Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 10:19
General
- Target 2026-09-10_cfdad67882e9cc9dea720ad30f2c0a86_elex_wannacry.exe
- Size 92KB
- Sample260910-mcy3msge56
- SHA256 46da2fbfbccda4bbe17a4af5d97bda46f2dcf76fbec3b79991703874a7ad02a8
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 37 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_cfdad67882e9cc9dea720ad30f2c0a86_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_cfdad67882e9cc9dea720ad30f2c0a86_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4BA35E1D-9018-4817-AB6C-004CA7D9DBD7}.exeC:\Windows\{4BA35E1D-9018-4817-AB6C-004CA7D9DBD7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{920A99D3-BB49-42f2-969E-F1A26BE4F255}.exeC:\Windows\{920A99D3-BB49-42f2-969E-F1A26BE4F255}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{360F99FE-D034-4fdb-9CC2-0AFD5B408E48}.exeC:\Windows\{360F99FE-D034-4fdb-9CC2-0AFD5B408E48}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D15215AE-2564-4ad6-AB83-5D90D3884A22}.exeC:\Windows\{D15215AE-2564-4ad6-AB83-5D90D3884A22}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0467B095-9143-4da3-AFA6-D47B06494191}.exeC:\Windows\{0467B095-9143-4da3-AFA6-D47B06494191}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAAD8D16-DB8D-4433-AEA0-21B90F0E1366}.exeC:\Windows\{CAAD8D16-DB8D-4433-AEA0-21B90F0E1366}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{09D6F195-647A-4dcd-8F99-A0D956FB0215}.exeC:\Windows\{09D6F195-647A-4dcd-8F99-A0D956FB0215}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5D941E5-7685-4a1f-959C-9E0D20402E47}.exeC:\Windows\{D5D941E5-7685-4a1f-959C-9E0D20402E47}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{670B84F5-3DCE-4d4a-8399-B3DA21682B73}.exeC:\Windows\{670B84F5-3DCE-4d4a-8399-B3DA21682B73}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6260618-4016-4eda-9FBA-C4B3BBE5DFF8}.exeC:\Windows\{C6260618-4016-4eda-9FBA-C4B3BBE5DFF8}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20FCDFF0-A91C-4f2d-B4FB-62DDD5273281}.exeC:\Windows\{20FCDFF0-A91C-4f2d-B4FB-62DDD5273281}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6260~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{670B8~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5D94~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09D6F~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAAD8~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0467B~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1521~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{360F9~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{920A9~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4BA35~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0467B095-9143-4da3-AFA6-D47B06494191}.exe
{09D6F195-647A-4dcd-8F99-A0D956FB0215}.exe
{20FCDFF0-A91C-4f2d-B4FB-62DDD5273281}.exe
{360F99FE-D034-4fdb-9CC2-0AFD5B408E48}.exe
{4BA35E1D-9018-4817-AB6C-004CA7D9DBD7}.exe
{670B84F5-3DCE-4d4a-8399-B3DA21682B73}.exe
{920A99D3-BB49-42f2-969E-F1A26BE4F255}.exe
{C6260618-4016-4eda-9FBA-C4B3BBE5DFF8}.exe
{CAAD8D16-DB8D-4433-AEA0-21B90F0E1366}.exe
{D15215AE-2564-4ad6-AB83-5D90D3884A22}.exe
{D5D941E5-7685-4a1f-959C-9E0D20402E47}.exe
memory/1440-64-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1440-58-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1460-48-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1460-43-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1788-22-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1788-15-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3124-79-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3464-30-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3464-21-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3472-41-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3472-35-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4628-71-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4628-77-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4952-50-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4952-52-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4952-56-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5160-28-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5160-36-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5584-72-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5584-65-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6544-13-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6544-6-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6544-9-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6856-8-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6856-1-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6856-0-0x0000000000400000-0x0000000000417000-memory.dmp