Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 17:52
General
- Target 2026-10-29_04ea80f2f075980ec04e416faad2b9a2_elex_wannacry.exe
- Size 167KB
- Sample261029-wfn7aaey2l
- SHA256 bd77a48bd9c7e1297f13af1ee3a3b124358f1a1482ba928110c511660174ec59
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-29_04ea80f2f075980ec04e416faad2b9a2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-29_04ea80f2f075980ec04e416faad2b9a2_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE0BCB47-BAAF-45c9-85D7-FA4B2A9825EC}.exeC:\Windows\{DE0BCB47-BAAF-45c9-85D7-FA4B2A9825EC}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E4FF76E-9B3D-4cb2-8A3D-58E7CF230D5B}.exeC:\Windows\{3E4FF76E-9B3D-4cb2-8A3D-58E7CF230D5B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{382897A5-A994-4e22-BCD7-BB81D76E2A11}.exeC:\Windows\{382897A5-A994-4e22-BCD7-BB81D76E2A11}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{70574679-02AC-4d56-A919-A6DD1B09AB15}.exeC:\Windows\{70574679-02AC-4d56-A919-A6DD1B09AB15}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{251B223A-6B2A-4180-9E87-32EF8C11F8D0}.exeC:\Windows\{251B223A-6B2A-4180-9E87-32EF8C11F8D0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9630774B-3133-4e06-AAD4-4DD5DA7EB9AC}.exeC:\Windows\{9630774B-3133-4e06-AAD4-4DD5DA7EB9AC}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D1D542B-2114-4e0a-8B18-174E74DA2B30}.exeC:\Windows\{5D1D542B-2114-4e0a-8B18-174E74DA2B30}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CBAFC7E-62EB-40e4-8134-019ED56B995D}.exeC:\Windows\{2CBAFC7E-62EB-40e4-8134-019ED56B995D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{535F60C6-59E6-47f9-AF5B-1421497D4733}.exeC:\Windows\{535F60C6-59E6-47f9-AF5B-1421497D4733}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03EEF166-A53C-47eb-B8E1-65CCAE53D83C}.exeC:\Windows\{03EEF166-A53C-47eb-B8E1-65CCAE53D83C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93C36A31-647A-4120-BC91-233EB846497B}.exeC:\Windows\{93C36A31-647A-4120-BC91-233EB846497B}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03EEF~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{535F6~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CBAF~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D1D5~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96307~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{251B2~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70574~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38289~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E4FF~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE0BC~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{03EEF166-A53C-47eb-B8E1-65CCAE53D83C}.exe
{251B223A-6B2A-4180-9E87-32EF8C11F8D0}.exe
{2CBAFC7E-62EB-40e4-8134-019ED56B995D}.exe
{382897A5-A994-4e22-BCD7-BB81D76E2A11}.exe
{3E4FF76E-9B3D-4cb2-8A3D-58E7CF230D5B}.exe
{535F60C6-59E6-47f9-AF5B-1421497D4733}.exe
{5D1D542B-2114-4e0a-8B18-174E74DA2B30}.exe
{70574679-02AC-4d56-A919-A6DD1B09AB15}.exe
{93C36A31-647A-4120-BC91-233EB846497B}.exe
{9630774B-3133-4e06-AAD4-4DD5DA7EB9AC}.exe
{DE0BCB47-BAAF-45c9-85D7-FA4B2A9825EC}.exe