Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 08:07
General
- Target 2026-07-27_a5f15258cfb3dc00453c30be56309c32_elex_wannacry.exe
- Size 90KB
- Sample260727-j1glqaaa52
- SHA256 b51cc473a347ca01ddd3a6ed0f97aff1f9e1781ad5f6a3a661abec36110f4c12
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_a5f15258cfb3dc00453c30be56309c32_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_a5f15258cfb3dc00453c30be56309c32_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C704EA9-CD1C-40f3-A553-3372296EF216}.exeC:\Windows\{6C704EA9-CD1C-40f3-A553-3372296EF216}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{776BFC71-56AF-4034-A4ED-C0C62C58CE54}.exeC:\Windows\{776BFC71-56AF-4034-A4ED-C0C62C58CE54}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C4939ED9-EEA2-41ad-BFD6-D04AE83380BF}.exeC:\Windows\{C4939ED9-EEA2-41ad-BFD6-D04AE83380BF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F60B49E3-1373-486a-AC27-D1186BE40824}.exeC:\Windows\{F60B49E3-1373-486a-AC27-D1186BE40824}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0BB1DDEB-6504-4935-8A94-496FD22CD9B4}.exeC:\Windows\{0BB1DDEB-6504-4935-8A94-496FD22CD9B4}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8E0DEFD-5034-4f0f-84C9-6514EE0AC804}.exeC:\Windows\{B8E0DEFD-5034-4f0f-84C9-6514EE0AC804}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA9AE5F7-9FD5-46f8-8DC5-22A129628820}.exeC:\Windows\{CA9AE5F7-9FD5-46f8-8DC5-22A129628820}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0977399-25EC-4ffc-90C4-F22767448C9A}.exeC:\Windows\{A0977399-25EC-4ffc-90C4-F22767448C9A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{088D0A1E-D236-4bbf-955C-6B5D9328B986}.exeC:\Windows\{088D0A1E-D236-4bbf-955C-6B5D9328B986}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6CA06D9-37A4-40dd-85DD-F4051F4DB4C8}.exeC:\Windows\{C6CA06D9-37A4-40dd-85DD-F4051F4DB4C8}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\{90E3989B-ACFB-4f7d-BA7A-761307E2B36F}.exeC:\Windows\{90E3989B-ACFB-4f7d-BA7A-761307E2B36F}.exe12⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6CA0~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{088D0~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0977~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA9AE~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8E0D~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0BB1D~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F60B4~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4939~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{776BF~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C704~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{088D0A1E-D236-4bbf-955C-6B5D9328B986}.exe
{0BB1DDEB-6504-4935-8A94-496FD22CD9B4}.exe
{6C704EA9-CD1C-40f3-A553-3372296EF216}.exe
{776BFC71-56AF-4034-A4ED-C0C62C58CE54}.exe
{A0977399-25EC-4ffc-90C4-F22767448C9A}.exe
{B8E0DEFD-5034-4f0f-84C9-6514EE0AC804}.exe
{C4939ED9-EEA2-41ad-BFD6-D04AE83380BF}.exe
{C6CA06D9-37A4-40dd-85DD-F4051F4DB4C8}.exe
{CA9AE5F7-9FD5-46f8-8DC5-22A129628820}.exe
{F60B49E3-1373-486a-AC27-D1186BE40824}.exe
memory/544-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/544-23-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1436-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1436-25-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1460-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2040-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2040-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2040-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2220-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2220-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2220-11-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2340-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2340-18-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2808-60-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3176-59-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3176-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4120-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4120-37-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4432-51-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4556-58-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4556-53-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4876-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4876-43-0x0000000000400000-0x0000000000411000-memory.dmp