Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 03:30
General
- Target 2026-08-02_1e9bb935ffe0c0c94e0cf039c4b19cc3_elex_wannacry.exe
- Size 24KB
- Sample260802-d2wjdatcng
- SHA256 b9f5418d3834572a6880aa081cd706c643a71b5b440e22ff13e7caf6c39d82b6
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 45 IoCs
- UPX dump on OEP (original entry point) 45 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_1e9bb935ffe0c0c94e0cf039c4b19cc3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_1e9bb935ffe0c0c94e0cf039c4b19cc3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05F85506-8492-4499-B3F7-173615F5D17D}.exeC:\Windows\{05F85506-8492-4499-B3F7-173615F5D17D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{66A5B028-597F-4fcb-89B8-31ADB144F954}.exeC:\Windows\{66A5B028-597F-4fcb-89B8-31ADB144F954}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A079FD6-4850-4e85-A9E3-FA81F3FE6FF9}.exeC:\Windows\{8A079FD6-4850-4e85-A9E3-FA81F3FE6FF9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3685D1E-0E3B-478a-AF69-C0B21D38A465}.exeC:\Windows\{C3685D1E-0E3B-478a-AF69-C0B21D38A465}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF9D9519-F8AF-4a3e-A7CC-6E8D297D3AA1}.exeC:\Windows\{AF9D9519-F8AF-4a3e-A7CC-6E8D297D3AA1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19B126D6-8AA9-4d67-83A8-E4D234B57CC5}.exeC:\Windows\{19B126D6-8AA9-4d67-83A8-E4D234B57CC5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27235EAD-C9B1-43b8-A79B-822050D68217}.exeC:\Windows\{27235EAD-C9B1-43b8-A79B-822050D68217}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{66D0DE8B-7364-4295-9791-41215DB3B71F}.exeC:\Windows\{66D0DE8B-7364-4295-9791-41215DB3B71F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05FCA334-5228-499e-A023-E5622F017C19}.exeC:\Windows\{05FCA334-5228-499e-A023-E5622F017C19}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{818BC5F2-1784-4b9e-B872-76BCBFD42F8C}.exeC:\Windows\{818BC5F2-1784-4b9e-B872-76BCBFD42F8C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A96E5CB-73CB-4e54-A7A3-CE65A9D6E3FA}.exeC:\Windows\{1A96E5CB-73CB-4e54-A7A3-CE65A9D6E3FA}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{818BC~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05FCA~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{66D0D~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27235~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19B12~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF9D9~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3685~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A079~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{66A5B~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05F85~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{05F85506-8492-4499-B3F7-173615F5D17D}.exe
{05FCA334-5228-499e-A023-E5622F017C19}.exe
{19B126D6-8AA9-4d67-83A8-E4D234B57CC5}.exe
{1A96E5CB-73CB-4e54-A7A3-CE65A9D6E3FA}.exe
{27235EAD-C9B1-43b8-A79B-822050D68217}.exe
{66A5B028-597F-4fcb-89B8-31ADB144F954}.exe
{66D0DE8B-7364-4295-9791-41215DB3B71F}.exe
{818BC5F2-1784-4b9e-B872-76BCBFD42F8C}.exe
{8A079FD6-4850-4e85-A9E3-FA81F3FE6FF9}.exe
{AF9D9519-F8AF-4a3e-A7CC-6E8D297D3AA1}.exe
{C3685D1E-0E3B-478a-AF69-C0B21D38A465}.exe
memory/2408-33-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2408-37-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2408-31-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2692-55-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2692-57-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2692-61-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2812-71-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2812-73-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2812-77-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2912-15-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2912-9-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2912-6-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3120-30-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3120-25-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3120-22-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3160-87-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4532-70-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4532-65-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4532-63-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4760-45-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4760-39-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4760-41-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5192-49-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5192-47-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5192-53-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5560-14-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5560-23-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5560-17-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5864-79-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5864-81-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5864-85-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5872-0-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5872-7-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5872-1-0x0000000000400000-0x0000000000413000-memory.dmp