Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 13:21
General
- Target 2026-07-31_fc1ea6eb3141aba5e7fe9058671d263f_elex_wannacry.exe
- Size 64KB
- Sample260731-qlyd9abb77
- SHA256 43dfda55be3fe472e60939c23c2aa5a08a4689f11eb2260e8c094b1f56fee959
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 37 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_fc1ea6eb3141aba5e7fe9058671d263f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_fc1ea6eb3141aba5e7fe9058671d263f_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9726FC7D-4420-46df-80AA-C5EF3C8C49BF}.exeC:\Windows\{9726FC7D-4420-46df-80AA-C5EF3C8C49BF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E2B9D2D-5B90-41c0-B4E4-E3320F816171}.exeC:\Windows\{0E2B9D2D-5B90-41c0-B4E4-E3320F816171}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAB68DAE-E4AE-405b-9D8A-F3199B80FACD}.exeC:\Windows\{CAB68DAE-E4AE-405b-9D8A-F3199B80FACD}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{413711B9-889E-4fad-8F94-40CA590BD600}.exeC:\Windows\{413711B9-889E-4fad-8F94-40CA590BD600}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C80788D4-5818-4b95-AE3A-68CBAC2DEEF5}.exeC:\Windows\{C80788D4-5818-4b95-AE3A-68CBAC2DEEF5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F50EF44D-4371-4113-86B5-8904A7900161}.exeC:\Windows\{F50EF44D-4371-4113-86B5-8904A7900161}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ABF9AFF5-8EC8-4edc-A638-A292824AFBF2}.exeC:\Windows\{ABF9AFF5-8EC8-4edc-A638-A292824AFBF2}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A645045-D1CC-454c-A7ED-875CD2BBE164}.exeC:\Windows\{7A645045-D1CC-454c-A7ED-875CD2BBE164}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75960D6A-A44D-4499-B5F2-AC20EAB32ED8}.exeC:\Windows\{75960D6A-A44D-4499-B5F2-AC20EAB32ED8}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{243B46A6-159D-481c-8D3C-6EAC9ED6B1F2}.exeC:\Windows\{243B46A6-159D-481c-8D3C-6EAC9ED6B1F2}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8647601A-D134-40a4-A07E-17DD6837E600}.exeC:\Windows\{8647601A-D134-40a4-A07E-17DD6837E600}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{243B4~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75960~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A645~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ABF9A~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F50EF~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8078~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41371~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAB68~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E2B9~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9726F~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0E2B9D2D-5B90-41c0-B4E4-E3320F816171}.exe
{243B46A6-159D-481c-8D3C-6EAC9ED6B1F2}.exe
{413711B9-889E-4fad-8F94-40CA590BD600}.exe
{75960D6A-A44D-4499-B5F2-AC20EAB32ED8}.exe
{7A645045-D1CC-454c-A7ED-875CD2BBE164}.exe
{8647601A-D134-40a4-A07E-17DD6837E600}.exe
{9726FC7D-4420-46df-80AA-C5EF3C8C49BF}.exe
{ABF9AFF5-8EC8-4edc-A638-A292824AFBF2}.exe
{C80788D4-5818-4b95-AE3A-68CBAC2DEEF5}.exe
{CAB68DAE-E4AE-405b-9D8A-F3199B80FACD}.exe
{F50EF44D-4371-4113-86B5-8904A7900161}.exe
memory/1460-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1460-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3164-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3164-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3260-72-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3260-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3384-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3384-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3384-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4180-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4180-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4524-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4524-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4592-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4592-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4592-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4636-79-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5028-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5028-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5448-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5448-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5584-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5584-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5584-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5852-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5852-65-0x0000000000400000-0x0000000000410000-memory.dmp