Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 08:54
General
- Target 2026-11-10_2e4bfb106ab6f688dc1838a3ad629345_elex_wannacry.exe
- Size 368KB
- Sample261110-ktxj2aeb92
- SHA256 9abc033d0f4e8b1ce1241d2626614958ab1f45e92ab455eea870bddd5984c135
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_2e4bfb106ab6f688dc1838a3ad629345_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_2e4bfb106ab6f688dc1838a3ad629345_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DE3632B-0E33-4527-845B-04BAF902839F}.exeC:\Windows\{1DE3632B-0E33-4527-845B-04BAF902839F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB0E036A-8766-4204-8F32-891FB8CB245B}.exeC:\Windows\{AB0E036A-8766-4204-8F32-891FB8CB245B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7DDBDE48-C0AC-4fe5-A2B8-6FB0F69BCC4C}.exeC:\Windows\{7DDBDE48-C0AC-4fe5-A2B8-6FB0F69BCC4C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A9A3F4A8-AF92-4aa6-9B4B-9CECE22E6921}.exeC:\Windows\{A9A3F4A8-AF92-4aa6-9B4B-9CECE22E6921}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEA003FA-C0FF-4dba-861D-76CC22939782}.exeC:\Windows\{AEA003FA-C0FF-4dba-861D-76CC22939782}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{526F98D1-9D2A-46e2-AA58-A1F03B9E1B17}.exeC:\Windows\{526F98D1-9D2A-46e2-AA58-A1F03B9E1B17}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDF7DCB8-4C1E-46fb-8D48-CF446346DA52}.exeC:\Windows\{CDF7DCB8-4C1E-46fb-8D48-CF446346DA52}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44ABB97B-AEAB-4771-9594-7D534A6AF304}.exeC:\Windows\{44ABB97B-AEAB-4771-9594-7D534A6AF304}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03F4141B-7673-4e8d-AA21-5FA957B3CADA}.exeC:\Windows\{03F4141B-7673-4e8d-AA21-5FA957B3CADA}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4CA744B1-ACAA-4db6-9058-428191C47AA3}.exeC:\Windows\{4CA744B1-ACAA-4db6-9058-428191C47AA3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{68CC6312-AD9C-4c16-B8EC-DE8F2E01B6DB}.exeC:\Windows\{68CC6312-AD9C-4c16-B8EC-DE8F2E01B6DB}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4CA74~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03F41~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44ABB~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDF7D~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{526F9~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEA00~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9A3F~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DDBD~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB0E0~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DE36~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{03F4141B-7673-4e8d-AA21-5FA957B3CADA}.exe
{1DE3632B-0E33-4527-845B-04BAF902839F}.exe
{44ABB97B-AEAB-4771-9594-7D534A6AF304}.exe
{4CA744B1-ACAA-4db6-9058-428191C47AA3}.exe
{526F98D1-9D2A-46e2-AA58-A1F03B9E1B17}.exe
{68CC6312-AD9C-4c16-B8EC-DE8F2E01B6DB}.exe
{7DDBDE48-C0AC-4fe5-A2B8-6FB0F69BCC4C}.exe
{A9A3F4A8-AF92-4aa6-9B4B-9CECE22E6921}.exe
{AB0E036A-8766-4204-8F32-891FB8CB245B}.exe
{AEA003FA-C0FF-4dba-861D-76CC22939782}.exe
{CDF7DCB8-4C1E-46fb-8D48-CF446346DA52}.exe