Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 12:24
General
- Target 2026-11-11_51e40ec5e25851a04b000e45436b152d_elex_wannacry.exe
- Size 64KB
- Sample261113-plc8msbw8x
- SHA256 64182bb695cfa027ac9a089bf215b9496906415aacae10a6679e1fc11bf845ff
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-11_51e40ec5e25851a04b000e45436b152d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-11_51e40ec5e25851a04b000e45436b152d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F584E75-C070-4690-AFA2-F09333EA7AE9}.exeC:\Windows\{9F584E75-C070-4690-AFA2-F09333EA7AE9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EFB10A70-A36B-46ff-9FC5-F9E81842661D}.exeC:\Windows\{EFB10A70-A36B-46ff-9FC5-F9E81842661D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5BF06195-8BBD-43ee-B14C-EDB8EACFE506}.exeC:\Windows\{5BF06195-8BBD-43ee-B14C-EDB8EACFE506}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA912139-8D89-445a-93A8-3BAA9031D0E1}.exeC:\Windows\{AA912139-8D89-445a-93A8-3BAA9031D0E1}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{88E59D81-DC0E-42a6-A19B-FE195D12391E}.exeC:\Windows\{88E59D81-DC0E-42a6-A19B-FE195D12391E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9EE65921-B6D7-45d4-8B50-36E895EAEB8D}.exeC:\Windows\{9EE65921-B6D7-45d4-8B50-36E895EAEB8D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB90B2F8-D3B9-46dd-AB9C-30188AE323A7}.exeC:\Windows\{DB90B2F8-D3B9-46dd-AB9C-30188AE323A7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A55D8EFB-D305-43a2-B4C8-AFA92D225E4A}.exeC:\Windows\{A55D8EFB-D305-43a2-B4C8-AFA92D225E4A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{45CE2827-B479-4fcd-BDB4-A76282E3FA63}.exeC:\Windows\{45CE2827-B479-4fcd-BDB4-A76282E3FA63}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F029288E-5B91-4930-A4C0-47C931036F5C}.exeC:\Windows\{F029288E-5B91-4930-A4C0-47C931036F5C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A63ACFB4-D0D9-494f-A49F-28BCDF220466}.exeC:\Windows\{A63ACFB4-D0D9-494f-A49F-28BCDF220466}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0292~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45CE2~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A55D8~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB90B~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EE65~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88E59~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA912~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5BF06~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EFB10~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F584~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{45CE2827-B479-4fcd-BDB4-A76282E3FA63}.exe
{5BF06195-8BBD-43ee-B14C-EDB8EACFE506}.exe
{88E59D81-DC0E-42a6-A19B-FE195D12391E}.exe
{9EE65921-B6D7-45d4-8B50-36E895EAEB8D}.exe
{9F584E75-C070-4690-AFA2-F09333EA7AE9}.exe
{A55D8EFB-D305-43a2-B4C8-AFA92D225E4A}.exe
{A63ACFB4-D0D9-494f-A49F-28BCDF220466}.exe
{AA912139-8D89-445a-93A8-3BAA9031D0E1}.exe
{DB90B2F8-D3B9-46dd-AB9C-30188AE323A7}.exe
{EFB10A70-A36B-46ff-9FC5-F9E81842661D}.exe
{F029288E-5B91-4930-A4C0-47C931036F5C}.exe
memory/752-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/752-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/752-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1372-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1372-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1408-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1408-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2532-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2532-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3176-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3176-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3324-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3572-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3572-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4140-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4140-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4140-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4300-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4300-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4632-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4632-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5212-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5212-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5924-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5924-43-0x0000000000400000-0x0000000000410000-memory.dmp