Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 18:46
General
- Target 2026-10-13_1ac90b1c1742ee2110a67a08e973d743_elex_wannacry.exe
- Size 59KB
- Sample261015-xe5cjsbt81
- SHA256 c247ab8ac59529ec58d0f605a08b3804df0b4e7ee461f53172a52d20b830644c
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_1ac90b1c1742ee2110a67a08e973d743_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_1ac90b1c1742ee2110a67a08e973d743_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A05497EA-B9ED-48c9-922B-12E0756974BD}.exeC:\Windows\{A05497EA-B9ED-48c9-922B-12E0756974BD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9258C6B7-FA09-4aa8-99FB-7D039EFF9C04}.exeC:\Windows\{9258C6B7-FA09-4aa8-99FB-7D039EFF9C04}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E89D7BBF-359D-493f-AFFA-55C66B0675F4}.exeC:\Windows\{E89D7BBF-359D-493f-AFFA-55C66B0675F4}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2D7D196-F689-46b0-AA10-1FBC1FD5BDF9}.exeC:\Windows\{A2D7D196-F689-46b0-AA10-1FBC1FD5BDF9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD082246-903B-4eee-8039-3028D6B793EB}.exeC:\Windows\{AD082246-903B-4eee-8039-3028D6B793EB}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2ADA9E0-C1B4-4345-96C5-73E86812F965}.exeC:\Windows\{F2ADA9E0-C1B4-4345-96C5-73E86812F965}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BF776FF5-A44D-48f4-A5FC-36C16924D90E}.exeC:\Windows\{BF776FF5-A44D-48f4-A5FC-36C16924D90E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D88CF4AD-D931-4776-8DB1-DFC78A3689D0}.exeC:\Windows\{D88CF4AD-D931-4776-8DB1-DFC78A3689D0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58BACC0C-7630-4c74-888A-F02A578D9A9F}.exeC:\Windows\{58BACC0C-7630-4c74-888A-F02A578D9A9F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FBE0D70-C096-47be-87BA-BB2532382D29}.exeC:\Windows\{2FBE0D70-C096-47be-87BA-BB2532382D29}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3CA01AB7-79A9-42d6-9BC1-D308AF94C08E}.exeC:\Windows\{3CA01AB7-79A9-42d6-9BC1-D308AF94C08E}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FBE0~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58BAC~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D88CF~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BF776~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2ADA~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD082~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2D7D~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E89D7~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9258C~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0549~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2FBE0D70-C096-47be-87BA-BB2532382D29}.exe
{3CA01AB7-79A9-42d6-9BC1-D308AF94C08E}.exe
{58BACC0C-7630-4c74-888A-F02A578D9A9F}.exe
{9258C6B7-FA09-4aa8-99FB-7D039EFF9C04}.exe
{A05497EA-B9ED-48c9-922B-12E0756974BD}.exe
{A2D7D196-F689-46b0-AA10-1FBC1FD5BDF9}.exe
{AD082246-903B-4eee-8039-3028D6B793EB}.exe
{BF776FF5-A44D-48f4-A5FC-36C16924D90E}.exe
{D88CF4AD-D931-4776-8DB1-DFC78A3689D0}.exe
{E89D7BBF-359D-493f-AFFA-55C66B0675F4}.exe
{F2ADA9E0-C1B4-4345-96C5-73E86812F965}.exe