Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 14:17
General
- Target 2026-07-31_755853dca868d14f7b9aba4ed614bbcf_elex_wannacry.exe
- Size 60KB
- Sample260731-rl2bkshp2x
- SHA256 06f2480b36c1ed0b9c8a0d0a1f757585272115386e63468b24c9e74e590e3f88
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_755853dca868d14f7b9aba4ed614bbcf_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_755853dca868d14f7b9aba4ed614bbcf_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{034B6E22-55CD-4e74-B392-3443566A2019}.exeC:\Windows\{034B6E22-55CD-4e74-B392-3443566A2019}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE2BA3BC-6FAC-48fc-989A-16501C8525A7}.exeC:\Windows\{AE2BA3BC-6FAC-48fc-989A-16501C8525A7}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F629F1EE-BCE8-485f-B44B-69F68465383B}.exeC:\Windows\{F629F1EE-BCE8-485f-B44B-69F68465383B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33DB7F58-1D05-4ab8-9A6B-29E6F735E603}.exeC:\Windows\{33DB7F58-1D05-4ab8-9A6B-29E6F735E603}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A192EA76-56B6-4e05-9DA2-8ADC37C16577}.exeC:\Windows\{A192EA76-56B6-4e05-9DA2-8ADC37C16577}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D911501B-19FE-45a2-B91D-E2FE7FB2CA4E}.exeC:\Windows\{D911501B-19FE-45a2-B91D-E2FE7FB2CA4E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF250B78-19F9-43da-AABF-024B34470C74}.exeC:\Windows\{DF250B78-19F9-43da-AABF-024B34470C74}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01ED9E0C-BABF-42b9-8B85-0990278ACC78}.exeC:\Windows\{01ED9E0C-BABF-42b9-8B85-0990278ACC78}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B75E753-B00B-4798-BF0E-3BA746FA2720}.exeC:\Windows\{5B75E753-B00B-4798-BF0E-3BA746FA2720}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99BDBE5C-4709-4b9a-855F-F206F8732F0D}.exeC:\Windows\{99BDBE5C-4709-4b9a-855F-F206F8732F0D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E952513-162D-4866-B7F6-A32E275A88CE}.exeC:\Windows\{9E952513-162D-4866-B7F6-A32E275A88CE}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99BDB~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B75E~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01ED9~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF250~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9115~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A192E~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33DB7~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F629F~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE2BA~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{034B6~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{01ED9E0C-BABF-42b9-8B85-0990278ACC78}.exe
{034B6E22-55CD-4e74-B392-3443566A2019}.exe
{33DB7F58-1D05-4ab8-9A6B-29E6F735E603}.exe
{5B75E753-B00B-4798-BF0E-3BA746FA2720}.exe
{99BDBE5C-4709-4b9a-855F-F206F8732F0D}.exe
{9E952513-162D-4866-B7F6-A32E275A88CE}.exe
{A192EA76-56B6-4e05-9DA2-8ADC37C16577}.exe
{AE2BA3BC-6FAC-48fc-989A-16501C8525A7}.exe
{D911501B-19FE-45a2-B91D-E2FE7FB2CA4E}.exe
{DF250B78-19F9-43da-AABF-024B34470C74}.exe
{F629F1EE-BCE8-485f-B44B-69F68465383B}.exe
memory/124-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/124-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/712-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/712-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1120-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1120-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2460-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2460-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2648-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2648-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3120-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3324-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3324-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3420-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3420-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3532-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3532-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3532-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4984-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4984-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5220-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5220-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5220-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5532-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5532-69-0x0000000000400000-0x0000000000410000-memory.dmp