721b5254f8e4276b3bfa5d8e10646dac9c63b2f12bab50cd8fc3013d735e4325

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_c5e5bb1eb304a9214b5cc0b95d95582d_elex_wannacry.exe
Size 60KB
Sample261029-xpl9qacb83
SHA256 721b5254f8e4276b3bfa5d8e10646dac9c63b2f12bab50cd8fc3013d735e4325
MD5 c5e5bb1eb304a9214b5cc0b95d95582d
SHA1 61a5579052a410124a2d738481cc184d233b8ed8
SHA512 d607a57fa688aae19a36faad0bb8d2cc43f9916fb970ccebe92856cb2c4cade60700a61d7e73237a3164b4bdc477d62428e4fc6146b750c383bc6890a0051114
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroPe4/Clsrul:vvw9816vhKQLroPe4/QQ
TLSH
T1AF5319835BEE5CF2F7911231087C8BB9927B99D4950EBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5952	wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe
3300	w5CC58771f5C6Cv46c129C2783A1810585899l.exe
5648	w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe
4632	w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe
2652	w79BA9761f658Cv4a332A44782A7211CC756Fl.exe
1076	wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe
2748	wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe
2272	w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe
4512	w8979EDC1fA73Cv46142BAF484D3F05031334l.exe
4908	wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe
2336	w94A6B744f40B8v4f962AA1988869732D4298l.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\w94A6B744f40B8v4f962AA1988869732D4298l.exe	wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe
File created	C:\Windows\wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe	2026-10-28_c5e5bb1eb304a9214b5cc0b95d95582d_elex_wannacry.exe
File created	C:\Windows\w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe	w5CC58771f5C6Cv46c129C2783A1810585899l.exe
File created	C:\Windows\w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe	w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe
File created	C:\Windows\wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe	w79BA9761f658Cv4a332A44782A7211CC756Fl.exe
File created	C:\Windows\wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe	w8979EDC1fA73Cv46142BAF484D3F05031334l.exe
File created	C:\Windows\w5CC58771f5C6Cv46c129C2783A1810585899l.exe	wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe
File created	C:\Windows\w79BA9761f658Cv4a332A44782A7211CC756Fl.exe	w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe
File created	C:\Windows\wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe	wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe
File created	C:\Windows\w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe	wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe
File created	C:\Windows\w8979EDC1fA73Cv46142BAF484D3F05031334l.exe	w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5816	cmd.exe
1220	cmd.exe
4488	cmd.exe
3048	cmd.exe
4552	cmd.exe
5744	cmd.exe
3968	cmd.exe
1480	cmd.exe
4328	cmd.exe
2160	cmd.exe
2528	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w5CC58771f5C6Cv46c129C2783A1810585899l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w94A6B744f40B8v4f962AA1988869732D4298l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w79BA9761f658Cv4a332A44782A7211CC756Fl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w8979EDC1fA73Cv46142BAF484D3F05031334l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_c5e5bb1eb304a9214b5cc0b95d95582d_elex_wannacry.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2408	2026-10-28_c5e5bb1eb304a9214b5cc0b95d95582d_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	5952	wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe
Token: SeIncBasePriorityPrivilege	3300	w5CC58771f5C6Cv46c129C2783A1810585899l.exe
Token: SeIncBasePriorityPrivilege	5648	w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe
Token: SeIncBasePriorityPrivilege	4632	w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe
Token: SeIncBasePriorityPrivilege	2652	w79BA9761f658Cv4a332A44782A7211CC756Fl.exe
Token: SeIncBasePriorityPrivilege	1076	wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe
Token: SeIncBasePriorityPrivilege	2748	wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe
Token: SeIncBasePriorityPrivilege	2272	w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe
Token: SeIncBasePriorityPrivilege	4512	w8979EDC1fA73Cv46142BAF484D3F05031334l.exe
Token: SeIncBasePriorityPrivilege	4908	wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 5952	2408	2026-10-28_c5e5bb1eb304a9214b5cc0b95d95582d_elex_wannacry.exe	90
PID 2408 wrote to memory of 2160	2408	2026-10-28_c5e5bb1eb304a9214b5cc0b95d95582d_elex_wannacry.exe	91
PID 5952 wrote to memory of 3300	5952	wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe	92
PID 5952 wrote to memory of 4552	5952	wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe	93
PID 3300 wrote to memory of 5648	3300	w5CC58771f5C6Cv46c129C2783A1810585899l.exe	95
PID 3300 wrote to memory of 2528	3300	w5CC58771f5C6Cv46c129C2783A1810585899l.exe	96
PID 5648 wrote to memory of 4632	5648	w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe	97
PID 5648 wrote to memory of 5744	5648	w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe	98
PID 4632 wrote to memory of 2652	4632	w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe	99
PID 4632 wrote to memory of 5816	4632	w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe	100
PID 2652 wrote to memory of 1076	2652	w79BA9761f658Cv4a332A44782A7211CC756Fl.exe	101
PID 2652 wrote to memory of 1220	2652	w79BA9761f658Cv4a332A44782A7211CC756Fl.exe	102
PID 1076 wrote to memory of 2748	1076	wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe	103
PID 1076 wrote to memory of 3968	1076	wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe	104
PID 2748 wrote to memory of 2272	2748	wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe	105
PID 2748 wrote to memory of 1480	2748	wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe	106
PID 2272 wrote to memory of 4512	2272	w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe	107
PID 2272 wrote to memory of 4488	2272	w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe	108
PID 4512 wrote to memory of 4908	4512	w8979EDC1fA73Cv46142BAF484D3F05031334l.exe	109
PID 4512 wrote to memory of 4328	4512	w8979EDC1fA73Cv46142BAF484D3F05031334l.exe	110
PID 4908 wrote to memory of 2336	4908	wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe	111
PID 4908 wrote to memory of 3048	4908	wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-10-28_c5e5bb1eb304a9214b5cc0b95d95582d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_c5e5bb1eb304a9214b5cc0b95d95582d_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe
  C:\Windows\wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\w5CC58771f5C6Cv46c129C2783A1810585899l.exe
    C:\Windows\w5CC58771f5C6Cv46c129C2783A1810585899l.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Windows\w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe
      C:\Windows\w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5648
    - - C:\Windows\w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe
        
        C:\Windows\w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4632
      - C:\Windows\w79BA9761f658Cv4a332A44782A7211CC756Fl.exe
        
        C:\Windows\w79BA9761f658Cv4a332A44782A7211CC756Fl.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe
        
        C:\Windows\wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe
        
        C:\Windows\wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe
        
        C:\Windows\w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\w8979EDC1fA73Cv46142BAF484D3F05031334l.exe
        
        C:\Windows\w8979EDC1fA73Cv46142BAF484D3F05031334l.exe
        10⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe
        
        C:\Windows\wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\w94A6B744f40B8v4f962AA1988869732D4298l.exe
        
        C:\Windows\w94A6B744f40B8v4f962AA1988869732D4298l.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\WE1D14~1.EXE > nul
        12⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W8979E~1.EXE > nul
        11⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W1FDB5~1.EXE > nul
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\WB8D5A~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\WE525A~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W79BA9~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1220
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W13447~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5816
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W1BF07~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\W5CC58~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\WF7F9A~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe

Path C:\Windows\w134473CDf5CC7v436b28F2B8447F9EA8A849l.exe
Size 60KB
SHA256 f4941bc0bb1e457a8e5d62ae1c727edd474649f5663ba0b6251c974b2bf484bd
MD5 34b8fedb147a5b1305e9de41f359ef16
SHA1 816e723372a9c8aca3ed0fac59ac5b34f62a3b6e
SHA512 2f01f3a75e357784e6b6e8364ee831f2f9dad0924ad0db38b07ccae0247145dc1b28b683a79f8abafac253a3946a39c7ac1bbbbd15af6165a8f34665cfbd97c2
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwfd404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroH4/Clsrul
TLSH
T1E55319835BEE5CF2F7951231087C8BB9927B99D4950EBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe

Path C:\Windows\w1BF07453f3D7Ev4b102B6F58741841D4AA70l.exe
Size 60KB
SHA256 3d084ddda2886b099cfd7b9a2a23448f5f3e9da8e93900357ae3dd6907ab599d
MD5 ce7c1323e9f4af6cd05b7f2fc42fd34b
SHA1 be1f53edff3478e900b459821018694cc6d68bca
SHA512 31cc598138a31ce2473afe4397370afa30f1b4acb3a1853cc9f85f3579ef5d691edc0602a20e7ac636b413cac2308947bea5aea6b74550540db0dfc6f1fbf633
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwJW404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroi4/Clsrul
TLSH
T1BB5319835BEE5CF2F7951131087C8BB9927B99D4950DBEEFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe

Path C:\Windows\w1FDB5DCCfB678v4eef2BC968578FEC9A99C1l.exe
Size 60KB
SHA256 046638c8e803834c5fc42eed6db0cd9de4768f288754634fdb8a0bfefd113ba7
MD5 410719014d282c1579274a625a6bad4c
SHA1 2c42bcfca4cb626e112992b774339ed83776aa4e
SHA512 fee5d9f4f7d5c49e530ad7e5283d9bc1a312b77ff87c67e9aa6561f7867ea347fc1107689bf9ced461553f25396a5c1cf53843b227f9a78d280ed16818cacafe
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwq404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLrog4/Clsrul
TLSH
T1415319835BEE5CF2F7951131087C8BB9927B99D4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w5CC58771f5C6Cv46c129C2783A1810585899l.exe

Path C:\Windows\w5CC58771f5C6Cv46c129C2783A1810585899l.exe
Size 60KB
SHA256 b5aea93e5fd5588292dbd732b1cdb189d31599ac982ed44eb28d6a1523b96fa0
MD5 e892d489f4eed72906308dcd263dd6f6
SHA1 296299115ccd8299d74740456e38646b9957572d
SHA512 7c76a18fe5c3e8c46604ce9d9a1cf3e347ad682b68ae05acec6de259428153a3aced3e46b6fc4f6214cac899125f293065f12610a7f4f6a91038357fbc75c275
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwa404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLrow4/Clsrul
TLSH
T1C25319835BEE5CF2F7911231087C8BB9927B99D4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w79BA9761f658Cv4a332A44782A7211CC756Fl.exe

Path C:\Windows\w79BA9761f658Cv4a332A44782A7211CC756Fl.exe
Size 60KB
SHA256 c09565329d18967ab26ac162ecea09e3422dae41af314d92d8856d052dea5dfe
MD5 507ac62a89391c96489a3b8cfd5797d4
SHA1 626049a365691e0196c03b326057a92c257be611
SHA512 beb805ac58c502fd49f25e3197bf83a22651a9a92b5b3fdb3e285a9cea8dc27f4232f5bccb689bd75fa23df232241107305c2b569c8045ff2b2e2cd095d9a7c5
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw2404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroc4/Clsrul
TLSH
T1255319835BEE5CF2F7911231087C8BB9927B99D4950DBEDFAB50CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w8979EDC1fA73Cv46142BAF484D3F05031334l.exe

Path C:\Windows\w8979EDC1fA73Cv46142BAF484D3F05031334l.exe
Size 60KB
SHA256 b75a85834e8265bb4678a76d981e49c741907026e86af6a6d8e1bc06c66f89b8
MD5 f578def202a49b5b78af904e70a23246
SHA1 2422136bdb6fdc6cca39f75c0f288e021009bd54
SHA512 f6b268b3a9ce582e771dac6706133ac5bfc33b6d754d8e6fdcff2af5efb7c629010a1ab3eeae6bce4ca39129ff16da5645d18c43497d31c5c2ebba8a7d0f967e
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwv404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroh4/Clsrul
TLSH
T1DE5318835BEE5CF2F7911231087C8BB9927B99D4950EBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w94A6B744f40B8v4f962AA1988869732D4298l.exe

Path C:\Windows\w94A6B744f40B8v4f962AA1988869732D4298l.exe
Size 60KB
SHA256 e50a2ec207d8922e8641e5c79c8677e64a41332053ca8b38ae3cad2ce3020b2c
MD5 500026f39a2026ae92cd32654d2664f1
SHA1 3f93dcc3daa5fdf56c04b3c41c66a3eec79393b5
SHA512 2d1fbdd165f43f140be0e453e289728c3ad7ff5c4e4dacc644ae700b9649303b9276adf9407ef62e497b698e321c120824f67372a22f8de7a27814ac7992beba
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwd404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLrov4/Clsrul
TLSH
T1FE5319835BEE5CF2F7951231087C8BB9927B99D4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe

Path C:\Windows\wB8D5A25Cf8042v4d2228EC38449D84212C81l.exe
Size 60KB
SHA256 93bfe06619e8953c09caa5544f689f21e681dfc85fb3f04526ad8b693a055be3
MD5 fb77b66e96862c1f55d2b370fdc127fe
SHA1 b52559be1b602f271ddb943b7c47923439eb5f10
SHA512 88f323c52417b79332b2d0d721a8a001258b5f7903b29b3690a36440fc3352217d65c4e7060f3bc50e760bf4a29022389bcb2c16b6d63eb7005794044e801baa
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwU404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroC4/Clsrul
TLSH
T1F35329835BEE5CF2F7911231087C8BB9927B99D4A50DBEDFAB40CD544037292E83A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe

Path C:\Windows\wE1D144C8f74BAv49db28EBA821344D475D2Fl.exe
Size 60KB
SHA256 9614614ee7de12c27e55c2b8c04f267d7a85d96b66e81fb3e23fab22eb6a261b
MD5 af7b7909e44f7e6722cba8a603e328ee
SHA1 35a23f44ec8eba5fa1b52409f7e89cb71e1b84a2
SHA512 91732686f30bc793ee35bcc5ffd913328b01113737b4f0caadf8b10b3cd683f6c6b73d6b68d38577c576c0236425ca2c5c8c4e81c8dba5bfbda74ffba3dbc09d
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwS404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroI4/Clsrul
TLSH
T1745319835BEE5CF2F7911131087C8BB9927B99D4A50DBEDFAB50CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe

Path C:\Windows\wE525A9DFf59EEv499a2AFCD8BF75A2DDDD1Al.exe
Size 60KB
SHA256 fc9e2bbff0b204ee02d43f1742278eb1db1893779d77d93f1d8b470a44e8d4c5
MD5 94a082573a9bf502ed028848bb2700ec
SHA1 d60d0c4d1608d14b000b201c2cb444173be4a989
SHA512 02b6704bc1c1f531d4d0f7e356290541ecbfadb27b7ba4fff6beae5b458b3c85146db457a200e3f75385abdd02888a3f75bc0524ee5c6ea24103b22328e52d5b
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwg404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroO4/Clsrul
TLSH
T1735318835BEE5CF2F7951231087C8BB9927B99D4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe

Path C:\Windows\wF7F9AABDfD42Cv4bd52BFEB85880B4F66E16l.exe
Size 60KB
SHA256 00a563302b7580a4c4b9fd783bdd2dd87a0f3c134c13aacb1561b7020303898f
MD5 16a728d5ba90c1d1b7068c4b376ef891
SHA1 4542d5dfdef4b72601712d16e307303b139fe239
SHA512 949ccd2bed356508556fede7dd2dc255d60e243bf52368d92f995c744a907c4277dad658d12d1d6b451cb94b22168b95037480fdc2fe46a01e4d629cc729da42
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw/404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroR4/Clsrul
TLSH
T1CF5319835BEE5CF2F7911231087C8BB9927B99D4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads