Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 02:34
General
- Target 2026-11-01_f8255b56d1f7da959693dd3f8511f89b_elex_wannacry.exe
- Size 60KB
- Sample261102-c2klfadh92
- SHA256 fe64553fb2f7b1239339928df9d57c5f8ce64d29d07cd4ba1f0e37fc1d441de3
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_f8255b56d1f7da959693dd3f8511f89b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f8255b56d1f7da959693dd3f8511f89b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED4CD809-4B4E-4556-A5F2-B584E1B5D81B}.exeC:\Windows\{ED4CD809-4B4E-4556-A5F2-B584E1B5D81B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFA7D6EE-9E00-4e91-8155-D1FB0CED9C1B}.exeC:\Windows\{AFA7D6EE-9E00-4e91-8155-D1FB0CED9C1B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC489B16-F5BA-477d-BBF7-38842A88CBB9}.exeC:\Windows\{DC489B16-F5BA-477d-BBF7-38842A88CBB9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1CC5EE09-8D3D-426b-ABD8-1D8D5E2C837C}.exeC:\Windows\{1CC5EE09-8D3D-426b-ABD8-1D8D5E2C837C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8AC5B443-660F-44b7-A3EB-A3A6DD480587}.exeC:\Windows\{8AC5B443-660F-44b7-A3EB-A3A6DD480587}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E6DF3C9-1049-487e-BD13-AE75D9225E56}.exeC:\Windows\{5E6DF3C9-1049-487e-BD13-AE75D9225E56}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93130DE7-BC8C-4bf6-8AF6-6BAF2E10EB82}.exeC:\Windows\{93130DE7-BC8C-4bf6-8AF6-6BAF2E10EB82}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EFE6ADD1-F85F-44ca-AF9B-4143C7780988}.exeC:\Windows\{EFE6ADD1-F85F-44ca-AF9B-4143C7780988}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4587F9F8-1174-426f-B7C3-A64C90848679}.exeC:\Windows\{4587F9F8-1174-426f-B7C3-A64C90848679}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F784907-3B2A-463e-9568-388C2CF13A9C}.exeC:\Windows\{6F784907-3B2A-463e-9568-388C2CF13A9C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BEB4FC5E-47E0-40cc-A1BD-6FD23107ED9C}.exeC:\Windows\{BEB4FC5E-47E0-40cc-A1BD-6FD23107ED9C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F784~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4587F~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EFE6A~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93130~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E6DF~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AC5B~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1CC5E~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC489~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFA7D~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED4CD~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1CC5EE09-8D3D-426b-ABD8-1D8D5E2C837C}.exe
{4587F9F8-1174-426f-B7C3-A64C90848679}.exe
{5E6DF3C9-1049-487e-BD13-AE75D9225E56}.exe
{6F784907-3B2A-463e-9568-388C2CF13A9C}.exe
{8AC5B443-660F-44b7-A3EB-A3A6DD480587}.exe
{93130DE7-BC8C-4bf6-8AF6-6BAF2E10EB82}.exe
{AFA7D6EE-9E00-4e91-8155-D1FB0CED9C1B}.exe
{BEB4FC5E-47E0-40cc-A1BD-6FD23107ED9C}.exe
{DC489B16-F5BA-477d-BBF7-38842A88CBB9}.exe
{ED4CD809-4B4E-4556-A5F2-B584E1B5D81B}.exe
{EFE6ADD1-F85F-44ca-AF9B-4143C7780988}.exe