Analysis
- max time kernel
145s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 15:00
General
- Target 2026-10-01_4e92ab0d92b9a7f26642001cade3ccf1_elex_wannacry.exe
- Size 213KB
- Sample261002-sdctpascph
- SHA256 9e35d6dd22a7a511e223ef2f92ce77a78138ff4672127b6be62ee6317bae8989
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_4e92ab0d92b9a7f26642001cade3ccf1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_4e92ab0d92b9a7f26642001cade3ccf1_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{446AE9D7-DD69-4fed-A02B-333E2E7CFF2B}.exeC:\Windows\{446AE9D7-DD69-4fed-A02B-333E2E7CFF2B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A6084C7-15B5-4bf7-B022-7EEE08AD6014}.exeC:\Windows\{3A6084C7-15B5-4bf7-B022-7EEE08AD6014}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C3FC1BB-BE75-42e8-903B-F9F014837820}.exeC:\Windows\{5C3FC1BB-BE75-42e8-903B-F9F014837820}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CFBA912E-36B1-4ef6-A8BE-3997A5B8C299}.exeC:\Windows\{CFBA912E-36B1-4ef6-A8BE-3997A5B8C299}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{67871D80-6CA8-45a9-99AE-9251B160909B}.exeC:\Windows\{67871D80-6CA8-45a9-99AE-9251B160909B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21E55D74-0D66-4805-9C4F-1F654327640D}.exeC:\Windows\{21E55D74-0D66-4805-9C4F-1F654327640D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F7E74AB-5756-4c09-BAEF-B04EAAB8CF94}.exeC:\Windows\{4F7E74AB-5756-4c09-BAEF-B04EAAB8CF94}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19BC944C-000E-4e02-A5C3-F9BF03236E64}.exeC:\Windows\{19BC944C-000E-4e02-A5C3-F9BF03236E64}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6D6BA713-C67E-472d-8FA6-363F7250548E}.exeC:\Windows\{6D6BA713-C67E-472d-8FA6-363F7250548E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E9BB89EC-61D9-479d-94B2-7CFFA3DE312F}.exeC:\Windows\{E9BB89EC-61D9-479d-94B2-7CFFA3DE312F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B55203AE-27D4-4386-8AE8-FB8A74C37019}.exeC:\Windows\{B55203AE-27D4-4386-8AE8-FB8A74C37019}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9BB8~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D6BA~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19BC9~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F7E7~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21E55~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67871~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CFBA9~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C3FC~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A608~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{446AE~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{19BC944C-000E-4e02-A5C3-F9BF03236E64}.exe
{21E55D74-0D66-4805-9C4F-1F654327640D}.exe
{3A6084C7-15B5-4bf7-B022-7EEE08AD6014}.exe
{446AE9D7-DD69-4fed-A02B-333E2E7CFF2B}.exe
{4F7E74AB-5756-4c09-BAEF-B04EAAB8CF94}.exe
{5C3FC1BB-BE75-42e8-903B-F9F014837820}.exe
{67871D80-6CA8-45a9-99AE-9251B160909B}.exe
{6D6BA713-C67E-472d-8FA6-363F7250548E}.exe
{B55203AE-27D4-4386-8AE8-FB8A74C37019}.exe
{CFBA912E-36B1-4ef6-A8BE-3997A5B8C299}.exe
{E9BB89EC-61D9-479d-94B2-7CFFA3DE312F}.exe