Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 06:06
General
- Target 2026-08-04_9d95845a0dda04708ee07b9a9b0cd015_elex_wannacry.exe
- Size 96KB
- Sample260804-gt74zsself
- SHA256 b1045582afee32b83fd886dbc5b2aed76bec3006bf59442e9eea80bc5cf19a18
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_9d95845a0dda04708ee07b9a9b0cd015_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_9d95845a0dda04708ee07b9a9b0cd015_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A0D80E3-C8F3-48f3-9230-0C15D75247E0}.exeC:\Windows\{7A0D80E3-C8F3-48f3-9230-0C15D75247E0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F0EB782-CBEF-457e-8ED7-FC1E677AA17F}.exeC:\Windows\{9F0EB782-CBEF-457e-8ED7-FC1E677AA17F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F3090D5-C545-4795-8ADB-D0FC16ECFE17}.exeC:\Windows\{9F3090D5-C545-4795-8ADB-D0FC16ECFE17}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{704926AB-CB54-4f71-8C15-700EAC048739}.exeC:\Windows\{704926AB-CB54-4f71-8C15-700EAC048739}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F28D16C2-9B84-4c2d-938E-5035700E05B8}.exeC:\Windows\{F28D16C2-9B84-4c2d-938E-5035700E05B8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DAEFCEEA-2A00-4f3f-A317-31D7E4041D38}.exeC:\Windows\{DAEFCEEA-2A00-4f3f-A317-31D7E4041D38}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D31F5912-3E8D-47d6-BB68-97F00982B87C}.exeC:\Windows\{D31F5912-3E8D-47d6-BB68-97F00982B87C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3638078-92F4-44a7-B5E8-CCFDDD4CBF18}.exeC:\Windows\{D3638078-92F4-44a7-B5E8-CCFDDD4CBF18}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B7E23CA-F256-46de-8063-A921559C5C65}.exeC:\Windows\{3B7E23CA-F256-46de-8063-A921559C5C65}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BF8B4E66-5481-442c-8C54-B218E6C516E5}.exeC:\Windows\{BF8B4E66-5481-442c-8C54-B218E6C516E5}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E1B9E0D-A8FE-4352-A075-D9B5D697940A}.exeC:\Windows\{2E1B9E0D-A8FE-4352-A075-D9B5D697940A}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BF8B4~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B7E2~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3638~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D31F5~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAEFC~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F28D1~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70492~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F309~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F0EB~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A0D8~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2E1B9E0D-A8FE-4352-A075-D9B5D697940A}.exe
{3B7E23CA-F256-46de-8063-A921559C5C65}.exe
{704926AB-CB54-4f71-8C15-700EAC048739}.exe
{7A0D80E3-C8F3-48f3-9230-0C15D75247E0}.exe
{9F0EB782-CBEF-457e-8ED7-FC1E677AA17F}.exe
{9F3090D5-C545-4795-8ADB-D0FC16ECFE17}.exe
{BF8B4E66-5481-442c-8C54-B218E6C516E5}.exe
{D31F5912-3E8D-47d6-BB68-97F00982B87C}.exe
{D3638078-92F4-44a7-B5E8-CCFDDD4CBF18}.exe
{DAEFCEEA-2A00-4f3f-A317-31D7E4041D38}.exe
{F28D16C2-9B84-4c2d-938E-5035700E05B8}.exe