Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 19:16
General
- Target 2026-11-06_f0fb59924e810a29e7a5ea8679650600_elex_wannacry.exe
- Size 167KB
- Sample261107-xyydcaft4n
- SHA256 8678cf881792bc60e28b918132bda96eaccb6f116f818ae58a54a8f51256985b
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_f0fb59924e810a29e7a5ea8679650600_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_f0fb59924e810a29e7a5ea8679650600_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A9C7D29F-00D5-4524-82BE-7D5886D2CC5E}.exeC:\Windows\{A9C7D29F-00D5-4524-82BE-7D5886D2CC5E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8824DC91-CC02-4460-ACF6-05EF0DD15AFA}.exeC:\Windows\{8824DC91-CC02-4460-ACF6-05EF0DD15AFA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FFA2603C-8CC5-4bb5-9F44-9387F2B2D8FB}.exeC:\Windows\{FFA2603C-8CC5-4bb5-9F44-9387F2B2D8FB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBF18A5E-655D-4302-BC81-4CDC3DD538B4}.exeC:\Windows\{CBF18A5E-655D-4302-BC81-4CDC3DD538B4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A631526D-A3E9-4590-84E2-A68F92EEB477}.exeC:\Windows\{A631526D-A3E9-4590-84E2-A68F92EEB477}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{70D25D3B-69B3-4607-A5CE-31D75E2438E1}.exeC:\Windows\{70D25D3B-69B3-4607-A5CE-31D75E2438E1}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E91A744-149A-4124-BC9E-A181BAC6CCBE}.exeC:\Windows\{3E91A744-149A-4124-BC9E-A181BAC6CCBE}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F8E42243-3BD9-42f4-A1A5-CC9F150C6434}.exeC:\Windows\{F8E42243-3BD9-42f4-A1A5-CC9F150C6434}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0AD0F9A6-7712-4254-AB9F-B41B3DB56C7C}.exeC:\Windows\{0AD0F9A6-7712-4254-AB9F-B41B3DB56C7C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA28FB74-F618-45c2-8C13-51675C24AA6A}.exeC:\Windows\{EA28FB74-F618-45c2-8C13-51675C24AA6A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0276514C-01E2-44db-9EC7-3CB46CBFFA6F}.exeC:\Windows\{0276514C-01E2-44db-9EC7-3CB46CBFFA6F}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA28F~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0AD0F~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8E42~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E91A~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70D25~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6315~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBF18~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFA26~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8824D~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9C7D~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0276514C-01E2-44db-9EC7-3CB46CBFFA6F}.exe
{0AD0F9A6-7712-4254-AB9F-B41B3DB56C7C}.exe
{3E91A744-149A-4124-BC9E-A181BAC6CCBE}.exe
{70D25D3B-69B3-4607-A5CE-31D75E2438E1}.exe
{8824DC91-CC02-4460-ACF6-05EF0DD15AFA}.exe
{A631526D-A3E9-4590-84E2-A68F92EEB477}.exe
{A9C7D29F-00D5-4524-82BE-7D5886D2CC5E}.exe
{CBF18A5E-655D-4302-BC81-4CDC3DD538B4}.exe
{EA28FB74-F618-45c2-8C13-51675C24AA6A}.exe
{F8E42243-3BD9-42f4-A1A5-CC9F150C6434}.exe
{FFA2603C-8CC5-4bb5-9F44-9387F2B2D8FB}.exe