Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 14:06
General
- Target 2026-08-02_88d385ffbcba41f7ca693bce46e6a912_elex_wannacry.exe
- Size 90KB
- Sample260802-red8gavanh
- SHA256 0b1668373c0237a18c22992302f9a57d0b1805a73455b6a7bd4e72b896a1df5f
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_88d385ffbcba41f7ca693bce46e6a912_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_88d385ffbcba41f7ca693bce46e6a912_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A09B99B0-C5D6-488e-82B2-10387A716D5E}.exeC:\Windows\{A09B99B0-C5D6-488e-82B2-10387A716D5E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4DE1FF28-0FA5-4205-A274-32EA4F7E0030}.exeC:\Windows\{4DE1FF28-0FA5-4205-A274-32EA4F7E0030}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC4342D0-BD3C-460b-8FA5-AF0A936E1235}.exeC:\Windows\{BC4342D0-BD3C-460b-8FA5-AF0A936E1235}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2C7BD0C0-193D-4861-8E5F-E8339154CBDF}.exeC:\Windows\{2C7BD0C0-193D-4861-8E5F-E8339154CBDF}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD435E3C-651C-4d29-925B-D376631BAA52}.exeC:\Windows\{AD435E3C-651C-4d29-925B-D376631BAA52}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{631616C8-5617-42a5-BE8C-524F9D226321}.exeC:\Windows\{631616C8-5617-42a5-BE8C-524F9D226321}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{018E60A8-9930-4882-B2EF-69E2BEFD336C}.exeC:\Windows\{018E60A8-9930-4882-B2EF-69E2BEFD336C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06AF4E86-7866-418e-AC10-CA5EF2A97E0D}.exeC:\Windows\{06AF4E86-7866-418e-AC10-CA5EF2A97E0D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FDE82094-32E3-4666-B615-B377535FC0A9}.exeC:\Windows\{FDE82094-32E3-4666-B615-B377535FC0A9}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7FFE20E7-43A4-4b2e-98BA-168FBF58DDBD}.exeC:\Windows\{7FFE20E7-43A4-4b2e-98BA-168FBF58DDBD}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7BAA54C-F7DD-42a8-B68A-0801D5807D56}.exeC:\Windows\{F7BAA54C-F7DD-42a8-B68A-0801D5807D56}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7FFE2~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FDE82~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06AF4~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{018E6~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63161~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD435~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C7BD~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC434~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4DE1F~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A09B9~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{018E60A8-9930-4882-B2EF-69E2BEFD336C}.exe
{06AF4E86-7866-418e-AC10-CA5EF2A97E0D}.exe
{2C7BD0C0-193D-4861-8E5F-E8339154CBDF}.exe
{4DE1FF28-0FA5-4205-A274-32EA4F7E0030}.exe
{631616C8-5617-42a5-BE8C-524F9D226321}.exe
{7FFE20E7-43A4-4b2e-98BA-168FBF58DDBD}.exe
{A09B99B0-C5D6-488e-82B2-10387A716D5E}.exe
{AD435E3C-651C-4d29-925B-D376631BAA52}.exe
{BC4342D0-BD3C-460b-8FA5-AF0A936E1235}.exe
{F7BAA54C-F7DD-42a8-B68A-0801D5807D56}.exe
{FDE82094-32E3-4666-B615-B377535FC0A9}.exe
memory/1480-11-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1480-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1480-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1852-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1852-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2960-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2960-52-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2964-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2964-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2964-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3372-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3372-26-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3496-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3496-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3504-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3748-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3748-37-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3932-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3932-31-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4120-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4120-24-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4428-66-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4680-54-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4680-58-0x0000000000400000-0x0000000000411000-memory.dmp