Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 09:05
General
- Target 2026-11-01_c6d465e5f6e4cbad0372a7a94e60e7bb_elex_wannacry.exe
- Size 60KB
- Sample261102-k2edestz8l
- SHA256 9de01fb6933fe81e22b04efedc64d3b9a09a7f63c5ad8adbec7278e69d6ff7a8
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_c6d465e5f6e4cbad0372a7a94e60e7bb_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c6d465e5f6e4cbad0372a7a94e60e7bb_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15702627-83EE-4c7a-BB4B-6C452B6F6165}.exeC:\Windows\{15702627-83EE-4c7a-BB4B-6C452B6F6165}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73B67AB2-8410-497a-94B4-0AED2B41A3BF}.exeC:\Windows\{73B67AB2-8410-497a-94B4-0AED2B41A3BF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27A95632-C362-4ee0-BAF2-661F5E0BBEAD}.exeC:\Windows\{27A95632-C362-4ee0-BAF2-661F5E0BBEAD}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26ADDEF7-12AA-441d-A540-4027FFA5179F}.exeC:\Windows\{26ADDEF7-12AA-441d-A540-4027FFA5179F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E78F08B5-DDF5-49c5-8B00-0FA01E0F1F52}.exeC:\Windows\{E78F08B5-DDF5-49c5-8B00-0FA01E0F1F52}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{000DF4E9-8C17-4cfb-9903-7C33E8A9B58B}.exeC:\Windows\{000DF4E9-8C17-4cfb-9903-7C33E8A9B58B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B34AE7FA-E733-4d83-A9BD-A73CDA11A9E3}.exeC:\Windows\{B34AE7FA-E733-4d83-A9BD-A73CDA11A9E3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C540003D-01C4-48ab-B6EE-057E24DFED1D}.exeC:\Windows\{C540003D-01C4-48ab-B6EE-057E24DFED1D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{570E1FFD-8707-4459-A2E7-3F16892E9286}.exeC:\Windows\{570E1FFD-8707-4459-A2E7-3F16892E9286}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D91419A0-0C8D-46de-865C-31DE5C142098}.exeC:\Windows\{D91419A0-0C8D-46de-865C-31DE5C142098}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F65B2E3-A0D1-4307-87AE-9843CFDF1C5D}.exeC:\Windows\{2F65B2E3-A0D1-4307-87AE-9843CFDF1C5D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9141~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{570E1~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5400~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B34AE~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{000DF~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E78F0~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26ADD~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27A95~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73B67~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15702~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{000DF4E9-8C17-4cfb-9903-7C33E8A9B58B}.exe
{15702627-83EE-4c7a-BB4B-6C452B6F6165}.exe
{26ADDEF7-12AA-441d-A540-4027FFA5179F}.exe
{27A95632-C362-4ee0-BAF2-661F5E0BBEAD}.exe
{2F65B2E3-A0D1-4307-87AE-9843CFDF1C5D}.exe
{570E1FFD-8707-4459-A2E7-3F16892E9286}.exe
{73B67AB2-8410-497a-94B4-0AED2B41A3BF}.exe
{B34AE7FA-E733-4d83-A9BD-A73CDA11A9E3}.exe
{C540003D-01C4-48ab-B6EE-057E24DFED1D}.exe
{D91419A0-0C8D-46de-865C-31DE5C142098}.exe
{E78F08B5-DDF5-49c5-8B00-0FA01E0F1F52}.exe