Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 14:22
General
- Target 2026-10-22_4845a84e3e269078dc2e481756c6255f_elex_wannacry.exe
- Size 92KB
- Sample261024-rpshvavvds
- SHA256 603678e2e2e95020aa9d1157f68063311661542c043a99147e1403f74bdb61d2
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_4845a84e3e269078dc2e481756c6255f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4845a84e3e269078dc2e481756c6255f_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FE4B3A98-A93D-4229-816D-2983849951D4}.exeC:\Windows\{FE4B3A98-A93D-4229-816D-2983849951D4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F373B801-447C-4b99-B186-F09F075DCA89}.exeC:\Windows\{F373B801-447C-4b99-B186-F09F075DCA89}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{41ED3359-FB23-4299-9937-4950F7DFAB42}.exeC:\Windows\{41ED3359-FB23-4299-9937-4950F7DFAB42}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7AE5F2AE-DBE8-4970-96E1-5A8A3A310C36}.exeC:\Windows\{7AE5F2AE-DBE8-4970-96E1-5A8A3A310C36}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B5E5EDE-151E-477e-9679-C8B972E96F16}.exeC:\Windows\{2B5E5EDE-151E-477e-9679-C8B972E96F16}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2B55A51-1CA6-4607-9889-11D7F10267F2}.exeC:\Windows\{F2B55A51-1CA6-4607-9889-11D7F10267F2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93A7FADD-E925-4c07-98FA-FA8598F5E557}.exeC:\Windows\{93A7FADD-E925-4c07-98FA-FA8598F5E557}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53FE30B2-EA36-424b-88C8-F5E77CA14EEB}.exeC:\Windows\{53FE30B2-EA36-424b-88C8-F5E77CA14EEB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9EBBC09-9C5A-4537-8186-BB0D36A81D33}.exeC:\Windows\{F9EBBC09-9C5A-4537-8186-BB0D36A81D33}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2D46347-75A9-44c0-8E79-596856B4D198}.exeC:\Windows\{C2D46347-75A9-44c0-8E79-596856B4D198}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35A98731-D6B6-40f2-BA56-74EFB3B5E322}.exeC:\Windows\{35A98731-D6B6-40f2-BA56-74EFB3B5E322}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2D46~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9EBB~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53FE3~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93A7F~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2B55~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B5E5~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7AE5F~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41ED3~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F373B~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE4B3~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2B5E5EDE-151E-477e-9679-C8B972E96F16}.exe
{35A98731-D6B6-40f2-BA56-74EFB3B5E322}.exe
{41ED3359-FB23-4299-9937-4950F7DFAB42}.exe
{53FE30B2-EA36-424b-88C8-F5E77CA14EEB}.exe
{7AE5F2AE-DBE8-4970-96E1-5A8A3A310C36}.exe
{93A7FADD-E925-4c07-98FA-FA8598F5E557}.exe
{C2D46347-75A9-44c0-8E79-596856B4D198}.exe
{F2B55A51-1CA6-4607-9889-11D7F10267F2}.exe
{F373B801-447C-4b99-B186-F09F075DCA89}.exe
{F9EBBC09-9C5A-4537-8186-BB0D36A81D33}.exe
{FE4B3A98-A93D-4229-816D-2983849951D4}.exe
memory/904-70-0x0000000000400000-0x0000000000417000-memory.dmp
memory/904-64-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1140-42-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1140-47-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2096-26-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2096-22-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2148-54-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2148-49-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2240-62-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2240-56-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2240-58-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2832-19-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2832-14-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4488-78-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4488-71-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4608-1-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4608-7-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4608-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4652-77-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4988-33-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4988-28-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5096-12-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5096-6-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5216-35-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5216-41-0x0000000000400000-0x0000000000417000-memory.dmp