Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 04:45
General
- Target 2026-10-26_df76961283fe8dc537a6ecf2bec52837_elex_wannacry.exe
- Size 68KB
- Sample261027-fdstpacf83
- SHA256 8cb206dbf7eb4a63eb340a4596b68273113da478063ec23d95d31cdff2dc8405
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_df76961283fe8dc537a6ecf2bec52837_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_df76961283fe8dc537a6ecf2bec52837_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{047A7571-AEB0-4497-A7E7-2F69B171DFF0}.exeC:\Windows\{047A7571-AEB0-4497-A7E7-2F69B171DFF0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91AE8FE6-A801-41db-9978-B2CBCEF51652}.exeC:\Windows\{91AE8FE6-A801-41db-9978-B2CBCEF51652}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{994AAD5F-15B5-4332-AE2E-32AFDBBF054A}.exeC:\Windows\{994AAD5F-15B5-4332-AE2E-32AFDBBF054A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C0652842-2CCB-4056-8CAA-12C725C814D6}.exeC:\Windows\{C0652842-2CCB-4056-8CAA-12C725C814D6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6CED9DC9-C048-454e-9740-68383BF58BD8}.exeC:\Windows\{6CED9DC9-C048-454e-9740-68383BF58BD8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F30D5D86-8C01-4a0f-AA2C-2A42012456D2}.exeC:\Windows\{F30D5D86-8C01-4a0f-AA2C-2A42012456D2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{756450F9-E3E2-47fe-A56E-660874ABA03A}.exeC:\Windows\{756450F9-E3E2-47fe-A56E-660874ABA03A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD2466E4-496E-4f68-A554-5434E62E9C48}.exeC:\Windows\{CD2466E4-496E-4f68-A554-5434E62E9C48}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49AA322E-D318-4e91-8696-9B0F249E34E0}.exeC:\Windows\{49AA322E-D318-4e91-8696-9B0F249E34E0}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91E18705-5E9D-44da-9409-50EB051774AA}.exeC:\Windows\{91E18705-5E9D-44da-9409-50EB051774AA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F3BE5D87-F9D9-4cee-A24D-6C692F0962E5}.exeC:\Windows\{F3BE5D87-F9D9-4cee-A24D-6C692F0962E5}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91E18~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49AA3~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD246~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75645~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F30D5~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6CED9~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0652~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{994AA~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91AE8~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{047A7~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{047A7571-AEB0-4497-A7E7-2F69B171DFF0}.exe
{49AA322E-D318-4e91-8696-9B0F249E34E0}.exe
{6CED9DC9-C048-454e-9740-68383BF58BD8}.exe
{756450F9-E3E2-47fe-A56E-660874ABA03A}.exe
{91AE8FE6-A801-41db-9978-B2CBCEF51652}.exe
{91E18705-5E9D-44da-9409-50EB051774AA}.exe
{994AAD5F-15B5-4332-AE2E-32AFDBBF054A}.exe
{C0652842-2CCB-4056-8CAA-12C725C814D6}.exe
{CD2466E4-496E-4f68-A554-5434E62E9C48}.exe
{F30D5D86-8C01-4a0f-AA2C-2A42012456D2}.exe
{F3BE5D87-F9D9-4cee-A24D-6C692F0962E5}.exe
memory/2708-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2708-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3444-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3444-26-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3620-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3620-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3832-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3832-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4160-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4160-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4332-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4716-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4716-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4864-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4864-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4884-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4884-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4884-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5620-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5620-72-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5620-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5708-62-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5708-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6004-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6004-14-0x0000000000400000-0x0000000000411000-memory.dmp