Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/07/2026, 08:35
General
- Target 2026-07-29_244575b059aad7f5fd3006bb8473ab9a_elex_wannacry.exe
- Size 90KB
- Sample260729-khdmsa11ev
- SHA256 45bb7ae2547d6a1a8a3d7dae8a9ede19faec7cf4dd913904fcd4d03c6335d83f
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 27 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 9 IoCs
- Drops file in Windows directory 9 IoCs
- Executes a command shell one-liner 1 TTPs 9 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_244575b059aad7f5fd3006bb8473ab9a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_244575b059aad7f5fd3006bb8473ab9a_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B6716BA-A9D0-4a43-8B8A-CD491C7DAD5B}.exeC:\Windows\{1B6716BA-A9D0-4a43-8B8A-CD491C7DAD5B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5418F78D-C5E0-4e39-9E09-A637866FE81F}.exeC:\Windows\{5418F78D-C5E0-4e39-9E09-A637866FE81F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{611F81FF-546D-40fb-AA0E-8EE23E7752B2}.exeC:\Windows\{611F81FF-546D-40fb-AA0E-8EE23E7752B2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A0A010B-0761-49ad-A912-2E29C431867B}.exeC:\Windows\{7A0A010B-0761-49ad-A912-2E29C431867B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1967A7F-B087-4d7a-AC2F-8F699068558A}.exeC:\Windows\{D1967A7F-B087-4d7a-AC2F-8F699068558A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31FE6236-1F9D-4141-A727-CA212AED2025}.exeC:\Windows\{31FE6236-1F9D-4141-A727-CA212AED2025}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAD242A9-C578-4bb8-90AF-7FD5543A3A43}.exeC:\Windows\{CAD242A9-C578-4bb8-90AF-7FD5543A3A43}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D66C6BC7-3E64-43b3-A971-9E22037EF673}.exeC:\Windows\{D66C6BC7-3E64-43b3-A971-9E22037EF673}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0DC7906B-DD3C-4645-A2AF-E45415847753}.exeC:\Windows\{0DC7906B-DD3C-4645-A2AF-E45415847753}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D66C6~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAD24~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31FE6~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1967~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A0A0~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{611F8~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5418F~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B671~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0DC7906B-DD3C-4645-A2AF-E45415847753}.exe
{1B6716BA-A9D0-4a43-8B8A-CD491C7DAD5B}.exe
{31FE6236-1F9D-4141-A727-CA212AED2025}.exe
{5418F78D-C5E0-4e39-9E09-A637866FE81F}.exe
{611F81FF-546D-40fb-AA0E-8EE23E7752B2}.exe
{7A0A010B-0761-49ad-A912-2E29C431867B}.exe
{CAD242A9-C578-4bb8-90AF-7FD5543A3A43}.exe
{D1967A7F-B087-4d7a-AC2F-8F699068558A}.exe
{D66C6BC7-3E64-43b3-A971-9E22037EF673}.exe
memory/812-45-0x0000000000400000-0x0000000000411000-memory.dmp
memory/812-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1196-39-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1196-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1656-23-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1656-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2240-16-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2404-32-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2716-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2716-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3348-46-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3348-51-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4304-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4304-18-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4464-52-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4876-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4876-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4876-1-0x0000000000400000-0x0000000000411000-memory.dmp