Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 22:47
General
- Target 2026-07-27_a8a494a80d2b40af52aaac7c16a0cdc4_elex_wannacry.exe
- Size 68KB
- Sample260727-2ql3kasfpe
- SHA256 014141c802b9d269f4bf8be348e8a8675476ad0ebb39ecb8c589496c084f9327
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_a8a494a80d2b40af52aaac7c16a0cdc4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_a8a494a80d2b40af52aaac7c16a0cdc4_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1196AEB8-47EB-4004-87F1-F73739309F72}.exeC:\Windows\{1196AEB8-47EB-4004-87F1-F73739309F72}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B336F212-4696-428f-A5A6-BF43F70DAB63}.exeC:\Windows\{B336F212-4696-428f-A5A6-BF43F70DAB63}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D649D88-CAD7-41dd-BF70-1EE1B7179065}.exeC:\Windows\{2D649D88-CAD7-41dd-BF70-1EE1B7179065}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA958493-4393-49cd-A789-093558F8B3C8}.exeC:\Windows\{EA958493-4393-49cd-A789-093558F8B3C8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA46B796-3EBF-43de-93DD-1470BB2644C1}.exeC:\Windows\{EA46B796-3EBF-43de-93DD-1470BB2644C1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D8D5D442-E398-45f2-8169-0945D71ADED2}.exeC:\Windows\{D8D5D442-E398-45f2-8169-0945D71ADED2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD810829-F8F7-41c0-A7FD-C1E7FC908023}.exeC:\Windows\{AD810829-F8F7-41c0-A7FD-C1E7FC908023}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E1C5C2A-0F09-46be-99D0-1DD04FC354A7}.exeC:\Windows\{3E1C5C2A-0F09-46be-99D0-1DD04FC354A7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{95DF59CA-FA10-4d21-B5AC-724637CA4FA8}.exeC:\Windows\{95DF59CA-FA10-4d21-B5AC-724637CA4FA8}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12C1E0F1-C285-47e4-A963-41FC48F4D799}.exeC:\Windows\{12C1E0F1-C285-47e4-A963-41FC48F4D799}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6DEC0F24-34C4-40b2-93F0-5C90EAE6657A}.exeC:\Windows\{6DEC0F24-34C4-40b2-93F0-5C90EAE6657A}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12C1E~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95DF5~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E1C5~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD810~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8D5D~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA46B~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA958~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D649~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B336F~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1196A~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1196AEB8-47EB-4004-87F1-F73739309F72}.exe
{12C1E0F1-C285-47e4-A963-41FC48F4D799}.exe
{2D649D88-CAD7-41dd-BF70-1EE1B7179065}.exe
{3E1C5C2A-0F09-46be-99D0-1DD04FC354A7}.exe
{6DEC0F24-34C4-40b2-93F0-5C90EAE6657A}.exe
{95DF59CA-FA10-4d21-B5AC-724637CA4FA8}.exe
{AD810829-F8F7-41c0-A7FD-C1E7FC908023}.exe
{B336F212-4696-428f-A5A6-BF43F70DAB63}.exe
{D8D5D442-E398-45f2-8169-0945D71ADED2}.exe
{EA46B796-3EBF-43de-93DD-1470BB2644C1}.exe
{EA958493-4393-49cd-A789-093558F8B3C8}.exe
memory/1080-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1080-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1080-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1468-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1468-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1656-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1656-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1776-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1776-15-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2272-62-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2272-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3316-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3316-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3644-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3684-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3684-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3948-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3948-43-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4628-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4628-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4664-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4664-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5484-9-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5484-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5484-13-0x0000000000400000-0x0000000000411000-memory.dmp