Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 07:51
General
- Target 2026-07-30_72a174dfc628045da81ec87b1d070fe9_elex_wannacry.exe
- Size 68KB
- Sample260730-jp8k3axtdy
- SHA256 d0e38dbf4172db7dcc9ef15e9f135b37d4141ebadebc646af1d458dfe9f68b1b
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_72a174dfc628045da81ec87b1d070fe9_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_72a174dfc628045da81ec87b1d070fe9_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A279154-51B0-4a9e-833E-541D16C3EE0B}.exeC:\Windows\{7A279154-51B0-4a9e-833E-541D16C3EE0B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0233F387-2B0D-4eb7-B3F8-91804A67C0A0}.exeC:\Windows\{0233F387-2B0D-4eb7-B3F8-91804A67C0A0}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56DE25FB-99EB-47e8-984E-DADA86F07EDB}.exeC:\Windows\{56DE25FB-99EB-47e8-984E-DADA86F07EDB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F99A34E2-3DB4-4061-933B-2A261B79DABE}.exeC:\Windows\{F99A34E2-3DB4-4061-933B-2A261B79DABE}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{38EF333F-9FDC-4cb3-ADC4-FAF6212385DE}.exeC:\Windows\{38EF333F-9FDC-4cb3-ADC4-FAF6212385DE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BAC3EB51-C8CB-4edc-9F43-A4EAD3D0D7BC}.exeC:\Windows\{BAC3EB51-C8CB-4edc-9F43-A4EAD3D0D7BC}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D159A6F-0F18-431d-AF38-8BAEE9C8A861}.exeC:\Windows\{2D159A6F-0F18-431d-AF38-8BAEE9C8A861}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA6F6C62-B9D6-47b4-A206-A00312676B7E}.exeC:\Windows\{CA6F6C62-B9D6-47b4-A206-A00312676B7E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFFD1ADC-95AD-4516-8620-1C9DE5D8B75E}.exeC:\Windows\{AFFD1ADC-95AD-4516-8620-1C9DE5D8B75E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71D63D93-7278-4245-A424-6EACAC491872}.exeC:\Windows\{71D63D93-7278-4245-A424-6EACAC491872}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B1E81889-053F-4d72-8CAF-632241C14B5F}.exeC:\Windows\{B1E81889-053F-4d72-8CAF-632241C14B5F}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71D63~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFFD1~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA6F6~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D159~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BAC3E~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38EF3~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F99A3~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56DE2~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0233F~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A279~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0233F387-2B0D-4eb7-B3F8-91804A67C0A0}.exe
{2D159A6F-0F18-431d-AF38-8BAEE9C8A861}.exe
{38EF333F-9FDC-4cb3-ADC4-FAF6212385DE}.exe
{56DE25FB-99EB-47e8-984E-DADA86F07EDB}.exe
{71D63D93-7278-4245-A424-6EACAC491872}.exe
{7A279154-51B0-4a9e-833E-541D16C3EE0B}.exe
{AFFD1ADC-95AD-4516-8620-1C9DE5D8B75E}.exe
{B1E81889-053F-4d72-8CAF-632241C14B5F}.exe
{BAC3EB51-C8CB-4edc-9F43-A4EAD3D0D7BC}.exe
{CA6F6C62-B9D6-47b4-A206-A00312676B7E}.exe
{F99A34E2-3DB4-4061-933B-2A261B79DABE}.exe
memory/564-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/564-30-0x0000000000400000-0x0000000000411000-memory.dmp
memory/888-17-0x0000000000400000-0x0000000000411000-memory.dmp
memory/888-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2308-59-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2308-65-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2600-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2600-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2600-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2728-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2832-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2832-23-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3648-11-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3648-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4852-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4852-54-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5048-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5048-25-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5596-40-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5596-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5692-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5692-42-0x0000000000400000-0x0000000000411000-memory.dmp