Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 06:10
General
- Target 2026-08-04_99916ea93f91d51aa6b701923c54de28_elex_wannacry.exe
- Size 92KB
- Sample260804-gw5rmseb67
- SHA256 efe30984404ecefd369c8f3345e4fb84125d15b59ce7e3d131752b01ece9edf8
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_99916ea93f91d51aa6b701923c54de28_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_99916ea93f91d51aa6b701923c54de28_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E0C483A-7846-46b5-BFBE-F5BB056600B3}.exeC:\Windows\{6E0C483A-7846-46b5-BFBE-F5BB056600B3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB5395E0-1CE9-4e6f-B8EF-C26A33464B4E}.exeC:\Windows\{FB5395E0-1CE9-4e6f-B8EF-C26A33464B4E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5FD2B464-515E-48c4-AC3D-DEC3BA913830}.exeC:\Windows\{5FD2B464-515E-48c4-AC3D-DEC3BA913830}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB1E7381-37AA-471a-AEC3-394096185602}.exeC:\Windows\{AB1E7381-37AA-471a-AEC3-394096185602}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56BC26EA-CCB2-487b-A186-BAC7235298C2}.exeC:\Windows\{56BC26EA-CCB2-487b-A186-BAC7235298C2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{945D368F-68C1-4ac3-A4A2-2DC149EED034}.exeC:\Windows\{945D368F-68C1-4ac3-A4A2-2DC149EED034}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6278FC3A-AB81-40bc-8C5D-DA33D3D31D03}.exeC:\Windows\{6278FC3A-AB81-40bc-8C5D-DA33D3D31D03}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7FE7980D-AA78-45df-BBE7-CEFD4E4B965C}.exeC:\Windows\{7FE7980D-AA78-45df-BBE7-CEFD4E4B965C}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEAE15C1-D972-4021-B1C1-71BDC7BAD716}.exeC:\Windows\{AEAE15C1-D972-4021-B1C1-71BDC7BAD716}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5FC6397-F359-4988-8312-F45BFD657D72}.exeC:\Windows\{A5FC6397-F359-4988-8312-F45BFD657D72}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DEE424EF-9ACD-4f9d-B8F7-284E3D1B43EC}.exeC:\Windows\{DEE424EF-9ACD-4f9d-B8F7-284E3D1B43EC}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5FC6~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEAE1~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7FE79~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6278F~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{945D3~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56BC2~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB1E7~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FD2B~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB539~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E0C4~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{56BC26EA-CCB2-487b-A186-BAC7235298C2}.exe
{5FD2B464-515E-48c4-AC3D-DEC3BA913830}.exe
{6278FC3A-AB81-40bc-8C5D-DA33D3D31D03}.exe
{6E0C483A-7846-46b5-BFBE-F5BB056600B3}.exe
{7FE7980D-AA78-45df-BBE7-CEFD4E4B965C}.exe
{945D368F-68C1-4ac3-A4A2-2DC149EED034}.exe
{A5FC6397-F359-4988-8312-F45BFD657D72}.exe
{AB1E7381-37AA-471a-AEC3-394096185602}.exe
{AEAE15C1-D972-4021-B1C1-71BDC7BAD716}.exe
{DEE424EF-9ACD-4f9d-B8F7-284E3D1B43EC}.exe
{FB5395E0-1CE9-4e6f-B8EF-C26A33464B4E}.exe
memory/1620-50-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1620-55-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1632-57-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1632-63-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2384-36-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2384-41-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2464-12-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2464-6-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2712-27-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2712-23-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2712-21-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2872-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2872-1-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2872-7-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3320-34-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3320-29-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4916-78-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5364-64-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5364-71-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5644-70-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5644-76-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5764-14-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5764-19-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6032-48-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6032-43-0x0000000000400000-0x0000000000417000-memory.dmp