Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
29/07/2026, 02:49
General
- Target 2026-07-29_40541a2257e52ce003d9c76556cebea3_elex_wannacry.exe
- Size 64KB
- Sample260729-da3hlsvvez
- SHA256 c087a6dac1ca3f0cd6ab2fa7eaf1653e520c5dd2d2ab1a44f7720d2ddae91d41
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_40541a2257e52ce003d9c76556cebea3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_40541a2257e52ce003d9c76556cebea3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{59792D8E-93E4-4407-B3DD-B5ED24D9EE16}.exeC:\Windows\{59792D8E-93E4-4407-B3DD-B5ED24D9EE16}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B11602DF-79A9-44c0-8E93-522FCE947099}.exeC:\Windows\{B11602DF-79A9-44c0-8E93-522FCE947099}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{975ED49D-2D92-46f5-B4BB-22A0493266D7}.exeC:\Windows\{975ED49D-2D92-46f5-B4BB-22A0493266D7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{70152FE6-0723-4456-AEBC-310B787E1C33}.exeC:\Windows\{70152FE6-0723-4456-AEBC-310B787E1C33}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F52F189-8058-4ad0-8CE9-B803F5DB19ED}.exeC:\Windows\{1F52F189-8058-4ad0-8CE9-B803F5DB19ED}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC66DA3B-6F5A-4a06-9222-246046F045A6}.exeC:\Windows\{AC66DA3B-6F5A-4a06-9222-246046F045A6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2C18CB26-0D2F-4053-BE78-A309565A5A02}.exeC:\Windows\{2C18CB26-0D2F-4053-BE78-A309565A5A02}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C9ED210-AFD2-46c4-91D7-8798D1867EDF}.exeC:\Windows\{8C9ED210-AFD2-46c4-91D7-8798D1867EDF}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{666F7174-873F-4eb1-98BA-FEAA9AD32E2E}.exeC:\Windows\{666F7174-873F-4eb1-98BA-FEAA9AD32E2E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3F641F60-AF54-487c-9A35-573BA21C945F}.exeC:\Windows\{3F641F60-AF54-487c-9A35-573BA21C945F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8DC243C1-2D47-4300-B4B2-B37A0AC26BA4}.exeC:\Windows\{8DC243C1-2D47-4300-B4B2-B37A0AC26BA4}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3F641~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{666F7~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C9ED~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C18C~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC66D~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F52F~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70152~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{975ED~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1160~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59792~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1F52F189-8058-4ad0-8CE9-B803F5DB19ED}.exe
{2C18CB26-0D2F-4053-BE78-A309565A5A02}.exe
{3F641F60-AF54-487c-9A35-573BA21C945F}.exe
{59792D8E-93E4-4407-B3DD-B5ED24D9EE16}.exe
{666F7174-873F-4eb1-98BA-FEAA9AD32E2E}.exe
{70152FE6-0723-4456-AEBC-310B787E1C33}.exe
{8C9ED210-AFD2-46c4-91D7-8798D1867EDF}.exe
{8DC243C1-2D47-4300-B4B2-B37A0AC26BA4}.exe
{975ED49D-2D92-46f5-B4BB-22A0493266D7}.exe
{AC66DA3B-6F5A-4a06-9222-246046F045A6}.exe
{B11602DF-79A9-44c0-8E93-522FCE947099}.exe
memory/1040-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1040-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1216-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1216-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1944-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1944-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2116-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2116-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2664-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2664-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2664-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2872-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2872-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3060-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3060-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3852-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3852-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3852-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4248-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4248-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4272-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4272-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5380-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5380-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5644-78-0x0000000000400000-0x0000000000410000-memory.dmp