Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 15:49
General
- Target 2026-10-19_792fad4bce27502a411d927bb06d1d07_elex_wannacry.exe
- Size 60KB
- Sample261020-s9n7lasz9m
- SHA256 bee6f7abf3304a0093e7ea94989a9785a90ff4ee66f3a740451a946031e96918
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_792fad4bce27502a411d927bb06d1d07_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_792fad4bce27502a411d927bb06d1d07_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7A049D1-EBB9-4493-9E9D-4E01B4DC99FE}.exeC:\Windows\{E7A049D1-EBB9-4493-9E9D-4E01B4DC99FE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D79715D-1731-4ac9-87B8-DED13C0F26DC}.exeC:\Windows\{9D79715D-1731-4ac9-87B8-DED13C0F26DC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{69D8FC3C-EB17-483d-ACE7-13E4AFFD6E24}.exeC:\Windows\{69D8FC3C-EB17-483d-ACE7-13E4AFFD6E24}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{11E2D2E3-E179-49d6-A5DD-DD62156D7E6C}.exeC:\Windows\{11E2D2E3-E179-49d6-A5DD-DD62156D7E6C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E20501EA-46F6-4fe2-83BC-5C5A2A3A12E7}.exeC:\Windows\{E20501EA-46F6-4fe2-83BC-5C5A2A3A12E7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{670CC783-8D1A-44d5-8E05-66A4D64B1600}.exeC:\Windows\{670CC783-8D1A-44d5-8E05-66A4D64B1600}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C4A9F20-CF6D-4f3c-9879-1C097B038FE7}.exeC:\Windows\{5C4A9F20-CF6D-4f3c-9879-1C097B038FE7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12CBCDF7-291B-4660-9627-B6C351CDDD60}.exeC:\Windows\{12CBCDF7-291B-4660-9627-B6C351CDDD60}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C468387D-CD4B-449f-9DB9-673C6765917C}.exeC:\Windows\{C468387D-CD4B-449f-9DB9-673C6765917C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50BBAC9F-6CAD-4e0f-97AD-CAC8F1060482}.exeC:\Windows\{50BBAC9F-6CAD-4e0f-97AD-CAC8F1060482}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{367B1F7D-6678-4f3d-A77F-BE0747E351F7}.exeC:\Windows\{367B1F7D-6678-4f3d-A77F-BE0747E351F7}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50BBA~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4683~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12CBC~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C4A9~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{670CC~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2050~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11E2D~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69D8F~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D797~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7A04~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{11E2D2E3-E179-49d6-A5DD-DD62156D7E6C}.exe
{12CBCDF7-291B-4660-9627-B6C351CDDD60}.exe
{367B1F7D-6678-4f3d-A77F-BE0747E351F7}.exe
{50BBAC9F-6CAD-4e0f-97AD-CAC8F1060482}.exe
{5C4A9F20-CF6D-4f3c-9879-1C097B038FE7}.exe
{670CC783-8D1A-44d5-8E05-66A4D64B1600}.exe
{69D8FC3C-EB17-483d-ACE7-13E4AFFD6E24}.exe
{9D79715D-1731-4ac9-87B8-DED13C0F26DC}.exe
{C468387D-CD4B-449f-9DB9-673C6765917C}.exe
{E20501EA-46F6-4fe2-83BC-5C5A2A3A12E7}.exe
{E7A049D1-EBB9-4493-9E9D-4E01B4DC99FE}.exe