Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 11:44
General
- Target 2026-09-30_496118ef9a0118324d2ed970f10d278d_elex_wannacry.exe
- Size 68KB
- Sample260930-nv55castes
- SHA256 4d0bd48f7798e31a2e3a84aa810529bced388cd28cd2b7f649510352adb416bf
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 30 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_496118ef9a0118324d2ed970f10d278d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_496118ef9a0118324d2ed970f10d278d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2AD8DDE-D53A-4477-8024-D502B6E1214A}.exeC:\Windows\{F2AD8DDE-D53A-4477-8024-D502B6E1214A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{941EC98B-D657-4c16-BF11-0DDBB58E3D77}.exeC:\Windows\{941EC98B-D657-4c16-BF11-0DDBB58E3D77}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ECACC1CB-CB42-45f1-B1EE-126B5F9B15C0}.exeC:\Windows\{ECACC1CB-CB42-45f1-B1EE-126B5F9B15C0}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89029743-B65F-4b5f-AD40-81C9433246F6}.exeC:\Windows\{89029743-B65F-4b5f-AD40-81C9433246F6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B860831-C100-4cee-9B04-814C7E3EF9DC}.exeC:\Windows\{5B860831-C100-4cee-9B04-814C7E3EF9DC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2021F4ED-5831-4e0c-B4FD-826A273EE404}.exeC:\Windows\{2021F4ED-5831-4e0c-B4FD-826A273EE404}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{776C36C3-60E2-4268-8FE9-A6625E219E16}.exeC:\Windows\{776C36C3-60E2-4268-8FE9-A6625E219E16}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C95D60BA-26B9-419f-80BF-5EA6A7AE4BE1}.exeC:\Windows\{C95D60BA-26B9-419f-80BF-5EA6A7AE4BE1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B29C4CF4-DE49-47ca-B76D-AC31A637AA13}.exeC:\Windows\{B29C4CF4-DE49-47ca-B76D-AC31A637AA13}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2C09C76-ACA1-4917-BDA3-D16620ED6E63}.exeC:\Windows\{A2C09C76-ACA1-4917-BDA3-D16620ED6E63}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04CB85E2-3DA3-4765-ACFD-E3C3A41850FA}.exeC:\Windows\{04CB85E2-3DA3-4765-ACFD-E3C3A41850FA}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2C09~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B29C4~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C95D6~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{776C3~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2021F~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B860~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89029~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECACC~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{941EC~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2AD8~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{04CB85E2-3DA3-4765-ACFD-E3C3A41850FA}.exe
{2021F4ED-5831-4e0c-B4FD-826A273EE404}.exe
{5B860831-C100-4cee-9B04-814C7E3EF9DC}.exe
{776C36C3-60E2-4268-8FE9-A6625E219E16}.exe
{89029743-B65F-4b5f-AD40-81C9433246F6}.exe
{941EC98B-D657-4c16-BF11-0DDBB58E3D77}.exe
{A2C09C76-ACA1-4917-BDA3-D16620ED6E63}.exe
{B29C4CF4-DE49-47ca-B76D-AC31A637AA13}.exe
{C95D60BA-26B9-419f-80BF-5EA6A7AE4BE1}.exe
{ECACC1CB-CB42-45f1-B1EE-126B5F9B15C0}.exe
{F2AD8DDE-D53A-4477-8024-D502B6E1214A}.exe
memory/368-17-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1140-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1140-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1140-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1808-32-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3116-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3116-45-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4224-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4224-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4260-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4376-39-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4376-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4856-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4876-23-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4876-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5272-11-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5272-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5992-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5992-16-0x0000000000400000-0x0000000000411000-memory.dmp