Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 05:07
General
- Target 2026-07-30_a45418a76f5bbd48cdca0be6aea08b92_elex_wannacry.exe
- Size 60KB
- Sample260730-fsalnatvey
- SHA256 c68481eca929a32021068233a0118f9d8ea66642287fdc23ef879a066b351ae6
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_a45418a76f5bbd48cdca0be6aea08b92_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a45418a76f5bbd48cdca0be6aea08b92_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{68375B78-74D0-4f4b-90AD-F207295866DF}.exeC:\Windows\{68375B78-74D0-4f4b-90AD-F207295866DF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{897F65D5-DFEB-4e3e-816B-6C0F037E5B66}.exeC:\Windows\{897F65D5-DFEB-4e3e-816B-6C0F037E5B66}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9FA6ED5E-4569-4d8f-969D-A2CDC8866679}.exeC:\Windows\{9FA6ED5E-4569-4d8f-969D-A2CDC8866679}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1CD9B480-AAA3-4cef-BEB7-B8E17178A8B6}.exeC:\Windows\{1CD9B480-AAA3-4cef-BEB7-B8E17178A8B6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A093BEB-B797-4087-8CDF-F6CB183CD15B}.exeC:\Windows\{7A093BEB-B797-4087-8CDF-F6CB183CD15B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{343C90F0-8C93-49dd-9140-C3A919BA1651}.exeC:\Windows\{343C90F0-8C93-49dd-9140-C3A919BA1651}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85D5B984-A208-4364-BAC3-DDC694039C3C}.exeC:\Windows\{85D5B984-A208-4364-BAC3-DDC694039C3C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D66698F-5867-4e5d-B290-50162A440071}.exeC:\Windows\{3D66698F-5867-4e5d-B290-50162A440071}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1727149F-24FA-4d8a-93CD-10AFBE96AC34}.exeC:\Windows\{1727149F-24FA-4d8a-93CD-10AFBE96AC34}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5EAD5937-E86C-43f5-BE6D-AE3F3F680646}.exeC:\Windows\{5EAD5937-E86C-43f5-BE6D-AE3F3F680646}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B0CA05F1-FC34-41bf-B3A2-2E97B087E640}.exeC:\Windows\{B0CA05F1-FC34-41bf-B3A2-2E97B087E640}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5EAD5~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17271~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D666~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85D5B~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{343C9~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A093~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1CD9B~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FA6E~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{897F6~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68375~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1727149F-24FA-4d8a-93CD-10AFBE96AC34}.exe
{1CD9B480-AAA3-4cef-BEB7-B8E17178A8B6}.exe
{343C90F0-8C93-49dd-9140-C3A919BA1651}.exe
{3D66698F-5867-4e5d-B290-50162A440071}.exe
{5EAD5937-E86C-43f5-BE6D-AE3F3F680646}.exe
{68375B78-74D0-4f4b-90AD-F207295866DF}.exe
{7A093BEB-B797-4087-8CDF-F6CB183CD15B}.exe
{85D5B984-A208-4364-BAC3-DDC694039C3C}.exe
{897F65D5-DFEB-4e3e-816B-6C0F037E5B66}.exe
{9FA6ED5E-4569-4d8f-969D-A2CDC8866679}.exe
{B0CA05F1-FC34-41bf-B3A2-2E97B087E640}.exe