Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 00:26
General
- Target 2026-10-25_6fc66d1be827290a040be1e8993c37f5_elex_wannacry.exe
- Size 64KB
- Sample261027-arg2fsat6n
- SHA256 212795343e24188ff60baccda905f633cd2ed1ed6c16d98a354a296414397ac6
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_6fc66d1be827290a040be1e8993c37f5_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_6fc66d1be827290a040be1e8993c37f5_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C2CFB6E-4054-4caa-9FC2-22DCA99551E4}.exeC:\Windows\{4C2CFB6E-4054-4caa-9FC2-22DCA99551E4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{774D67D4-3AD5-4cf1-B900-00AAC90B4A81}.exeC:\Windows\{774D67D4-3AD5-4cf1-B900-00AAC90B4A81}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E00A11B9-AAB7-4c63-B322-3A5CC86DF97A}.exeC:\Windows\{E00A11B9-AAB7-4c63-B322-3A5CC86DF97A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6AD8587F-C8BF-4543-BF5F-3BB6B8D0FEA9}.exeC:\Windows\{6AD8587F-C8BF-4543-BF5F-3BB6B8D0FEA9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75679539-90C9-473a-BD0B-9E4C352A49ED}.exeC:\Windows\{75679539-90C9-473a-BD0B-9E4C352A49ED}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{266FE229-33ED-42c7-9898-2F194C08A907}.exeC:\Windows\{266FE229-33ED-42c7-9898-2F194C08A907}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E77FED16-1253-448f-8563-713F4A5F3DAF}.exeC:\Windows\{E77FED16-1253-448f-8563-713F4A5F3DAF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D14F9756-6799-46f2-BCD5-8354F4AC7467}.exeC:\Windows\{D14F9756-6799-46f2-BCD5-8354F4AC7467}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{23394181-6443-4b32-B185-5B1D77E1ED70}.exeC:\Windows\{23394181-6443-4b32-B185-5B1D77E1ED70}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89008870-11A4-4200-ABEF-0974C21170CF}.exeC:\Windows\{89008870-11A4-4200-ABEF-0974C21170CF}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A91FD59-A8A6-4189-A01E-B4F63E53CE1D}.exeC:\Windows\{4A91FD59-A8A6-4189-A01E-B4F63E53CE1D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89008~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23394~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D14F9~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E77FE~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{266FE~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75679~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6AD85~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E00A1~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{774D6~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C2CF~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{23394181-6443-4b32-B185-5B1D77E1ED70}.exe
{266FE229-33ED-42c7-9898-2F194C08A907}.exe
{4A91FD59-A8A6-4189-A01E-B4F63E53CE1D}.exe
{4C2CFB6E-4054-4caa-9FC2-22DCA99551E4}.exe
{6AD8587F-C8BF-4543-BF5F-3BB6B8D0FEA9}.exe
{75679539-90C9-473a-BD0B-9E4C352A49ED}.exe
{774D67D4-3AD5-4cf1-B900-00AAC90B4A81}.exe
{89008870-11A4-4200-ABEF-0974C21170CF}.exe
{D14F9756-6799-46f2-BCD5-8354F4AC7467}.exe
{E00A11B9-AAB7-4c63-B322-3A5CC86DF97A}.exe
{E77FED16-1253-448f-8563-713F4A5F3DAF}.exe
memory/592-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/592-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1220-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1220-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1416-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1416-61-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1920-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1920-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2544-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2544-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3316-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3316-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4228-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4228-68-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4392-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4604-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4604-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5028-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5028-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5028-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5692-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5692-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5960-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5960-13-0x0000000000400000-0x0000000000410000-memory.dmp