Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 09:45
General
- Target 2026-07-30_d9a2d51764889a10caa8d02ade123753_elex_wannacry.exe
- Size 64KB
- Sample260730-lq8cssgk9s
- SHA256 33ebc504d2966e5f2b37b66c3d7a780b3e8b24d0ec81a7dc1d401eb83c5993d2
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_d9a2d51764889a10caa8d02ade123753_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_d9a2d51764889a10caa8d02ade123753_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{245BFC84-1329-4c92-84B1-1141AEF0CE75}.exeC:\Windows\{245BFC84-1329-4c92-84B1-1141AEF0CE75}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE79275F-CC89-462a-B448-35C1624F18DC}.exeC:\Windows\{BE79275F-CC89-462a-B448-35C1624F18DC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7737C500-7840-4d25-B984-23FD57858773}.exeC:\Windows\{7737C500-7840-4d25-B984-23FD57858773}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31D971F9-6DBF-402b-8E58-02A495A51B96}.exeC:\Windows\{31D971F9-6DBF-402b-8E58-02A495A51B96}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F9CCA4E-1DC5-4764-8B4E-A499CC9A928C}.exeC:\Windows\{1F9CCA4E-1DC5-4764-8B4E-A499CC9A928C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16481A98-161A-4d21-897A-D17F0AAC931D}.exeC:\Windows\{16481A98-161A-4d21-897A-D17F0AAC931D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3879CD78-40A7-40cc-BE12-30335D105FA0}.exeC:\Windows\{3879CD78-40A7-40cc-BE12-30335D105FA0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4574F914-1722-4f7b-9CA6-B1847C0430E1}.exeC:\Windows\{4574F914-1722-4f7b-9CA6-B1847C0430E1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1177C132-BDB6-46f9-848F-A9693C267779}.exeC:\Windows\{1177C132-BDB6-46f9-848F-A9693C267779}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F205CB7A-FD44-4043-861F-92FBCAB3A0CA}.exeC:\Windows\{F205CB7A-FD44-4043-861F-92FBCAB3A0CA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5039B4CC-C50A-413b-8B95-3DCF573B4D86}.exeC:\Windows\{5039B4CC-C50A-413b-8B95-3DCF573B4D86}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F205C~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1177C~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4574F~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3879C~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16481~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F9CC~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31D97~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7737C~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE792~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{245BF~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1177C132-BDB6-46f9-848F-A9693C267779}.exe
{16481A98-161A-4d21-897A-D17F0AAC931D}.exe
{1F9CCA4E-1DC5-4764-8B4E-A499CC9A928C}.exe
{245BFC84-1329-4c92-84B1-1141AEF0CE75}.exe
{31D971F9-6DBF-402b-8E58-02A495A51B96}.exe
{3879CD78-40A7-40cc-BE12-30335D105FA0}.exe
{4574F914-1722-4f7b-9CA6-B1847C0430E1}.exe
{5039B4CC-C50A-413b-8B95-3DCF573B4D86}.exe
{7737C500-7840-4d25-B984-23FD57858773}.exe
{BE79275F-CC89-462a-B448-35C1624F18DC}.exe
{F205CB7A-FD44-4043-861F-92FBCAB3A0CA}.exe
memory/204-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/204-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1188-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1188-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1888-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1888-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2016-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2016-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3360-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3360-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4464-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4464-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4464-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4600-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4600-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4952-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4952-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5016-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5016-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5016-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5156-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5156-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5420-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5420-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5700-78-0x0000000000400000-0x0000000000410000-memory.dmp