8e65d9672ab2edb2062d75154f64b00543d06df316f95e3b358dbabf11f4881999
SSDEEP 768:4vw9816vhKQLrov4/wQzXOQ69zbjlAAX5e9zz:wEGh0ovlGizbR9Xwzz
TLSH
T1DC835CC38EAC4483FDE6697012B8D9A77C3E97C61604B99B6B95FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe

Path C:\Windows\{7915FC91-4554-49fa-ABE2-F6DB3D1951F5}.exe
Size 79KB
SHA256 cd177a8addddc62669140cf90a10524e786b7cc5e826eda10955b98651373ba7
MD5 9f9f5730239cf0698071b1ddc7d99252
SHA1 e4458107bff9c112fea889e49e199a5999af833f
SHA512 72eb86bf38a5cd71392da0516b12963f0434690fdc3b12783ac0892252aa3da460e98fbf363ba55aff1d9ba26ca5420669805f2684b112ab8b40aa809a389158
SSDEEP 768:4vw9816vhKQLro74/wQzXOQ69zbjlAAX5e9zz:wEGh0o7lGizbR9Xwzz
TLSH
T12A835CD38EAC4483FDD6697012B8D9A77C3E97C61504B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe

Path C:\Windows\{A1A1D03F-9650-4281-B8DA-ADAFE52E53BC}.exe
Size 79KB
SHA256 204c0f5ed21158c2ad6f326b85a036a77125a6862d64aa4b3a62ecb0c3446de4
MD5 812d593c424f95b6f29614f1582dfd96
SHA1 a9d9c86c36a596a8a472b8836f0be9c70d5e837e
SHA512 2bb2604a77cb411c087365c324c7fe099b79fab7e4c5979426a2ac1f0474784592348bf87b0ef09195a6e3371b7cedeb5bff3d1d6fd63dd854ad8e2c529876d3
SSDEEP 768:4vw9816vhKQLroz4/wQzXOQ69zbjlAAX5e9zz:wEGh0ozlGizbR9Xwzz
TLSH
T1CC835CC38EAC4483FDE6697012B8D9A77C3E97C61504799B6B95FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{AF635538-CC09-4c26-8D13-9969A9668C85}.exe

Path C:\Windows\{AF635538-CC09-4c26-8D13-9969A9668C85}.exe
Size 79KB
SHA256 f9fb48309e6954bcbce896dee1e6096c0bd82386b0cd17a35c8c0e2e10441eb8
MD5 aaf08cd45345db88d5ad91c15ce5b4a7
SHA1 6302d43f3bc539f837f0ddfcf4f467b1ed6a1a10
SHA512 c429fa9d3047d5e71ec23f084b6acb284f2a1c7e73a7b6c180213a95fa5a7cecea3d3d297ff5e760ed57ab3316e3e6db3496b76da3e9a379e3fe091b3d29bdc6
SSDEEP 768:4vw9816vhKQLroe4/wQzXOQ69zbjlAAX5e9zz:wEGh0oelGizbR9Xwzz
TLSH
T127835CD38EAC4483FDD6697012B8D9A77C3E97C61504B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe

Path C:\Windows\{D3E9D803-0DA7-488e-BF54-22FFC089FACA}.exe
Size 79KB
SHA256 be6e3c7bc603933477bcc034358323305e237cba649ccbe18521f181b7008919
MD5 77462e2f468f88094c08cea3f5b6ebde
SHA1 df5cb6b11881b8839881e1fd17bdc3d5f8ed4e36
SHA512 8cfa381ad6499e52b8c0b5826be906913e88d6cb7aa108ec59834ac86507a13409f97111e1d0009a681b4c1f58f04ad8483590f57a0846c0d083460ab2a24030
SSDEEP 768:4vw9816vhKQLroj4/wQzXOQ69zbjlAAX5e9zz:wEGh0ojlGizbR9Xwzz
TLSH
T1C0835CD38EAC4483FDD6697012B8D9A77C3E97C61504B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe

Path C:\Windows\{FA482AA2-7F2E-4393-98F2-4C2561D5898D}.exe
Size 79KB
SHA256 e4c2e6bd9db4eb5f18d780dbed86d3a8cca60d1bc95b4772ea74772428545fef
MD5 4d75e9c2835ae3d8e784e2b08e535428
SHA1 7f5bd6e7a450d53ef1741bec2c4c1db1a002536a
SHA512 3e4438566197b665e4cd3e089559b45ccd1e0d95cfe0a56252f68abad9f7dbd0195487c44db0b0249970728d2c24fc3cb5a6abb2651c5be0d23aacb8f63cc3e2
SSDEEP 768:4vw9816vhKQLro64/wQzXOQ69zbjlAAX5e9zz:wEGh0o6lGizbR9Xwzz
TLSH
T1DA835CD38EAC4483FDD6697012B8DAA77C3E97C61504B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads