Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 01:48
General
- Target 2026-10-28_766d40d6d70fee95040920f2fc694508_elex_wannacry.exe
- Size 64KB
- Sample261030-b79bbagv8w
- SHA256 7a873686f58d0cadecec0abb7f4cb803138fe7632604ebe92e4c769b78778e54
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 37 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_766d40d6d70fee95040920f2fc694508_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_766d40d6d70fee95040920f2fc694508_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7368848E-8219-4869-BDA7-CDC453EC0ECD}.exeC:\Windows\{7368848E-8219-4869-BDA7-CDC453EC0ECD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{419E1927-5B16-4bb0-9331-B26B14A3F72B}.exeC:\Windows\{419E1927-5B16-4bb0-9331-B26B14A3F72B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F29234C-AFE1-4a03-B513-80F13A2812A8}.exeC:\Windows\{0F29234C-AFE1-4a03-B513-80F13A2812A8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8D9BD497-AD9A-4a62-88BC-00BD80B47C38}.exeC:\Windows\{8D9BD497-AD9A-4a62-88BC-00BD80B47C38}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C44082DB-2AC0-4d2e-BD68-F54816F68CC7}.exeC:\Windows\{C44082DB-2AC0-4d2e-BD68-F54816F68CC7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93B5DF94-845C-43ff-8ABE-68651CAF8040}.exeC:\Windows\{93B5DF94-845C-43ff-8ABE-68651CAF8040}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B98328CF-2B74-4efc-8300-F4FDDFF86F44}.exeC:\Windows\{B98328CF-2B74-4efc-8300-F4FDDFF86F44}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9A8C4896-8411-4bf4-91FE-9670DB872C82}.exeC:\Windows\{9A8C4896-8411-4bf4-91FE-9670DB872C82}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDD044B6-5470-45bf-9821-E03E7F885FFE}.exeC:\Windows\{CDD044B6-5470-45bf-9821-E03E7F885FFE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{778C5967-8D5B-45b2-9015-9DFAA102E90C}.exeC:\Windows\{778C5967-8D5B-45b2-9015-9DFAA102E90C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1495569F-1BEB-430b-92FE-58BB99470B79}.exeC:\Windows\{1495569F-1BEB-430b-92FE-58BB99470B79}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{778C5~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDD04~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A8C4~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9832~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93B5D~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4408~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D9BD~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F292~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{419E1~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73688~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0F29234C-AFE1-4a03-B513-80F13A2812A8}.exe
{1495569F-1BEB-430b-92FE-58BB99470B79}.exe
{419E1927-5B16-4bb0-9331-B26B14A3F72B}.exe
{7368848E-8219-4869-BDA7-CDC453EC0ECD}.exe
{778C5967-8D5B-45b2-9015-9DFAA102E90C}.exe
{8D9BD497-AD9A-4a62-88BC-00BD80B47C38}.exe
{93B5DF94-845C-43ff-8ABE-68651CAF8040}.exe
{9A8C4896-8411-4bf4-91FE-9670DB872C82}.exe
{B98328CF-2B74-4efc-8300-F4FDDFF86F44}.exe
{C44082DB-2AC0-4d2e-BD68-F54816F68CC7}.exe
{CDD044B6-5470-45bf-9821-E03E7F885FFE}.exe
memory/404-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/404-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/576-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/576-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/944-79-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1396-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1396-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1880-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1880-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1884-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1884-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1884-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2144-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2144-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3712-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3712-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3712-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4664-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4664-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5076-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5076-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5436-72-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5436-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6128-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6128-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6128-14-0x0000000000400000-0x0000000000410000-memory.dmp