Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
31/10/2026, 19:41
General
- Target 2026-10-30_cc2aefb3ded5d3389fcf3aeb389e45e2_elex_wannacry.exe
- Size 372KB
- Sample261031-yd39jaac64
- SHA256 aaac9153b5eb69b6167d6d31a26237d277277961372bf3b4bd5ea7fcd68244a4
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_cc2aefb3ded5d3389fcf3aeb389e45e2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_cc2aefb3ded5d3389fcf3aeb389e45e2_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{708FE6CA-E289-46f9-BD18-46E78147D0B2}.exeC:\Windows\{708FE6CA-E289-46f9-BD18-46E78147D0B2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F8C0E4D-D6C5-4a01-91B1-3573F42E63C0}.exeC:\Windows\{6F8C0E4D-D6C5-4a01-91B1-3573F42E63C0}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E598E4E-C6F7-45f8-806E-F0692DC2C8FD}.exeC:\Windows\{9E598E4E-C6F7-45f8-806E-F0692DC2C8FD}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{023DC695-A339-48b3-8DFD-FF3A676E7046}.exeC:\Windows\{023DC695-A339-48b3-8DFD-FF3A676E7046}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B7EC69C-58D3-4a5b-ADA2-C0F2CC0F08C0}.exeC:\Windows\{2B7EC69C-58D3-4a5b-ADA2-C0F2CC0F08C0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{196836E7-1583-42ec-BDD8-4916B09D71A7}.exeC:\Windows\{196836E7-1583-42ec-BDD8-4916B09D71A7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C371B106-9CEE-4efd-9AE4-1D30147A3FE7}.exeC:\Windows\{C371B106-9CEE-4efd-9AE4-1D30147A3FE7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF21C9F7-C5C9-44de-B215-EE84BB5D4E84}.exeC:\Windows\{DF21C9F7-C5C9-44de-B215-EE84BB5D4E84}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02DF31B3-8551-48b6-B2BE-EDE939B69F46}.exeC:\Windows\{02DF31B3-8551-48b6-B2BE-EDE939B69F46}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E97A462B-6F15-4e57-8A4E-48AD1A28F24F}.exeC:\Windows\{E97A462B-6F15-4e57-8A4E-48AD1A28F24F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC4A35BB-03F4-4027-A4C7-BCDBF958E8A7}.exeC:\Windows\{BC4A35BB-03F4-4027-A4C7-BCDBF958E8A7}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E97A4~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02DF3~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF21C~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C371B~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19683~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B7EC~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{023DC~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E598~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F8C0~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{708FE~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{023DC695-A339-48b3-8DFD-FF3A676E7046}.exe
{02DF31B3-8551-48b6-B2BE-EDE939B69F46}.exe
{196836E7-1583-42ec-BDD8-4916B09D71A7}.exe
{2B7EC69C-58D3-4a5b-ADA2-C0F2CC0F08C0}.exe
{6F8C0E4D-D6C5-4a01-91B1-3573F42E63C0}.exe
{708FE6CA-E289-46f9-BD18-46E78147D0B2}.exe
{9E598E4E-C6F7-45f8-806E-F0692DC2C8FD}.exe
{BC4A35BB-03F4-4027-A4C7-BCDBF958E8A7}.exe
{C371B106-9CEE-4efd-9AE4-1D30147A3FE7}.exe
{DF21C9F7-C5C9-44de-B215-EE84BB5D4E84}.exe
{E97A462B-6F15-4e57-8A4E-48AD1A28F24F}.exe