Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 06:42
General
- Target 2026-10-26_cb86306362e40c2dd96825f1be6b56ac_elex_wannacry.exe
- Size 60KB
- Sample261027-hgkctsa16w
- SHA256 87fe14b9d6ab918a7eda761498e1a0a595576d6c24a347d6f6a24254b6d59888
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_cb86306362e40c2dd96825f1be6b56ac_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_cb86306362e40c2dd96825f1be6b56ac_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE0AE59B-1BC6-4062-B22F-6985BDC16363}.exeC:\Windows\{DE0AE59B-1BC6-4062-B22F-6985BDC16363}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1283A7CB-601A-4f55-8EB7-F5FB8F67CA87}.exeC:\Windows\{1283A7CB-601A-4f55-8EB7-F5FB8F67CA87}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E62DCBA-F339-4eab-8543-5F3667FC0BE8}.exeC:\Windows\{9E62DCBA-F339-4eab-8543-5F3667FC0BE8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA06C2A7-CB30-405e-A042-771300253F7C}.exeC:\Windows\{CA06C2A7-CB30-405e-A042-771300253F7C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C5DE3C95-81F4-4fc1-ABC7-628DAA4929DC}.exeC:\Windows\{C5DE3C95-81F4-4fc1-ABC7-628DAA4929DC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC98E323-E403-424b-8425-7B56ED93E3AE}.exeC:\Windows\{AC98E323-E403-424b-8425-7B56ED93E3AE}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBE99C0A-2F47-4457-9B4D-C3A9C4E21E35}.exeC:\Windows\{CBE99C0A-2F47-4457-9B4D-C3A9C4E21E35}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDD36395-DCF3-4946-877B-5984292C66D3}.exeC:\Windows\{CDD36395-DCF3-4946-877B-5984292C66D3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBAE9FBC-9A6D-48dd-B3DD-E20664FC5112}.exeC:\Windows\{BBAE9FBC-9A6D-48dd-B3DD-E20664FC5112}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{23C58212-9FA6-4b1e-A30B-2FD5BE810FE4}.exeC:\Windows\{23C58212-9FA6-4b1e-A30B-2FD5BE810FE4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{598C170A-3BE8-4c2f-8B50-3D25FB8E0E08}.exeC:\Windows\{598C170A-3BE8-4c2f-8B50-3D25FB8E0E08}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23C58~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBAE9~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDD36~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBE99~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC98E~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5DE3~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA06C~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E62D~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1283A~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE0AE~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1283A7CB-601A-4f55-8EB7-F5FB8F67CA87}.exe
{23C58212-9FA6-4b1e-A30B-2FD5BE810FE4}.exe
{598C170A-3BE8-4c2f-8B50-3D25FB8E0E08}.exe
{9E62DCBA-F339-4eab-8543-5F3667FC0BE8}.exe
{AC98E323-E403-424b-8425-7B56ED93E3AE}.exe
{BBAE9FBC-9A6D-48dd-B3DD-E20664FC5112}.exe
{C5DE3C95-81F4-4fc1-ABC7-628DAA4929DC}.exe
{CA06C2A7-CB30-405e-A042-771300253F7C}.exe
{CBE99C0A-2F47-4457-9B4D-C3A9C4E21E35}.exe
{CDD36395-DCF3-4946-877B-5984292C66D3}.exe
{DE0AE59B-1BC6-4062-B22F-6985BDC16363}.exe
memory/940-75-0x0000000000400000-0x0000000000410000-memory.dmp
memory/940-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1076-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1076-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2052-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2240-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2240-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2320-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2320-68-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2576-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2576-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2600-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2600-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2600-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3184-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3184-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3216-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3216-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3668-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3668-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4564-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4564-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4868-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4868-27-0x0000000000400000-0x0000000000410000-memory.dmp