Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 08:46
General
- Target 2026-10-20_1acebdcab092c03a3cbf9076ddf1b1f4_elex_wannacry.exe
- Size 60KB
- Sample261020-kpgysafv2t
- SHA256 314c0d1d1b643a97e13c166c75b3d73584c195d6b118e369e28af47156b12dc7
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-20_1acebdcab092c03a3cbf9076ddf1b1f4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-20_1acebdcab092c03a3cbf9076ddf1b1f4_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{88629194-7AF8-4168-91EC-234A58DD4656}.exeC:\Windows\{88629194-7AF8-4168-91EC-234A58DD4656}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7EFFD59E-33F9-429f-B107-2995BBB62D49}.exeC:\Windows\{7EFFD59E-33F9-429f-B107-2995BBB62D49}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{900D5A50-2BDA-45de-B4D3-A9B1D0E5B7BF}.exeC:\Windows\{900D5A50-2BDA-45de-B4D3-A9B1D0E5B7BF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7EC7DC61-B8B4-47a2-9DF7-534FB9B6E44D}.exeC:\Windows\{7EC7DC61-B8B4-47a2-9DF7-534FB9B6E44D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5114D010-2FEA-4a94-9C16-E12E78478ADF}.exeC:\Windows\{5114D010-2FEA-4a94-9C16-E12E78478ADF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3CB60B9-D913-4f6b-B9FC-3186BCBB01A8}.exeC:\Windows\{B3CB60B9-D913-4f6b-B9FC-3186BCBB01A8}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE875531-E936-4c36-AE09-A7FC975DAA0B}.exeC:\Windows\{CE875531-E936-4c36-AE09-A7FC975DAA0B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60CCEF6C-E326-40b6-8FF1-70EAA48E5783}.exeC:\Windows\{60CCEF6C-E326-40b6-8FF1-70EAA48E5783}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C39E0A5-A5DA-49f4-8C21-2D5B26B19E0A}.exeC:\Windows\{5C39E0A5-A5DA-49f4-8C21-2D5B26B19E0A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{822A0F47-DE79-44d2-908F-02A50CCA9B27}.exeC:\Windows\{822A0F47-DE79-44d2-908F-02A50CCA9B27}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2B23E2F-BB82-43f5-944A-01F0650841CC}.exeC:\Windows\{A2B23E2F-BB82-43f5-944A-01F0650841CC}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{822A0~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C39E~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60CCE~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE875~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3CB6~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5114D~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7EC7D~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{900D5~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7EFFD~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88629~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{5114D010-2FEA-4a94-9C16-E12E78478ADF}.exe
{5C39E0A5-A5DA-49f4-8C21-2D5B26B19E0A}.exe
{60CCEF6C-E326-40b6-8FF1-70EAA48E5783}.exe
{7EC7DC61-B8B4-47a2-9DF7-534FB9B6E44D}.exe
{7EFFD59E-33F9-429f-B107-2995BBB62D49}.exe
{822A0F47-DE79-44d2-908F-02A50CCA9B27}.exe
{88629194-7AF8-4168-91EC-234A58DD4656}.exe
{900D5A50-2BDA-45de-B4D3-A9B1D0E5B7BF}.exe
{A2B23E2F-BB82-43f5-944A-01F0650841CC}.exe
{B3CB60B9-D913-4f6b-B9FC-3186BCBB01A8}.exe
{CE875531-E936-4c36-AE09-A7FC975DAA0B}.exe
memory/1324-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1324-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1700-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2140-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2140-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2324-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2324-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2324-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3388-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3388-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4452-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4452-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4972-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4972-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4972-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5012-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5012-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5160-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5160-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5260-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5260-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5304-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5304-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5888-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5888-76-0x0000000000400000-0x0000000000410000-memory.dmp