Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/10/2026, 02:59
General
- Target 2026-10-19_17168b4a176145b250895109b3025994_elex_wannacry.exe
- Size 76KB
- Sample261021-dg65dact5n
- SHA256 fd64afbb374d97ebe1b516cd8db10aea7f396ea39a78138baca2ab104c7ebf3e
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_17168b4a176145b250895109b3025994_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_17168b4a176145b250895109b3025994_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7CAD280-E71F-49dd-A124-01F705967ECA}.exeC:\Windows\{E7CAD280-E71F-49dd-A124-01F705967ECA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3CA2CC47-2E84-4958-AE1D-17266D47CC2B}.exeC:\Windows\{3CA2CC47-2E84-4958-AE1D-17266D47CC2B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80B74DCC-E451-4a1d-9CA2-6087AAB4B70A}.exeC:\Windows\{80B74DCC-E451-4a1d-9CA2-6087AAB4B70A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3895D31D-B616-4c9b-AF26-BC038752D3A1}.exeC:\Windows\{3895D31D-B616-4c9b-AF26-BC038752D3A1}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73B72E2B-7B10-43f4-A472-173BEC9E6D0A}.exeC:\Windows\{73B72E2B-7B10-43f4-A472-173BEC9E6D0A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A58B2D85-7085-4188-9390-7F8EAB082FC7}.exeC:\Windows\{A58B2D85-7085-4188-9390-7F8EAB082FC7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2435CE24-AD78-4f95-9C22-D6040FCDFB9D}.exeC:\Windows\{2435CE24-AD78-4f95-9C22-D6040FCDFB9D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03323D2D-6859-49be-B345-707F496C9341}.exeC:\Windows\{03323D2D-6859-49be-B345-707F496C9341}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60CF50D4-123D-4926-AB7A-D1560BD1860F}.exeC:\Windows\{60CF50D4-123D-4926-AB7A-D1560BD1860F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD52EE5F-315E-4fe4-BA7F-908B5F619C9D}.exeC:\Windows\{CD52EE5F-315E-4fe4-BA7F-908B5F619C9D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A45AEA39-642F-4998-895F-E5348C0345D0}.exeC:\Windows\{A45AEA39-642F-4998-895F-E5348C0345D0}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD52E~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60CF5~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03323~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2435C~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A58B2~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73B72~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3895D~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80B74~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CA2C~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7CAD~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{03323D2D-6859-49be-B345-707F496C9341}.exe
{2435CE24-AD78-4f95-9C22-D6040FCDFB9D}.exe
{3895D31D-B616-4c9b-AF26-BC038752D3A1}.exe
{3CA2CC47-2E84-4958-AE1D-17266D47CC2B}.exe
{60CF50D4-123D-4926-AB7A-D1560BD1860F}.exe
{73B72E2B-7B10-43f4-A472-173BEC9E6D0A}.exe
{80B74DCC-E451-4a1d-9CA2-6087AAB4B70A}.exe
{A45AEA39-642F-4998-895F-E5348C0345D0}.exe
{A58B2D85-7085-4188-9390-7F8EAB082FC7}.exe
{CD52EE5F-315E-4fe4-BA7F-908B5F619C9D}.exe
{E7CAD280-E71F-49dd-A124-01F705967ECA}.exe