Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 19:02
General
- Target 2026-11-09_58c1520e738062c4a84bed4b5a4dbd08_elex_wannacry.exe
- Size 372KB
- Sample261110-xp2dms1v6p
- SHA256 b0caac18c28b80f952cbb4a61547914beea1ecdfc8e76fdab802e69ba301aac0
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_58c1520e738062c4a84bed4b5a4dbd08_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_58c1520e738062c4a84bed4b5a4dbd08_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFA4ED32-33E7-4e95-9C7D-9F71E29635A5}.exeC:\Windows\{BFA4ED32-33E7-4e95-9C7D-9F71E29635A5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FFF27FAF-9795-456e-BC52-1A56051B3C26}.exeC:\Windows\{FFF27FAF-9795-456e-BC52-1A56051B3C26}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87602EB7-8690-491c-A0FF-4DFB75B206B4}.exeC:\Windows\{87602EB7-8690-491c-A0FF-4DFB75B206B4}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FAA9FD7-1C0C-4f50-BE1D-171545C87A5F}.exeC:\Windows\{0FAA9FD7-1C0C-4f50-BE1D-171545C87A5F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{340817AF-7EC7-4740-A8C1-BCD6B6786256}.exeC:\Windows\{340817AF-7EC7-4740-A8C1-BCD6B6786256}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6DCF7A94-AD7A-439a-9D82-7424D539E988}.exeC:\Windows\{6DCF7A94-AD7A-439a-9D82-7424D539E988}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA71B52C-81FD-47b5-850A-E5479CFC52F8}.exeC:\Windows\{AA71B52C-81FD-47b5-850A-E5479CFC52F8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C37021E4-DE24-4d78-A0CF-86474CADADBF}.exeC:\Windows\{C37021E4-DE24-4d78-A0CF-86474CADADBF}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBEFCD82-1F71-4cd8-B169-DA3823B79AE2}.exeC:\Windows\{BBEFCD82-1F71-4cd8-B169-DA3823B79AE2}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC9B2CBF-37C8-4b8c-BF2F-0CDCD6CEB2EB}.exeC:\Windows\{CC9B2CBF-37C8-4b8c-BF2F-0CDCD6CEB2EB}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D317AEE3-367C-482f-B22A-C21284CA7B55}.exeC:\Windows\{D317AEE3-367C-482f-B22A-C21284CA7B55}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC9B2~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBEFC~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3702~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA71B~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6DCF7~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34081~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FAA9~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87602~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFF27~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFA4E~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0FAA9FD7-1C0C-4f50-BE1D-171545C87A5F}.exe
{340817AF-7EC7-4740-A8C1-BCD6B6786256}.exe
{6DCF7A94-AD7A-439a-9D82-7424D539E988}.exe
{87602EB7-8690-491c-A0FF-4DFB75B206B4}.exe
{AA71B52C-81FD-47b5-850A-E5479CFC52F8}.exe
{BBEFCD82-1F71-4cd8-B169-DA3823B79AE2}.exe
{BFA4ED32-33E7-4e95-9C7D-9F71E29635A5}.exe
{C37021E4-DE24-4d78-A0CF-86474CADADBF}.exe
{CC9B2CBF-37C8-4b8c-BF2F-0CDCD6CEB2EB}.exe
{D317AEE3-367C-482f-B22A-C21284CA7B55}.exe
{FFF27FAF-9795-456e-BC52-1A56051B3C26}.exe