Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 01:53
General
- Target 2026-10-28_74c3cea4fbde986d141192b1e286619a_elex_wannacry.exe
- Size 68KB
- Sample261030-ca61csvvfv
- SHA256 0dc482ffcebbd85764d2b74308231516ef35bf4a9bbd0d6fbdab8459b7c5ee19
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_74c3cea4fbde986d141192b1e286619a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_74c3cea4fbde986d141192b1e286619a_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AABA4136-9474-4bbc-976B-824F680285CC}.exeC:\Windows\{AABA4136-9474-4bbc-976B-824F680285CC}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D353B90-C899-4b11-9DB6-C20A3CF84D54}.exeC:\Windows\{5D353B90-C899-4b11-9DB6-C20A3CF84D54}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7FF9CD83-BE84-4382-88F7-E095601CF1A7}.exeC:\Windows\{7FF9CD83-BE84-4382-88F7-E095601CF1A7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3CE2CC9-DBD4-4c8c-8A36-EDADC90A9C8F}.exeC:\Windows\{D3CE2CC9-DBD4-4c8c-8A36-EDADC90A9C8F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{889445D4-E12C-46ee-BBEA-C95A55FDF587}.exeC:\Windows\{889445D4-E12C-46ee-BBEA-C95A55FDF587}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3425F2E2-1816-496a-94FF-BE4DD7ECFC9B}.exeC:\Windows\{3425F2E2-1816-496a-94FF-BE4DD7ECFC9B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24189B12-C1C1-4aae-9BD4-393C2B8D58BC}.exeC:\Windows\{24189B12-C1C1-4aae-9BD4-393C2B8D58BC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F3967A5-B8EF-42ac-8D1B-67D0864DE217}.exeC:\Windows\{1F3967A5-B8EF-42ac-8D1B-67D0864DE217}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{556312FC-2DD3-4312-9738-0CD1228CAE47}.exeC:\Windows\{556312FC-2DD3-4312-9738-0CD1228CAE47}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{837CBB14-3E53-43d1-A940-7C276EB2D797}.exeC:\Windows\{837CBB14-3E53-43d1-A940-7C276EB2D797}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27FB0411-A340-4106-BD8C-2D255D521066}.exeC:\Windows\{27FB0411-A340-4106-BD8C-2D255D521066}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{837CB~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55631~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F396~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24189~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3425F~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88944~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3CE2~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7FF9C~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D353~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AABA4~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1F3967A5-B8EF-42ac-8D1B-67D0864DE217}.exe
{24189B12-C1C1-4aae-9BD4-393C2B8D58BC}.exe
{27FB0411-A340-4106-BD8C-2D255D521066}.exe
{3425F2E2-1816-496a-94FF-BE4DD7ECFC9B}.exe
{556312FC-2DD3-4312-9738-0CD1228CAE47}.exe
{5D353B90-C899-4b11-9DB6-C20A3CF84D54}.exe
{7FF9CD83-BE84-4382-88F7-E095601CF1A7}.exe
{837CBB14-3E53-43d1-A940-7C276EB2D797}.exe
{889445D4-E12C-46ee-BBEA-C95A55FDF587}.exe
{AABA4136-9474-4bbc-976B-824F680285CC}.exe
{D3CE2CC9-DBD4-4c8c-8A36-EDADC90A9C8F}.exe
memory/2144-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2144-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2828-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2828-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3044-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3044-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3120-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3120-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3576-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3576-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3576-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3592-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3592-16-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3592-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3664-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3664-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4432-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4432-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4436-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4532-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4532-43-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5728-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5728-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6076-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6076-76-0x0000000000400000-0x0000000000411000-memory.dmp