Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 18:29
General
- Target 2026-10-10_281b1473f98b02fd016365a2ffd8b6b4_elex_wannacry.exe
- Size 90KB
- Sample261011-w5aeesvyct
- SHA256 f2b39ff9c92319833f2a5a37788539150edbfe82a75810630f5fff1973625787
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_281b1473f98b02fd016365a2ffd8b6b4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_281b1473f98b02fd016365a2ffd8b6b4_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD9D693E-41F0-45aa-8806-7F8E2C8E670E}.exeC:\Windows\{DD9D693E-41F0-45aa-8806-7F8E2C8E670E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07A742E4-514C-4bff-AAF2-7A3099F1B652}.exeC:\Windows\{07A742E4-514C-4bff-AAF2-7A3099F1B652}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6EAA018A-AE67-434f-A03E-12E0055CCF8F}.exeC:\Windows\{6EAA018A-AE67-434f-A03E-12E0055CCF8F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FBC6D10-AD47-487b-AA76-55A7785EE84A}.exeC:\Windows\{2FBC6D10-AD47-487b-AA76-55A7785EE84A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8FE4690E-C094-4c2a-A0A2-5F1033210C0B}.exeC:\Windows\{8FE4690E-C094-4c2a-A0A2-5F1033210C0B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8FCD8E2-5394-48cc-B1A4-16371B0C0B85}.exeC:\Windows\{B8FCD8E2-5394-48cc-B1A4-16371B0C0B85}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07200429-4C0B-4647-A0D3-6A34F0DAD7C5}.exeC:\Windows\{07200429-4C0B-4647-A0D3-6A34F0DAD7C5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A00EBAD-D79D-4c0e-A4BE-0C35A645C5D0}.exeC:\Windows\{3A00EBAD-D79D-4c0e-A4BE-0C35A645C5D0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35199022-1BE5-4420-B30C-63ECD8C9F70B}.exeC:\Windows\{35199022-1BE5-4420-B30C-63ECD8C9F70B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86627DE8-5509-4bfc-98E3-EC5CAF3D64B0}.exeC:\Windows\{86627DE8-5509-4bfc-98E3-EC5CAF3D64B0}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E73F16FC-F369-4a41-8B6A-7D49973DFAF6}.exeC:\Windows\{E73F16FC-F369-4a41-8B6A-7D49973DFAF6}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86627~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35199~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A00E~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07200~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8FCD~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FE46~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FBC6~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6EAA0~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07A74~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD9D6~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{07200429-4C0B-4647-A0D3-6A34F0DAD7C5}.exe
{07A742E4-514C-4bff-AAF2-7A3099F1B652}.exe
{2FBC6D10-AD47-487b-AA76-55A7785EE84A}.exe
{35199022-1BE5-4420-B30C-63ECD8C9F70B}.exe
{3A00EBAD-D79D-4c0e-A4BE-0C35A645C5D0}.exe
{6EAA018A-AE67-434f-A03E-12E0055CCF8F}.exe
{86627DE8-5509-4bfc-98E3-EC5CAF3D64B0}.exe
{8FE4690E-C094-4c2a-A0A2-5F1033210C0B}.exe
{B8FCD8E2-5394-48cc-B1A4-16371B0C0B85}.exe
{DD9D693E-41F0-45aa-8806-7F8E2C8E670E}.exe
{E73F16FC-F369-4a41-8B6A-7D49973DFAF6}.exe
memory/1076-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1076-58-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1596-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1596-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1596-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1740-76-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1740-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2236-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2236-23-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2236-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2432-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3420-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3420-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3884-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3884-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3952-62-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3952-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4852-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4852-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5568-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5568-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5752-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5752-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6080-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6080-43-0x0000000000400000-0x0000000000411000-memory.dmp