Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 16:12
General
- Target 2026-10-31_10374348d8afaf4e5f7dc47473830c8f_elex_wannacry.exe
- Size 79KB
- Sample261031-tnt2dscv9s
- SHA256 2641569ceb646ea8b2153b7927e269a7bc345c0015309e905e8af29dc4647d15
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-31_10374348d8afaf4e5f7dc47473830c8f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-31_10374348d8afaf4e5f7dc47473830c8f_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E960F969-73B8-4d79-91F1-654EF8BC0A42}.exeC:\Windows\{E960F969-73B8-4d79-91F1-654EF8BC0A42}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F149BE8-C82C-4fa7-9C1E-44EB6F0E7BDB}.exeC:\Windows\{9F149BE8-C82C-4fa7-9C1E-44EB6F0E7BDB}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F8887398-819B-4cc5-8D67-B6BFEFE088AE}.exeC:\Windows\{F8887398-819B-4cc5-8D67-B6BFEFE088AE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C8D3B177-D068-45cd-8BD6-C0621C8FE762}.exeC:\Windows\{C8D3B177-D068-45cd-8BD6-C0621C8FE762}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DBEA089-6C8F-476c-BB18-BD8AEA3C493C}.exeC:\Windows\{1DBEA089-6C8F-476c-BB18-BD8AEA3C493C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5E31B93-DC24-4526-AE89-A7EDAD1B25BF}.exeC:\Windows\{E5E31B93-DC24-4526-AE89-A7EDAD1B25BF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B574995F-BCCE-4b85-8538-920D01576011}.exeC:\Windows\{B574995F-BCCE-4b85-8538-920D01576011}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61E10106-BA4D-4bd4-8259-7AB4358D4CFF}.exeC:\Windows\{61E10106-BA4D-4bd4-8259-7AB4358D4CFF}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EABABB0E-82BE-4fb4-9B66-EBCAF0C91397}.exeC:\Windows\{EABABB0E-82BE-4fb4-9B66-EBCAF0C91397}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F8333D09-BB85-42d0-B52B-33B840D7438E}.exeC:\Windows\{F8333D09-BB85-42d0-B52B-33B840D7438E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B954EE3-0BD5-4a8c-A683-0F7C15A05A1C}.exeC:\Windows\{5B954EE3-0BD5-4a8c-A683-0F7C15A05A1C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8333~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EABAB~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61E10~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5749~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5E31~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DBEA~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8D3B~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8887~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F149~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E960F~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1DBEA089-6C8F-476c-BB18-BD8AEA3C493C}.exe
{5B954EE3-0BD5-4a8c-A683-0F7C15A05A1C}.exe
{61E10106-BA4D-4bd4-8259-7AB4358D4CFF}.exe
{9F149BE8-C82C-4fa7-9C1E-44EB6F0E7BDB}.exe
{B574995F-BCCE-4b85-8538-920D01576011}.exe
{C8D3B177-D068-45cd-8BD6-C0621C8FE762}.exe
{E5E31B93-DC24-4526-AE89-A7EDAD1B25BF}.exe
{E960F969-73B8-4d79-91F1-654EF8BC0A42}.exe
{EABABB0E-82BE-4fb4-9B66-EBCAF0C91397}.exe
{F8333D09-BB85-42d0-B52B-33B840D7438E}.exe
{F8887398-819B-4cc5-8D67-B6BFEFE088AE}.exe