Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/09/2026, 02:54
General
- Target 2026-09-24_d34746f4e21c919fd985608cf66dd291_elex_wannacry.exe
- Size 64KB
- Sample260924-dedp2syblh
- SHA256 1624f01dd1d3015d03b6ef0a1a982c6d0e240a0accd3955310ef889e932dc246
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_d34746f4e21c919fd985608cf66dd291_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_d34746f4e21c919fd985608cf66dd291_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{84A79CDC-D41D-46f5-AE71-A7175C5A640E}.exeC:\Windows\{84A79CDC-D41D-46f5-AE71-A7175C5A640E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B92D4A9A-ACCC-4d6a-9DA3-A013C8767A7B}.exeC:\Windows\{B92D4A9A-ACCC-4d6a-9DA3-A013C8767A7B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B0F2301D-C54A-4c08-98A8-874DFACCEFC5}.exeC:\Windows\{B0F2301D-C54A-4c08-98A8-874DFACCEFC5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2154599-5678-4316-AD00-2836C0972662}.exeC:\Windows\{F2154599-5678-4316-AD00-2836C0972662}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0105C153-1300-4d96-967A-23038775BCC6}.exeC:\Windows\{0105C153-1300-4d96-967A-23038775BCC6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4CF45F36-EE04-4261-91C7-5CC2059E8F95}.exeC:\Windows\{4CF45F36-EE04-4261-91C7-5CC2059E8F95}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44B11850-EDCE-47db-B97E-BC78FAB3CD99}.exeC:\Windows\{44B11850-EDCE-47db-B97E-BC78FAB3CD99}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9FBA0219-0628-49ad-87EF-56119875FE6E}.exeC:\Windows\{9FBA0219-0628-49ad-87EF-56119875FE6E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FE6707FE-275E-48f7-B4A6-D2E6B9BFFE4B}.exeC:\Windows\{FE6707FE-275E-48f7-B4A6-D2E6B9BFFE4B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{071B1961-16DE-4630-8D8E-D2EF8BF2CCA5}.exeC:\Windows\{071B1961-16DE-4630-8D8E-D2EF8BF2CCA5}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31D181D5-D8C3-4183-BD91-F4AD28BCE3C9}.exeC:\Windows\{31D181D5-D8C3-4183-BD91-F4AD28BCE3C9}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{071B1~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE670~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FBA0~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44B11~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4CF45~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0105C~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2154~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0F23~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B92D4~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{84A79~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0105C153-1300-4d96-967A-23038775BCC6}.exe
{071B1961-16DE-4630-8D8E-D2EF8BF2CCA5}.exe
{31D181D5-D8C3-4183-BD91-F4AD28BCE3C9}.exe
{44B11850-EDCE-47db-B97E-BC78FAB3CD99}.exe
{4CF45F36-EE04-4261-91C7-5CC2059E8F95}.exe
{84A79CDC-D41D-46f5-AE71-A7175C5A640E}.exe
{9FBA0219-0628-49ad-87EF-56119875FE6E}.exe
{B0F2301D-C54A-4c08-98A8-874DFACCEFC5}.exe
{B92D4A9A-ACCC-4d6a-9DA3-A013C8767A7B}.exe
{F2154599-5678-4316-AD00-2836C0972662}.exe
{FE6707FE-275E-48f7-B4A6-D2E6B9BFFE4B}.exe
memory/1216-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1216-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1668-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1668-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1864-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1864-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2736-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2736-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3056-39-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3200-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4144-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4144-52-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4268-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4268-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4444-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4576-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4576-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4576-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4756-10-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4756-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5484-45-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5484-40-0x0000000000400000-0x0000000000410000-memory.dmp