Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 19:55
General
- Target 2026-11-02_e51ad13798a547c880cad21e99b1bbc6_elex_wannacry.exe
- Size 90KB
- Sample261102-ynl31agc24
- SHA256 f97f310ef5efa6f0793caffbc6b46feb84406527ccc10ee1c8dd92ffc47bf50b
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_e51ad13798a547c880cad21e99b1bbc6_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_e51ad13798a547c880cad21e99b1bbc6_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{074148EA-59D6-41d7-87A3-481D777E5BA0}.exeC:\Windows\{074148EA-59D6-41d7-87A3-481D777E5BA0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CF531E3-6C99-4475-B7D3-D8B3F5594103}.exeC:\Windows\{9CF531E3-6C99-4475-B7D3-D8B3F5594103}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B5D94CFF-7BE7-4ad4-A655-792D159A56A7}.exeC:\Windows\{B5D94CFF-7BE7-4ad4-A655-792D159A56A7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94E4FB97-BC9B-49e2-9C9E-F092144F900E}.exeC:\Windows\{94E4FB97-BC9B-49e2-9C9E-F092144F900E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDB08DA3-350C-4c3b-8F60-1DD65ABA60D4}.exeC:\Windows\{CDB08DA3-350C-4c3b-8F60-1DD65ABA60D4}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{66118C3D-35C4-48a8-8D6B-76FF2069ED34}.exeC:\Windows\{66118C3D-35C4-48a8-8D6B-76FF2069ED34}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEDAF5F5-CF5E-48f9-A503-385A55A93DB3}.exeC:\Windows\{AEDAF5F5-CF5E-48f9-A503-385A55A93DB3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E200D7D-5F83-4e81-ACD0-CF7377A9A24B}.exeC:\Windows\{0E200D7D-5F83-4e81-ACD0-CF7377A9A24B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DC967F3-6B37-4a81-8255-EC9B372C6396}.exeC:\Windows\{1DC967F3-6B37-4a81-8255-EC9B372C6396}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03DE11E0-34D8-484b-9AEC-95FF0745A3BE}.exeC:\Windows\{03DE11E0-34D8-484b-9AEC-95FF0745A3BE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FBEDDD6-1CE9-427a-8ABA-8A6475102619}.exeC:\Windows\{2FBEDDD6-1CE9-427a-8ABA-8A6475102619}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03DE1~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DC96~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E200~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEDAF~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{66118~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDB08~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94E4F~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5D94~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CF53~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07414~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{03DE11E0-34D8-484b-9AEC-95FF0745A3BE}.exe
{074148EA-59D6-41d7-87A3-481D777E5BA0}.exe
{0E200D7D-5F83-4e81-ACD0-CF7377A9A24B}.exe
{1DC967F3-6B37-4a81-8255-EC9B372C6396}.exe
{2FBEDDD6-1CE9-427a-8ABA-8A6475102619}.exe
{66118C3D-35C4-48a8-8D6B-76FF2069ED34}.exe
{94E4FB97-BC9B-49e2-9C9E-F092144F900E}.exe
{9CF531E3-6C99-4475-B7D3-D8B3F5594103}.exe
{AEDAF5F5-CF5E-48f9-A503-385A55A93DB3}.exe
{B5D94CFF-7BE7-4ad4-A655-792D159A56A7}.exe
{CDB08DA3-350C-4c3b-8F60-1DD65ABA60D4}.exe