Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 09:48
General
- Target 2026-07-30_c4815097fd0093b18832c703dffaeea3_elex_wannacry.exe
- Size 64KB
- Sample260730-lsxdbafc68
- SHA256 5d97fda28560c72eac7030a8ee0a340bfd92dc856a30e241b454199e94d0fd34
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Detects Windows executables referencing non-Windows User-Agents 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_c4815097fd0093b18832c703dffaeea3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_c4815097fd0093b18832c703dffaeea3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CC1A734-748D-4965-AF86-2BB33499BECF}.exeC:\Windows\{2CC1A734-748D-4965-AF86-2BB33499BECF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{476FF6A3-29A1-4744-B0C3-12F6A11EE0DD}.exeC:\Windows\{476FF6A3-29A1-4744-B0C3-12F6A11EE0DD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F5BE1B3-2059-40c5-A2F8-A8D8FC4BF601}.exeC:\Windows\{9F5BE1B3-2059-40c5-A2F8-A8D8FC4BF601}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{962ED9DC-4C78-4430-BE67-64348B12C4E8}.exeC:\Windows\{962ED9DC-4C78-4430-BE67-64348B12C4E8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0873C03D-5AD7-4a4e-8CCD-4F87E038FBA3}.exeC:\Windows\{0873C03D-5AD7-4a4e-8CCD-4F87E038FBA3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D87FD19-B7B8-4d8c-B29E-6E876AEF183F}.exeC:\Windows\{2D87FD19-B7B8-4d8c-B29E-6E876AEF183F}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D719D37-EB7D-4e1c-A8B6-87062042B86D}.exeC:\Windows\{9D719D37-EB7D-4e1c-A8B6-87062042B86D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{777CE644-19CE-4c4f-89E3-76AB44E53820}.exeC:\Windows\{777CE644-19CE-4c4f-89E3-76AB44E53820}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E413EDC-29C4-4b9f-91B5-FF7780E2FC89}.exeC:\Windows\{7E413EDC-29C4-4b9f-91B5-FF7780E2FC89}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FBC3937A-5DAF-4ba8-AC25-F137B2FC62BF}.exeC:\Windows\{FBC3937A-5DAF-4ba8-AC25-F137B2FC62BF}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A026335D-AF1D-4e77-9BAF-A3DE811EAE19}.exeC:\Windows\{A026335D-AF1D-4e77-9BAF-A3DE811EAE19}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBC39~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E413~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{777CE~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D719~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D87F~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0873C~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{962ED~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F5BE~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{476FF~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CC1A~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0873C03D-5AD7-4a4e-8CCD-4F87E038FBA3}.exe
{2CC1A734-748D-4965-AF86-2BB33499BECF}.exe
{2D87FD19-B7B8-4d8c-B29E-6E876AEF183F}.exe
{476FF6A3-29A1-4744-B0C3-12F6A11EE0DD}.exe
{777CE644-19CE-4c4f-89E3-76AB44E53820}.exe
{7E413EDC-29C4-4b9f-91B5-FF7780E2FC89}.exe
{962ED9DC-4C78-4430-BE67-64348B12C4E8}.exe
{9D719D37-EB7D-4e1c-A8B6-87062042B86D}.exe
{9F5BE1B3-2059-40c5-A2F8-A8D8FC4BF601}.exe
{A026335D-AF1D-4e77-9BAF-A3DE811EAE19}.exe
{FBC3937A-5DAF-4ba8-AC25-F137B2FC62BF}.exe
memory/212-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1460-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1460-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1496-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1496-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1560-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1560-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1660-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2552-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2552-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2904-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2904-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2904-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3832-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3832-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3876-59-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3876-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4076-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4076-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4508-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4508-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4508-1-0x0000000000400000-0x0000000000410000-memory.dmp