Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 21:22
General
- Target 2026-07-24_0b10b75c2440f6dd2110b1ea1abc69d3_elex_wannacry.exe
- Size 72KB
- Sample260724-z78xjstdmf
- SHA256 04f994d60ec194ad59777ac4d162d6de81568d8eefa1b732f95f543a347db42c
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 45 IoCs
- UPX dump on OEP (original entry point) 45 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_0b10b75c2440f6dd2110b1ea1abc69d3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_0b10b75c2440f6dd2110b1ea1abc69d3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C48CFD1B-3202-4c0b-A600-C050F26A91B7}.exeC:\Windows\{C48CFD1B-3202-4c0b-A600-C050F26A91B7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5572731D-CB02-4770-A5F3-FA023CBD4A57}.exeC:\Windows\{5572731D-CB02-4770-A5F3-FA023CBD4A57}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{781223B4-194A-4e04-84F7-6AFE19BEFA75}.exeC:\Windows\{781223B4-194A-4e04-84F7-6AFE19BEFA75}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C23FC119-225B-4327-8368-1DE61EC7CD74}.exeC:\Windows\{C23FC119-225B-4327-8368-1DE61EC7CD74}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18922711-F0E8-4073-92E7-C3FC91D19FC4}.exeC:\Windows\{18922711-F0E8-4073-92E7-C3FC91D19FC4}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F95F8B33-47EC-4ea8-997D-29088E20027E}.exeC:\Windows\{F95F8B33-47EC-4ea8-997D-29088E20027E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71904207-F863-4dac-A036-94816D78D16D}.exeC:\Windows\{71904207-F863-4dac-A036-94816D78D16D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{184F85AE-641F-41b1-A235-8BD683E91394}.exeC:\Windows\{184F85AE-641F-41b1-A235-8BD683E91394}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B735DA2-3CFA-4312-A2DC-5A2EC5834EBA}.exeC:\Windows\{4B735DA2-3CFA-4312-A2DC-5A2EC5834EBA}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A74829FF-ED7E-49a5-82F0-FF53AD3253E8}.exeC:\Windows\{A74829FF-ED7E-49a5-82F0-FF53AD3253E8}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{241B7BB5-69A9-4eee-89BA-46805BF53FAE}.exeC:\Windows\{241B7BB5-69A9-4eee-89BA-46805BF53FAE}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7482~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B735~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{184F8~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71904~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F95F8~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18922~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C23FC~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78122~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55727~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C48CF~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{184F85AE-641F-41b1-A235-8BD683E91394}.exe
{18922711-F0E8-4073-92E7-C3FC91D19FC4}.exe
{241B7BB5-69A9-4eee-89BA-46805BF53FAE}.exe
{4B735DA2-3CFA-4312-A2DC-5A2EC5834EBA}.exe
{5572731D-CB02-4770-A5F3-FA023CBD4A57}.exe
{71904207-F863-4dac-A036-94816D78D16D}.exe
{781223B4-194A-4e04-84F7-6AFE19BEFA75}.exe
{A74829FF-ED7E-49a5-82F0-FF53AD3253E8}.exe
{C23FC119-225B-4327-8368-1DE61EC7CD74}.exe
{C48CFD1B-3202-4c0b-A600-C050F26A91B7}.exe
{F95F8B33-47EC-4ea8-997D-29088E20027E}.exe
memory/1324-47-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1324-54-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1324-49-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1684-69-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1684-65-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1684-63-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1876-31-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1876-33-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1876-37-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2304-71-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2304-77-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2304-73-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4388-41-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4388-45-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4388-39-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4460-87-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4876-25-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4876-23-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4876-29-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4892-0-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4892-1-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4892-7-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5520-79-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5520-85-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5520-81-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6204-17-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6204-21-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6204-15-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6220-55-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6220-61-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6220-57-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6676-13-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6676-6-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6676-9-0x0000000000400000-0x0000000000413000-memory.dmp