Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 15:28
General
- Target 2026-10-16_69f1efd28afa4c4871fc06e0ddafd857_elex_wannacry.exe
- Size 372KB
- Sample261017-swee8sff49
- SHA256 f092d88a0a66eae6f78ac4898feec70cb853510e5c5e6153f082b8983c0e7b0f
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_69f1efd28afa4c4871fc06e0ddafd857_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_69f1efd28afa4c4871fc06e0ddafd857_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EFC3F774-445D-4ca7-989C-FF29810C2E3F}.exeC:\Windows\{EFC3F774-445D-4ca7-989C-FF29810C2E3F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B0955823-79FD-4bb3-AB0B-9DFCF7EF26D2}.exeC:\Windows\{B0955823-79FD-4bb3-AB0B-9DFCF7EF26D2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{133022E8-63D1-4fa6-9875-EAEE2ACB0834}.exeC:\Windows\{133022E8-63D1-4fa6-9875-EAEE2ACB0834}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{221FD66A-CF6A-43d1-AD65-6900469F9C00}.exeC:\Windows\{221FD66A-CF6A-43d1-AD65-6900469F9C00}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{474B6B62-D5F3-4f75-AA90-6A4941D4798D}.exeC:\Windows\{474B6B62-D5F3-4f75-AA90-6A4941D4798D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33AA7CA4-CBB2-4ecc-8063-6EA14ED1EDDE}.exeC:\Windows\{33AA7CA4-CBB2-4ecc-8063-6EA14ED1EDDE}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57C93A5D-20D4-47f6-BD75-7CCDC30991CC}.exeC:\Windows\{57C93A5D-20D4-47f6-BD75-7CCDC30991CC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{950A89BF-8AC2-4c9e-8555-3CCC92789AA0}.exeC:\Windows\{950A89BF-8AC2-4c9e-8555-3CCC92789AA0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9836CFC9-20F2-41a5-AB61-06BCA4835056}.exeC:\Windows\{9836CFC9-20F2-41a5-AB61-06BCA4835056}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D2CAF07-C557-46d6-984B-183E9B5F615A}.exeC:\Windows\{2D2CAF07-C557-46d6-984B-183E9B5F615A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4E2CA0F-450A-4663-A1B9-D0EE4C2323BA}.exeC:\Windows\{E4E2CA0F-450A-4663-A1B9-D0EE4C2323BA}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D2CA~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9836C~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{950A8~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57C93~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33AA7~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{474B6~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{221FD~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13302~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0955~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EFC3F~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{133022E8-63D1-4fa6-9875-EAEE2ACB0834}.exe
{221FD66A-CF6A-43d1-AD65-6900469F9C00}.exe
{2D2CAF07-C557-46d6-984B-183E9B5F615A}.exe
{33AA7CA4-CBB2-4ecc-8063-6EA14ED1EDDE}.exe
{474B6B62-D5F3-4f75-AA90-6A4941D4798D}.exe
{57C93A5D-20D4-47f6-BD75-7CCDC30991CC}.exe
{950A89BF-8AC2-4c9e-8555-3CCC92789AA0}.exe
{9836CFC9-20F2-41a5-AB61-06BCA4835056}.exe
{B0955823-79FD-4bb3-AB0B-9DFCF7EF26D2}.exe
{E4E2CA0F-450A-4663-A1B9-D0EE4C2323BA}.exe
{EFC3F774-445D-4ca7-989C-FF29810C2E3F}.exe