Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 17:24
General
- Target 2026-09-29_aff1e9640b73d712ca9faeeb2d69de44_elex_wannacry.exe
- Size 92KB
- Sample260930-vy3a7avbkh
- SHA256 4a9851da37d7d9c1b45758cecc93e5f970c0f70e612b91e05036388150d6d22d
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_aff1e9640b73d712ca9faeeb2d69de44_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_aff1e9640b73d712ca9faeeb2d69de44_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7ACE4DA8-DB24-4a9b-B945-FCD7F4944BDD}.exeC:\Windows\{7ACE4DA8-DB24-4a9b-B945-FCD7F4944BDD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD4665D4-82B5-4b44-B47E-4064086A88C4}.exeC:\Windows\{DD4665D4-82B5-4b44-B47E-4064086A88C4}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F008EC36-5C10-4d43-8CD1-AABEDAC14962}.exeC:\Windows\{F008EC36-5C10-4d43-8CD1-AABEDAC14962}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B66E9114-BA91-409a-B5E0-03BFB338A029}.exeC:\Windows\{B66E9114-BA91-409a-B5E0-03BFB338A029}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3F96E29C-E9A1-4320-9929-E1711DCB5492}.exeC:\Windows\{3F96E29C-E9A1-4320-9929-E1711DCB5492}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57F43BDD-D6F4-4d03-A7B7-D5DE4B35A20D}.exeC:\Windows\{57F43BDD-D6F4-4d03-A7B7-D5DE4B35A20D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D306304F-ADD1-4242-9BCA-75AE9FA1524D}.exeC:\Windows\{D306304F-ADD1-4242-9BCA-75AE9FA1524D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D796F93-AED2-4a7c-9295-079802159AD3}.exeC:\Windows\{2D796F93-AED2-4a7c-9295-079802159AD3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F8653FE-E08F-4910-9137-411C3726857B}.exeC:\Windows\{0F8653FE-E08F-4910-9137-411C3726857B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56278FE1-1A99-4933-90F2-96B15B518D2D}.exeC:\Windows\{56278FE1-1A99-4933-90F2-96B15B518D2D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD7DDB72-95BB-4d6f-8434-677184B6EA48}.exeC:\Windows\{AD7DDB72-95BB-4d6f-8434-677184B6EA48}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56278~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F865~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D796~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3063~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57F43~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3F96E~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B66E9~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F008E~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD466~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7ACE4~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0F8653FE-E08F-4910-9137-411C3726857B}.exe
{2D796F93-AED2-4a7c-9295-079802159AD3}.exe
{3F96E29C-E9A1-4320-9929-E1711DCB5492}.exe
{56278FE1-1A99-4933-90F2-96B15B518D2D}.exe
{57F43BDD-D6F4-4d03-A7B7-D5DE4B35A20D}.exe
{7ACE4DA8-DB24-4a9b-B945-FCD7F4944BDD}.exe
{AD7DDB72-95BB-4d6f-8434-677184B6EA48}.exe
{B66E9114-BA91-409a-B5E0-03BFB338A029}.exe
{D306304F-ADD1-4242-9BCA-75AE9FA1524D}.exe
{DD4665D4-82B5-4b44-B47E-4064086A88C4}.exe
{F008EC36-5C10-4d43-8CD1-AABEDAC14962}.exe
memory/352-14-0x0000000000400000-0x0000000000417000-memory.dmp
memory/352-6-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1788-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1788-8-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1788-1-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2100-13-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2100-20-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2116-55-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2116-61-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2316-35-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2316-28-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2336-70-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2336-75-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2536-42-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2536-49-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3020-68-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3020-63-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4576-56-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4576-48-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5472-77-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5892-26-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5892-21-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6028-41-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6028-34-0x0000000000400000-0x0000000000417000-memory.dmp