Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/11/2026, 12:08
General
- Target 2026-11-02_38b8501d0da3a30fcb8fdca58b46c119_elex_wannacry.exe
- Size 76KB
- Sample261103-pavcsahs4w
- SHA256 bcb4b1e0844d8f49f55c76a9c5109c8c3784c1f2bf4d98dcb6ba820b6becf6c1
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_38b8501d0da3a30fcb8fdca58b46c119_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_38b8501d0da3a30fcb8fdca58b46c119_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D9E9DD7-9D38-48ce-865A-1AC73E3EAD97}.exeC:\Windows\{3D9E9DD7-9D38-48ce-865A-1AC73E3EAD97}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D035B255-4CEC-4440-8D3A-CBDBF494A877}.exeC:\Windows\{D035B255-4CEC-4440-8D3A-CBDBF494A877}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF4EAF33-B131-44e5-A603-DD0BFDA1A2E3}.exeC:\Windows\{DF4EAF33-B131-44e5-A603-DD0BFDA1A2E3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{377432D9-61FB-4cfb-8614-FDA683BF3869}.exeC:\Windows\{377432D9-61FB-4cfb-8614-FDA683BF3869}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A47A6DA2-0FEC-4cad-AF3B-33F6F99EB825}.exeC:\Windows\{A47A6DA2-0FEC-4cad-AF3B-33F6F99EB825}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{930543C2-CE99-4011-AF03-8DB10CAA439D}.exeC:\Windows\{930543C2-CE99-4011-AF03-8DB10CAA439D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D9A50FB-3D1C-41d2-A7D7-56279B9DB9CA}.exeC:\Windows\{9D9A50FB-3D1C-41d2-A7D7-56279B9DB9CA}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4FB2957A-8444-4d9b-A7A3-06FBB9F47B7C}.exeC:\Windows\{4FB2957A-8444-4d9b-A7A3-06FBB9F47B7C}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58C70654-078E-4cc2-8DFF-4D96201FE4B5}.exeC:\Windows\{58C70654-078E-4cc2-8DFF-4D96201FE4B5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F138493C-C5A4-437a-822F-0F3E7E95BEFC}.exeC:\Windows\{F138493C-C5A4-437a-822F-0F3E7E95BEFC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28F291CD-BFC6-43af-9807-1827018CA66D}.exeC:\Windows\{28F291CD-BFC6-43af-9807-1827018CA66D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1384~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58C70~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FB29~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D9A5~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93054~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A47A6~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37743~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF4EA~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D035B~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D9E9~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{28F291CD-BFC6-43af-9807-1827018CA66D}.exe
{377432D9-61FB-4cfb-8614-FDA683BF3869}.exe
{3D9E9DD7-9D38-48ce-865A-1AC73E3EAD97}.exe
{4FB2957A-8444-4d9b-A7A3-06FBB9F47B7C}.exe
{58C70654-078E-4cc2-8DFF-4D96201FE4B5}.exe
{930543C2-CE99-4011-AF03-8DB10CAA439D}.exe
{9D9A50FB-3D1C-41d2-A7D7-56279B9DB9CA}.exe
{A47A6DA2-0FEC-4cad-AF3B-33F6F99EB825}.exe
{D035B255-4CEC-4440-8D3A-CBDBF494A877}.exe
{DF4EAF33-B131-44e5-A603-DD0BFDA1A2E3}.exe
{F138493C-C5A4-437a-822F-0F3E7E95BEFC}.exe