Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 00:50
General
- Target 2026-07-27_35572acb2cf440dc1d6a8e21b059f513_elex_wannacry.exe
- Size 60KB
- Sample260727-a7eahatdrh
- SHA256 26657dc0c2d1a59fc8c3eccf6a3e7dd7af48824e12ad57294e6269afd4723fd5
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Detects Windows executables referencing non-Windows User-Agents 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_35572acb2cf440dc1d6a8e21b059f513_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_35572acb2cf440dc1d6a8e21b059f513_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F04CF0DD-8BCB-48dc-84AB-FC3E0F3FC9E2}.exeC:\Windows\{F04CF0DD-8BCB-48dc-84AB-FC3E0F3FC9E2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3975E93-FC4B-42ee-9D26-201DE0FC5BA2}.exeC:\Windows\{A3975E93-FC4B-42ee-9D26-201DE0FC5BA2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDFF1880-F78B-4557-848F-DA8C0B9FBCF5}.exeC:\Windows\{CDFF1880-F78B-4557-848F-DA8C0B9FBCF5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E95BAC9-C605-4b33-997F-ACCA9A974087}.exeC:\Windows\{1E95BAC9-C605-4b33-997F-ACCA9A974087}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D7E7BF78-AD0F-4024-B2FA-BF27D9FC5FC1}.exeC:\Windows\{D7E7BF78-AD0F-4024-B2FA-BF27D9FC5FC1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{34443EC7-89C4-441e-B921-4C3917E69701}.exeC:\Windows\{34443EC7-89C4-441e-B921-4C3917E69701}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E6B89903-4ADA-423f-8205-BDBA832CD781}.exeC:\Windows\{E6B89903-4ADA-423f-8205-BDBA832CD781}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7829BF0D-B5C4-4070-919E-05138E942760}.exeC:\Windows\{7829BF0D-B5C4-4070-919E-05138E942760}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24A3CA08-F168-4b90-BF27-AADCBBF8ABF8}.exeC:\Windows\{24A3CA08-F168-4b90-BF27-AADCBBF8ABF8}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{374C914A-5800-4a6f-838A-513900476C8E}.exeC:\Windows\{374C914A-5800-4a6f-838A-513900476C8E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D49EA924-EBD4-4060-90F2-38B281285EEC}.exeC:\Windows\{D49EA924-EBD4-4060-90F2-38B281285EEC}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{374C9~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24A3C~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7829B~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6B89~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34443~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7E7B~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E95B~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDFF1~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3975~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F04CF~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1E95BAC9-C605-4b33-997F-ACCA9A974087}.exe
{24A3CA08-F168-4b90-BF27-AADCBBF8ABF8}.exe
{34443EC7-89C4-441e-B921-4C3917E69701}.exe
{374C914A-5800-4a6f-838A-513900476C8E}.exe
{7829BF0D-B5C4-4070-919E-05138E942760}.exe
{A3975E93-FC4B-42ee-9D26-201DE0FC5BA2}.exe
{CDFF1880-F78B-4557-848F-DA8C0B9FBCF5}.exe
{D49EA924-EBD4-4060-90F2-38B281285EEC}.exe
{D7E7BF78-AD0F-4024-B2FA-BF27D9FC5FC1}.exe
{E6B89903-4ADA-423f-8205-BDBA832CD781}.exe
{F04CF0DD-8BCB-48dc-84AB-FC3E0F3FC9E2}.exe
memory/444-68-0x0000000000400000-0x0000000000410000-memory.dmp
memory/444-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1000-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1000-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1892-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1892-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2096-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2096-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2096-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2612-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2752-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2752-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3416-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3416-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3480-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3480-61-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4432-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4432-75-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4472-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4472-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4744-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4744-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5848-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5848-6-0x0000000000400000-0x0000000000410000-memory.dmp