Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 21:36
General
- Target 2026-10-22_101247e70ae040576c0e4213746cbb87_elex_wannacry.exe
- Size 88KB
- Sample261024-1gerfsss2k
- SHA256 fc573f6d47d3bb3572b8abb51a8d8f94c9ef9b37461535511f39bbd7bbcf4ac1
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_101247e70ae040576c0e4213746cbb87_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_101247e70ae040576c0e4213746cbb87_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB77CD12-2970-4635-80EE-8B000438DA8F}.exeC:\Windows\{CB77CD12-2970-4635-80EE-8B000438DA8F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8BCB0B2-33B0-4d00-9651-A509A5DE3DAE}.exeC:\Windows\{E8BCB0B2-33B0-4d00-9651-A509A5DE3DAE}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E3B873D-1076-4ab3-B211-930352879A8B}.exeC:\Windows\{2E3B873D-1076-4ab3-B211-930352879A8B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B0FC663-2972-478a-9AA5-A16EBC6804A2}.exeC:\Windows\{8B0FC663-2972-478a-9AA5-A16EBC6804A2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E1CA255B-0682-4ddc-8840-98F71FAD9827}.exeC:\Windows\{E1CA255B-0682-4ddc-8840-98F71FAD9827}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC9D0389-E4FD-47b7-BB76-20D72154A895}.exeC:\Windows\{BC9D0389-E4FD-47b7-BB76-20D72154A895}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3AB0131-5AC1-41c7-A537-7B8351ED267D}.exeC:\Windows\{D3AB0131-5AC1-41c7-A537-7B8351ED267D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06835888-E1D9-45d6-B286-E9FFAB2ED1D6}.exeC:\Windows\{06835888-E1D9-45d6-B286-E9FFAB2ED1D6}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6454DEF-F1EA-4d23-A179-5BBE534719C3}.exeC:\Windows\{C6454DEF-F1EA-4d23-A179-5BBE534719C3}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8148BAF-15D2-40c2-9EC4-6014A702E285}.exeC:\Windows\{B8148BAF-15D2-40c2-9EC4-6014A702E285}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97534F34-6A0B-485f-8C4E-7E7ED8C712FD}.exeC:\Windows\{97534F34-6A0B-485f-8C4E-7E7ED8C712FD}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8148~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6454~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06835~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3AB0~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC9D0~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1CA2~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B0FC~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E3B8~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8BCB~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB77C~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{06835888-E1D9-45d6-B286-E9FFAB2ED1D6}.exe
{2E3B873D-1076-4ab3-B211-930352879A8B}.exe
{8B0FC663-2972-478a-9AA5-A16EBC6804A2}.exe
{97534F34-6A0B-485f-8C4E-7E7ED8C712FD}.exe
{B8148BAF-15D2-40c2-9EC4-6014A702E285}.exe
{BC9D0389-E4FD-47b7-BB76-20D72154A895}.exe
{C6454DEF-F1EA-4d23-A179-5BBE534719C3}.exe
{CB77CD12-2970-4635-80EE-8B000438DA8F}.exe
{D3AB0131-5AC1-41c7-A537-7B8351ED267D}.exe
{E1CA255B-0682-4ddc-8840-98F71FAD9827}.exe
{E8BCB0B2-33B0-4d00-9651-A509A5DE3DAE}.exe
memory/608-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/608-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/992-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/992-9-0x0000000000400000-0x0000000000411000-memory.dmp
memory/992-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1028-43-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1028-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1908-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1908-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2904-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2904-76-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3488-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3488-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3856-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3856-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4556-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4556-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4656-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4656-15-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5052-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5052-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5052-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5368-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5428-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5428-56-0x0000000000400000-0x0000000000411000-memory.dmp