Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 05:03
General
- Target 2026-07-22_86ede40997d50175181d336e0ae0e22e_elex_wannacry.exe
- Size 64KB
- Sample260722-fp3s2aag82
- SHA256 dadfe16f1fd9296905a789c787090f8c53664d866a5b038c20d034974be01fa8
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_86ede40997d50175181d336e0ae0e22e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_86ede40997d50175181d336e0ae0e22e_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6DDAF0D8-E5D9-4b55-BD6C-D46664D5DBE3}.exeC:\Windows\{6DDAF0D8-E5D9-4b55-BD6C-D46664D5DBE3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A255FC2C-C63B-44ef-ADF3-CA0B60226ACD}.exeC:\Windows\{A255FC2C-C63B-44ef-ADF3-CA0B60226ACD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{806D0321-B068-4821-AC63-78674ACBF5B7}.exeC:\Windows\{806D0321-B068-4821-AC63-78674ACBF5B7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E6D0767-A288-45f9-9E40-E0FF6737B30D}.exeC:\Windows\{0E6D0767-A288-45f9-9E40-E0FF6737B30D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{537B1B54-EE2C-41de-A78C-276474FA7BAF}.exeC:\Windows\{537B1B54-EE2C-41de-A78C-276474FA7BAF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4942C157-AB8D-4d88-A028-D0B3914348E2}.exeC:\Windows\{4942C157-AB8D-4d88-A028-D0B3914348E2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4BE33512-73CF-40bd-8941-9C9A296262E1}.exeC:\Windows\{4BE33512-73CF-40bd-8941-9C9A296262E1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C0AAE36-6D82-4cb8-996E-304987BAD8EB}.exeC:\Windows\{8C0AAE36-6D82-4cb8-996E-304987BAD8EB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F130C91E-2416-4cbd-8745-7DE8F213A230}.exeC:\Windows\{F130C91E-2416-4cbd-8745-7DE8F213A230}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2DDB046D-76E8-496e-AE1E-F77F0BBBD4C1}.exeC:\Windows\{2DDB046D-76E8-496e-AE1E-F77F0BBBD4C1}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7FA08622-E4DB-4d8b-9166-2EC9914BC202}.exeC:\Windows\{7FA08622-E4DB-4d8b-9166-2EC9914BC202}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2DDB0~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F130C~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C0AA~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4BE33~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4942C~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{537B1~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E6D0~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{806D0~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A255F~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6DDAF~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0E6D0767-A288-45f9-9E40-E0FF6737B30D}.exe
{2DDB046D-76E8-496e-AE1E-F77F0BBBD4C1}.exe
{4942C157-AB8D-4d88-A028-D0B3914348E2}.exe
{4BE33512-73CF-40bd-8941-9C9A296262E1}.exe
{537B1B54-EE2C-41de-A78C-276474FA7BAF}.exe
{6DDAF0D8-E5D9-4b55-BD6C-D46664D5DBE3}.exe
{7FA08622-E4DB-4d8b-9166-2EC9914BC202}.exe
{806D0321-B068-4821-AC63-78674ACBF5B7}.exe
{8C0AAE36-6D82-4cb8-996E-304987BAD8EB}.exe
{A255FC2C-C63B-44ef-ADF3-CA0B60226ACD}.exe
{F130C91E-2416-4cbd-8745-7DE8F213A230}.exe
memory/984-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/984-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/984-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1884-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1884-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2680-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2680-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3400-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3400-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3620-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3620-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4744-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4744-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4756-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4756-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4756-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5008-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5008-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5528-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5544-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5544-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5548-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5548-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5724-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5724-28-0x0000000000400000-0x0000000000410000-memory.dmp