Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 01:16
General
- Target 2026-07-18_03198745a725485386ec665ce59546eb_elex_wannacry.exe
- Size 64KB
- Sample260718-bm78hsbw4j
- SHA256 15f4ca99f9542f7641a92552cdd63fbffb7b55238ce684842dfe2df6041dc7a6
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_03198745a725485386ec665ce59546eb_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_03198745a725485386ec665ce59546eb_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{973CA0AC-DEE9-460f-B889-35CB57DCA653}.exeC:\Windows\{973CA0AC-DEE9-460f-B889-35CB57DCA653}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{729F2D94-86B9-4908-8761-7621B459650D}.exeC:\Windows\{729F2D94-86B9-4908-8761-7621B459650D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15EC4BE7-54DC-4e6f-AC01-B72A629D6D24}.exeC:\Windows\{15EC4BE7-54DC-4e6f-AC01-B72A629D6D24}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA51DE99-AB59-4142-850D-5E8BE5F46138}.exeC:\Windows\{AA51DE99-AB59-4142-850D-5E8BE5F46138}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBB19C36-3722-464f-B7D0-677A98AE5E44}.exeC:\Windows\{BBB19C36-3722-464f-B7D0-677A98AE5E44}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{170DA8B0-CBEE-498c-B493-7F596B32A079}.exeC:\Windows\{170DA8B0-CBEE-498c-B493-7F596B32A079}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{282B81D6-0C17-43b3-903E-DCA3AEF9DD42}.exeC:\Windows\{282B81D6-0C17-43b3-903E-DCA3AEF9DD42}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BF967859-5C75-49dd-8C5D-D30A414D969E}.exeC:\Windows\{BF967859-5C75-49dd-8C5D-D30A414D969E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB4CC4E5-1111-409f-A611-0AB491634C00}.exeC:\Windows\{BB4CC4E5-1111-409f-A611-0AB491634C00}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4072761-ABFB-4e8b-B071-AB49C6A8FA8F}.exeC:\Windows\{E4072761-ABFB-4e8b-B071-AB49C6A8FA8F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{70E05FD3-642B-44a9-821C-5E525048562A}.exeC:\Windows\{70E05FD3-642B-44a9-821C-5E525048562A}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4072~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB4CC~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BF967~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{282B8~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{170DA~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBB19~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA51D~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15EC4~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{729F2~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{973CA~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{15EC4BE7-54DC-4e6f-AC01-B72A629D6D24}.exe
{170DA8B0-CBEE-498c-B493-7F596B32A079}.exe
{282B81D6-0C17-43b3-903E-DCA3AEF9DD42}.exe
{70E05FD3-642B-44a9-821C-5E525048562A}.exe
{729F2D94-86B9-4908-8761-7621B459650D}.exe
{973CA0AC-DEE9-460f-B889-35CB57DCA653}.exe
{AA51DE99-AB59-4142-850D-5E8BE5F46138}.exe
{BB4CC4E5-1111-409f-A611-0AB491634C00}.exe
{BBB19C36-3722-464f-B7D0-677A98AE5E44}.exe
{BF967859-5C75-49dd-8C5D-D30A414D969E}.exe
{E4072761-ABFB-4e8b-B071-AB49C6A8FA8F}.exe
memory/1516-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1516-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1560-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1560-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2136-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2136-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2304-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2304-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3004-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3004-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3256-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3524-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3524-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3524-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3588-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3588-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4280-68-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4280-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4664-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4664-61-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5912-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5912-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5956-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5956-34-0x0000000000400000-0x0000000000410000-memory.dmp