Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/11/2026, 15:23
General
- Target 2026-11-10_f55025f2d7eaafd1c741fa7ca26a9bcd_elex_wannacry.exe
- Size 88KB
- Sample261111-ssstfshs8m
- SHA256 8e968926e4634424f4e0d77cb14a85acdbdc302cb058d75b618ff937b102d251
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 32 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_f55025f2d7eaafd1c741fa7ca26a9bcd_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_f55025f2d7eaafd1c741fa7ca26a9bcd_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89330E25-3094-4777-B2B1-B7AF94CEF303}.exeC:\Windows\{89330E25-3094-4777-B2B1-B7AF94CEF303}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D20969FE-099A-4990-95A3-772B126A3F00}.exeC:\Windows\{D20969FE-099A-4990-95A3-772B126A3F00}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{45644951-D4EB-4e41-AF50-416B700606EF}.exeC:\Windows\{45644951-D4EB-4e41-AF50-416B700606EF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97C0C7B4-AB9C-4e75-AD40-3F3B5D447335}.exeC:\Windows\{97C0C7B4-AB9C-4e75-AD40-3F3B5D447335}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0D29DBEE-8BFA-40f4-AC53-D90FA08892E7}.exeC:\Windows\{0D29DBEE-8BFA-40f4-AC53-D90FA08892E7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8DEDFF33-B6EE-4f9d-9A0B-9EC2A95BD34E}.exeC:\Windows\{8DEDFF33-B6EE-4f9d-9A0B-9EC2A95BD34E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C7C51D8-4401-4c9a-9B35-FFDC1715AAAC}.exeC:\Windows\{4C7C51D8-4401-4c9a-9B35-FFDC1715AAAC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{080C7B06-F75D-4647-A010-FBAC25846735}.exeC:\Windows\{080C7B06-F75D-4647-A010-FBAC25846735}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE03B950-7862-461e-988F-BE35A94E60D1}.exeC:\Windows\{EE03B950-7862-461e-988F-BE35A94E60D1}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B8F15D7-75B3-45a7-8440-D563659F0B3A}.exeC:\Windows\{9B8F15D7-75B3-45a7-8440-D563659F0B3A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3A05A2B-772A-44df-86ED-F1F6853811C9}.exeC:\Windows\{B3A05A2B-772A-44df-86ED-F1F6853811C9}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B8F1~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE03B~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{080C7~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C7C5~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8DEDF~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D29D~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97C0C~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45644~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2096~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89330~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{080C7B06-F75D-4647-A010-FBAC25846735}.exe
{0D29DBEE-8BFA-40f4-AC53-D90FA08892E7}.exe
{45644951-D4EB-4e41-AF50-416B700606EF}.exe
{4C7C51D8-4401-4c9a-9B35-FFDC1715AAAC}.exe
{89330E25-3094-4777-B2B1-B7AF94CEF303}.exe
{8DEDFF33-B6EE-4f9d-9A0B-9EC2A95BD34E}.exe
{97C0C7B4-AB9C-4e75-AD40-3F3B5D447335}.exe
{9B8F15D7-75B3-45a7-8440-D563659F0B3A}.exe
{B3A05A2B-772A-44df-86ED-F1F6853811C9}.exe
{D20969FE-099A-4990-95A3-772B126A3F00}.exe
{EE03B950-7862-461e-988F-BE35A94E60D1}.exe
memory/860-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/860-25-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1332-44-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1332-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1972-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2708-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2856-39-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3132-58-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3132-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3180-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3932-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3932-17-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4396-51-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4396-46-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4444-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4444-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4444-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4884-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4884-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4884-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5004-62-0x0000000000400000-0x0000000000411000-memory.dmp