Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 16:32
General
- Target 2026-09-29_cd726d09aa72bde6e95e5a2de0a28665_elex_wannacry.exe
- Size 213KB
- Sample260930-t11dya1dkf
- SHA256 ab6a0a1a1b2c2f6ece7ecb042dc7c38e195e7d0441d39e8d5e3c1c0ed12d6a7c
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- Executes a command shell one-liner 1 TTPs 10 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_cd726d09aa72bde6e95e5a2de0a28665_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_cd726d09aa72bde6e95e5a2de0a28665_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8643A567-EFDE-4c61-B579-061A222C2C46}.exeC:\Windows\{8643A567-EFDE-4c61-B579-061A222C2C46}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0DB30371-08C2-4d6d-8978-2061D574475D}.exeC:\Windows\{0DB30371-08C2-4d6d-8978-2061D574475D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D695EA17-9B22-4889-B082-DABA3C387B0D}.exeC:\Windows\{D695EA17-9B22-4889-B082-DABA3C387B0D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B7B8A57-E40D-44c4-BAF1-E9A49DA96634}.exeC:\Windows\{8B7B8A57-E40D-44c4-BAF1-E9A49DA96634}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ACEE56C6-641D-4461-B780-B10E996DB38F}.exeC:\Windows\{ACEE56C6-641D-4461-B780-B10E996DB38F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0CA10D0C-F570-4c96-A438-73621E82711A}.exeC:\Windows\{0CA10D0C-F570-4c96-A438-73621E82711A}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C486BA3B-F1F9-4b6e-A32F-208EFF7974A5}.exeC:\Windows\{C486BA3B-F1F9-4b6e-A32F-208EFF7974A5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1FABF02-D24D-4deb-B110-DEC6B204DFA0}.exeC:\Windows\{D1FABF02-D24D-4deb-B110-DEC6B204DFA0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EAB9387B-AA77-48e5-B313-39CC96E77268}.exeC:\Windows\{EAB9387B-AA77-48e5-B313-39CC96E77268}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12513581-F6BF-401b-84D9-AA08FD7777F0}.exeC:\Windows\{12513581-F6BF-401b-84D9-AA08FD7777F0}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EAB93~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1FAB~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C486B~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0CA10~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ACEE5~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B7B8~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D695E~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0DB30~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8643A~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0CA10D0C-F570-4c96-A438-73621E82711A}.exe
{0DB30371-08C2-4d6d-8978-2061D574475D}.exe
{12513581-F6BF-401b-84D9-AA08FD7777F0}.exe
{8643A567-EFDE-4c61-B579-061A222C2C46}.exe
{8B7B8A57-E40D-44c4-BAF1-E9A49DA96634}.exe
{ACEE56C6-641D-4461-B780-B10E996DB38F}.exe
{C486BA3B-F1F9-4b6e-A32F-208EFF7974A5}.exe
{D1FABF02-D24D-4deb-B110-DEC6B204DFA0}.exe
{D695EA17-9B22-4889-B082-DABA3C387B0D}.exe
{EAB9387B-AA77-48e5-B313-39CC96E77268}.exe