Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/07/2026, 00:30
General
- Target 2026-07-22_0115a82c2226191929505be026851acd_elex_wannacry.exe
- Size 64KB
- Sample260723-ath2jaed82
- SHA256 9497e7c95c5e07cadd0bf759e7ab96fd7ffad03609f33ce285320de7d4564f72
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- Executes a command shell one-liner 1 TTPs 10 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_0115a82c2226191929505be026851acd_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_0115a82c2226191929505be026851acd_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{55FE5DBD-BCC7-40c5-A98E-C5746CAA8BC9}.exeC:\Windows\{55FE5DBD-BCC7-40c5-A98E-C5746CAA8BC9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03F190F1-A8A7-4c61-A8CA-02E00D5E4A27}.exeC:\Windows\{03F190F1-A8A7-4c61-A8CA-02E00D5E4A27}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF230E3D-E5AB-4b0d-98DB-EA054295CFAF}.exeC:\Windows\{AF230E3D-E5AB-4b0d-98DB-EA054295CFAF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8CD87D19-0ADE-4225-BE73-93FD38D44457}.exeC:\Windows\{8CD87D19-0ADE-4225-BE73-93FD38D44457}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC76AE50-D6F3-468b-A5A8-A275F9CBC350}.exeC:\Windows\{AC76AE50-D6F3-468b-A5A8-A275F9CBC350}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB0BF05A-6491-491f-A805-CF225967F648}.exeC:\Windows\{BB0BF05A-6491-491f-A805-CF225967F648}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA02A251-48C6-49b0-9FF9-E7FA17263EB8}.exeC:\Windows\{DA02A251-48C6-49b0-9FF9-E7FA17263EB8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{017FF9C2-1878-42fc-954A-B2771A399670}.exeC:\Windows\{017FF9C2-1878-42fc-954A-B2771A399670}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F0C4FF3-3EC3-4c07-84E3-9FBA1800C214}.exeC:\Windows\{0F0C4FF3-3EC3-4c07-84E3-9FBA1800C214}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0334E6BA-A88C-4027-9E4D-D8CBFD7AF23A}.exeC:\Windows\{0334E6BA-A88C-4027-9E4D-D8CBFD7AF23A}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F0C4~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{017FF~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA02A~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB0BF~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC76A~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CD87~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF230~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03F19~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55FE5~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{017FF9C2-1878-42fc-954A-B2771A399670}.exe
{0334E6BA-A88C-4027-9E4D-D8CBFD7AF23A}.exe
{03F190F1-A8A7-4c61-A8CA-02E00D5E4A27}.exe
{0F0C4FF3-3EC3-4c07-84E3-9FBA1800C214}.exe
{55FE5DBD-BCC7-40c5-A98E-C5746CAA8BC9}.exe
{8CD87D19-0ADE-4225-BE73-93FD38D44457}.exe
{AC76AE50-D6F3-468b-A5A8-A275F9CBC350}.exe
{AF230E3D-E5AB-4b0d-98DB-EA054295CFAF}.exe
{BB0BF05A-6491-491f-A805-CF225967F648}.exe
{DA02A251-48C6-49b0-9FF9-E7FA17263EB8}.exe
memory/828-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/828-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1252-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1252-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1252-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1276-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1276-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1472-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1472-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1576-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1576-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2204-61-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2560-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2560-32-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3348-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3348-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3728-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3728-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3820-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3820-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3820-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4628-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4628-59-0x0000000000400000-0x0000000000410000-memory.dmp