stormser | ed48d54a655de094478bd2d8be9bfca22e55f26964435d3c88dc05cce827b1bb

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/11/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-05_9ba0aac415e3ad22f840666346c1ac4c_elex_wannacry.exe
Size 372KB
Sample261106-sdqesact3v
SHA256 ed48d54a655de094478bd2d8be9bfca22e55f26964435d3c88dc05cce827b1bb
MD5 9ba0aac415e3ad22f840666346c1ac4c
SHA1 edeae7bbe3ad77c7d4629825d294430da884f934
SHA512 aa86d3665364bd17b042091da71e6da5d49341f43aa436cec8cf9c66b47ac113daa262b960d3e4082dc5ee2f38f28b4d289c6894c40a0bd80766b509caa017b5
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrocpMx4/CFsrdb:Gvw9816vhKQLrocCx4/wQR
TLSH
T1518408835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD550037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral1/files/0x000500000001e108-2.dat	family_stormser
behavioral1/files/0x0007000000024336-6.dat	family_stormser
behavioral1/files/0x000800000002433e-10.dat	family_stormser
behavioral1/files/0x0008000000024336-14.dat	family_stormser
behavioral1/files/0x00030000000006d5-19.dat	family_stormser
behavioral1/files/0x0004000000000703-22.dat	family_stormser
behavioral1/files/0x00040000000006d5-26.dat	family_stormser
behavioral1/files/0x00050000000006f1-30.dat	family_stormser
behavioral1/files/0x00050000000006d5-34.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75DAD49A-F47F-4670-B23F-42937BAAB62C}	{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{14B03EDE-CC22-4fa5-9857-883E4C123D14}\stubpath = "C:\\Windows\\{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe"	{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}\stubpath = "C:\\Windows\\{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe"	{074750AA-732B-4957-8957-786A7CE13A87}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{392EF8B3-E0D2-4cb1-B2A6-210D7B68A6EF}	{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{14B03EDE-CC22-4fa5-9857-883E4C123D14}	{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}\stubpath = "C:\\Windows\\{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe"	{93158296-E707-433e-BE52-D62FD2A76D9E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}\stubpath = "C:\\Windows\\{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe"	{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{392EF8B3-E0D2-4cb1-B2A6-210D7B68A6EF}\stubpath = "C:\\Windows\\{392EF8B3-E0D2-4cb1-B2A6-210D7B68A6EF}.exe"	{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75DAD49A-F47F-4670-B23F-42937BAAB62C}\stubpath = "C:\\Windows\\{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe"	{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{074750AA-732B-4957-8957-786A7CE13A87}	{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{074750AA-732B-4957-8957-786A7CE13A87}\stubpath = "C:\\Windows\\{074750AA-732B-4957-8957-786A7CE13A87}.exe"	{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}	{074750AA-732B-4957-8957-786A7CE13A87}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9A6E052-2C52-4872-9A21-2F64CD386262}\stubpath = "C:\\Windows\\{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe"	2026-11-05_9ba0aac415e3ad22f840666346c1ac4c_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93158296-E707-433e-BE52-D62FD2A76D9E}	{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93158296-E707-433e-BE52-D62FD2A76D9E}\stubpath = "C:\\Windows\\{93158296-E707-433e-BE52-D62FD2A76D9E}.exe"	{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}	{93158296-E707-433e-BE52-D62FD2A76D9E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}	{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9A6E052-2C52-4872-9A21-2F64CD386262}	2026-11-05_9ba0aac415e3ad22f840666346c1ac4c_elex_wannacry.exe

Executes dropped EXE 9 IoCs

pid	Process
3536	{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe
5016	{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe
528	{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe
3952	{93158296-E707-433e-BE52-D62FD2A76D9E}.exe
4100	{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe
1584	{074750AA-732B-4957-8957-786A7CE13A87}.exe
1468	{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe
1984	{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe
756	{392EF8B3-E0D2-4cb1-B2A6-210D7B68A6EF}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe	{074750AA-732B-4957-8957-786A7CE13A87}.exe
File created	C:\Windows\{392EF8B3-E0D2-4cb1-B2A6-210D7B68A6EF}.exe	{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe
File created	C:\Windows\{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe	{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe
File created	C:\Windows\{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe	{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe
File created	C:\Windows\{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe	{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe
File created	C:\Windows\{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe	2026-11-05_9ba0aac415e3ad22f840666346c1ac4c_elex_wannacry.exe
File created	C:\Windows\{93158296-E707-433e-BE52-D62FD2A76D9E}.exe	{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe
File created	C:\Windows\{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe	{93158296-E707-433e-BE52-D62FD2A76D9E}.exe
File created	C:\Windows\{074750AA-732B-4957-8957-786A7CE13A87}.exe	{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4128	cmd.exe
4544	cmd.exe
1160	cmd.exe
2532	cmd.exe
4824	cmd.exe
3444	cmd.exe
4136	cmd.exe
1116	cmd.exe
2768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-05_9ba0aac415e3ad22f840666346c1ac4c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{392EF8B3-E0D2-4cb1-B2A6-210D7B68A6EF}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{93158296-E707-433e-BE52-D62FD2A76D9E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{074750AA-732B-4957-8957-786A7CE13A87}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1900	2026-11-05_9ba0aac415e3ad22f840666346c1ac4c_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3536	{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe
Token: SeIncBasePriorityPrivilege	5016	{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe
Token: SeIncBasePriorityPrivilege	528	{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe
Token: SeIncBasePriorityPrivilege	3952	{93158296-E707-433e-BE52-D62FD2A76D9E}.exe
Token: SeIncBasePriorityPrivilege	4100	{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe
Token: SeIncBasePriorityPrivilege	1584	{074750AA-732B-4957-8957-786A7CE13A87}.exe
Token: SeIncBasePriorityPrivilege	1468	{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe
Token: SeIncBasePriorityPrivilege	1984	{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 3536	1900	2026-11-05_9ba0aac415e3ad22f840666346c1ac4c_elex_wannacry.exe	91
PID 1900 wrote to memory of 3444	1900	2026-11-05_9ba0aac415e3ad22f840666346c1ac4c_elex_wannacry.exe	92
PID 3536 wrote to memory of 5016	3536	{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe	93
PID 3536 wrote to memory of 4136	3536	{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe	94
PID 5016 wrote to memory of 528	5016	{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe	97
PID 5016 wrote to memory of 1160	5016	{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe	98
PID 528 wrote to memory of 3952	528	{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe	99
PID 528 wrote to memory of 2532	528	{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe	100
PID 3952 wrote to memory of 4100	3952	{93158296-E707-433e-BE52-D62FD2A76D9E}.exe	101
PID 3952 wrote to memory of 1116	3952	{93158296-E707-433e-BE52-D62FD2A76D9E}.exe	102
PID 4100 wrote to memory of 1584	4100	{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe	103
PID 4100 wrote to memory of 2768	4100	{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe	104
PID 1584 wrote to memory of 1468	1584	{074750AA-732B-4957-8957-786A7CE13A87}.exe	105
PID 1584 wrote to memory of 4128	1584	{074750AA-732B-4957-8957-786A7CE13A87}.exe	106
PID 1468 wrote to memory of 1984	1468	{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe	107
PID 1468 wrote to memory of 4824	1468	{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe	108
PID 1984 wrote to memory of 756	1984	{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe	109
PID 1984 wrote to memory of 4544	1984	{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-05_9ba0aac415e3ad22f840666346c1ac4c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-05_9ba0aac415e3ad22f840666346c1ac4c_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe
  C:\Windows\{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe
    C:\Windows\{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe
      C:\Windows\{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:528
    - - C:\Windows\{93158296-E707-433e-BE52-D62FD2A76D9E}.exe
        
        C:\Windows\{93158296-E707-433e-BE52-D62FD2A76D9E}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3952
      - C:\Windows\{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe
        
        C:\Windows\{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\{074750AA-732B-4957-8957-786A7CE13A87}.exe
        
        C:\Windows\{074750AA-732B-4957-8957-786A7CE13A87}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe
        
        C:\Windows\{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe
        
        C:\Windows\{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\{392EF8B3-E0D2-4cb1-B2A6-210D7B68A6EF}.exe
        
        C:\Windows\{392EF8B3-E0D2-4cb1-B2A6-210D7B68A6EF}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1FAC1~1.EXE > nul
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5B410~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{07475~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{061F7~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2768
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{93158~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1116
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{14B03~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{75DAD~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A9A6E~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe

Path C:\Windows\{061F7561-4EEA-4ee7-97AF-8C1E6BE03836}.exe
Size 372KB
SHA256 659abcddf948955725206599147aaabe45a247184ad0b2e11b75730761de61f6
MD5 9ef130c3c80ac03355400a600500e21f
SHA1 cac402482628a363de4fc0ad47407176c8eb877e
SHA512 ae8650ab1eb0d0d918ef46c99d182bf39d2c6b33dc34902019caf98ab79f51729e7d54f3d5a90a8062e992001af5890fbcac2142f1bbc02f012af46d06c54c44
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrosx4/CFsrdb:Gvw9816vhKQLrosx4/wQR
TLSH
T18A8408835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD150037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{074750AA-732B-4957-8957-786A7CE13A87}.exe

Path C:\Windows\{074750AA-732B-4957-8957-786A7CE13A87}.exe
Size 372KB
SHA256 5a641c4fcd65a25a194f34124408dc875a4111e5b5244c6b68fa3d23d7b39bb6
MD5 8b4d951e05f298d6cefb5d82468b7e5d
SHA1 81cba58b814d113367c4fda536c01d24671ea071
SHA512 2c41ca31542401ec1c1e9c621848848934e211489df76a91f130cf9ad1e265ebe3daf59c5de8285d54a1cafaf658c90001c3e311c52bee57927156ff1233a721
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrohx4/CFsrdb:Gvw9816vhKQLrohx4/wQR
TLSH
T17D8419835BDE9CF2FB91113009798AB9927B99C4914EBEDFBF90CD150037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe

Path C:\Windows\{14B03EDE-CC22-4fa5-9857-883E4C123D14}.exe
Size 372KB
SHA256 aa6a65e02e58d075e8a3cfba1a5be3c63fadae326ce90fcb45d3ac59d025928a
MD5 d2441be97364091f2c6b73b819208fa2
SHA1 d98afd7e562d396e6e3e55c54cdad9c1e91be60d
SHA512 734966c0e0a72d28a254901c155f76043120f9e89f838c2e90f3f2e5d167e9b621e2166a1c7ae5189010f5a41fdb8de5a3d1c765a521d7e61ece52b510e60c84
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLro0x4/CFsrdb:Gvw9816vhKQLro0x4/wQR
TLSH
T1468409835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD650037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe

Path C:\Windows\{1FAC1EAB-E01C-480e-95DC-01F6D1AAE19D}.exe
Size 372KB
SHA256 22984bda0ccfd7c62ba867ed0c3e9ab8a73252e2467c60d80c945b06371a41ba
MD5 5e2c1ce3f309c2972b733b04f032dce7
SHA1 6e56eb85cfb6fbdb755da7c3a9bbacc86e81a0ab
SHA512 b36b9bc0e1a9e272b8b0f6f9eabef05bcf723af08d07a6e3827af9ea725e0618876ca24194c7dce0025592f1e804adcacb8332aadfa9943fbe95028172a3bb22
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLro3x4/CFsrdb:Gvw9816vhKQLro3x4/wQR
TLSH
T19F8418835BDE9CF2FB91113009798AB9927B9AC4910EBEDFBF90CD150037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{392EF8B3-E0D2-4cb1-B2A6-210D7B68A6EF}.exe

Path C:\Windows\{392EF8B3-E0D2-4cb1-B2A6-210D7B68A6EF}.exe
Size 372KB
SHA256 3bfd006dd091b891f36f38f3f9bc773e50249a61e7985925f05dd960137d120b
MD5 5406ad7f991e6aea5648be929282fddb
SHA1 6d0c28d02dc0205ff7b58feed75de1177e9334a0
SHA512 a773d588f519e7619e2c3dde8414656abca6410a56dde11bf25d6f73122f2cb9d8a543fa89b8deab3574e9323c61a7d543b4fff620fcc25c454ec6e543bdadeb
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLro/x4/CFsrdb:Gvw9816vhKQLro/x4/wQR
TLSH
T1A08419835BDE9CF2FB91113009798AB9927B9AC4910EBEDFBF90CD250037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe

Path C:\Windows\{5B41080D-3F9A-4f39-80B6-26F94AB00B0A}.exe
Size 372KB
SHA256 38b88a47dfc2e3d264dffed17aa02735186d3aebae356902ab67b6b8062acd22
MD5 7bef3686392883f74ade04a2941ca3d9
SHA1 ed02cf835a071397bdca475d210addfb7eba3101
SHA512 76b6c7c86b46240048c41f759761963d78afae0b68c351e13afcdc8799e92c0d96d072fc6e8b480139eb8e9025a69ff490c0a6daec2efda1c2f9310141a8a047
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLro/x4/CFsrdb:Gvw9816vhKQLro/x4/wQR
TLSH
T10C8419835BDE9CF2FB91113009798AB9927B9AC4910EBEDFBF90CD150037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe

Path C:\Windows\{75DAD49A-F47F-4670-B23F-42937BAAB62C}.exe
Size 372KB
SHA256 ed0331a202ab7d79bf34251ca789d0b0fc8b26a35a4d38925c9f8b3e309eeaf8
MD5 09f538f44fa8c5ab2a188910f5c5435d
SHA1 a75fb8e23384cc7d545ad62e98bc12ffb6e6479b
SHA512 d0a3194b161104c12d3e529b8afc78f76f18f90a810c0b5a115ccd5cd6fdae55cd7ac31a1938fb43748e15b12bc2e418e645bbf4b5828e4a91734d104ed80cf1
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroZx4/CFsrdb:Gvw9816vhKQLroZx4/wQR
TLSH
T16B8418835BDE9CF2FB91113009798AB9927B9AC4910EBEDFBF90CD550037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{93158296-E707-433e-BE52-D62FD2A76D9E}.exe

Path C:\Windows\{93158296-E707-433e-BE52-D62FD2A76D9E}.exe
Size 372KB
SHA256 c5e737ab1c8d53b76b2ab7b1427866ff544de84af05ed8de87151754a3779c92
MD5 60279385617032028dcf2a558acb7efe
SHA1 a2c386ea38f98257e3d92354dabd0048e7b979d0
SHA512 0aed622a8b9221d610dba873c27eaf0e6069e9fd4d20c6ea0ea62b121f44b0ee0b9375f0d905d13e131708c4d4f6cac411d8eb49d7c64b431a9ca6b25ca1b6bf
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroqx4/CFsrdb:Gvw9816vhKQLroqx4/wQR
TLSH
T15E8408835BDE9CF2FB91113109798AB9926B9AC4910EBEDFBF90CD550037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe

Path C:\Windows\{A9A6E052-2C52-4872-9A21-2F64CD386262}.exe
Size 372KB
SHA256 e13c6e15ed452fe5ea5ed71ef8ef690e75f28638de6eb8dc3894ade9e9b3bd9a
MD5 3e5a231afc93312e8dcdfce0164eb5bf
SHA1 d66dc16280148e9c0d02485fd0da006adc527ab4
SHA512 443efe55e4a8a375ec76190b52067a7f9e5bdfede3c4a5f3cf04056c631d49d25277eed1354988bc99f5c811c6f4b54329877cee00e4b2f3982f4f5792e46094
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroox4/CFsrdb:Gvw9816vhKQLroox4/wQR
TLSH
T15E8408835BDA9CF2FA91113009798AB9927B9AC4910EBEDFBF90CD150037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads