Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 15:51
General
- Target 2026-08-06_1bf03a25cd4d470d659d7b343bb1bb0d_elex_wannacry.exe
- Size 98KB
- Sample260806-tafxlsvdrf
- SHA256 e9fe2ff9efa7856caa47b70d5fa0ec774a2693c26ef2103b5912ab82e36cf3f1
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_1bf03a25cd4d470d659d7b343bb1bb0d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_1bf03a25cd4d470d659d7b343bb1bb0d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED1517B3-52DF-470c-ADFD-9A8AD17F301A}.exeC:\Windows\{ED1517B3-52DF-470c-ADFD-9A8AD17F301A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC349749-BDF5-4207-B05C-BF65715029A4}.exeC:\Windows\{DC349749-BDF5-4207-B05C-BF65715029A4}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6434C0B6-1406-4d7b-85B7-AF4064122AE9}.exeC:\Windows\{6434C0B6-1406-4d7b-85B7-AF4064122AE9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9FC9CDB1-4F4B-423a-8244-1B9C79520131}.exeC:\Windows\{9FC9CDB1-4F4B-423a-8244-1B9C79520131}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E289D131-6E50-41d5-9BE3-C91FB476BBF7}.exeC:\Windows\{E289D131-6E50-41d5-9BE3-C91FB476BBF7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24E2D1EF-FF26-4405-A5ED-AAC4794A7839}.exeC:\Windows\{24E2D1EF-FF26-4405-A5ED-AAC4794A7839}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7811FEE3-0AEF-447a-B2E8-903C81B5D0EA}.exeC:\Windows\{7811FEE3-0AEF-447a-B2E8-903C81B5D0EA}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFB06BEE-AB00-42b1-950F-43F603E31527}.exeC:\Windows\{AFB06BEE-AB00-42b1-950F-43F603E31527}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{775AE15A-2696-43ed-9ED1-7F2880E164BC}.exeC:\Windows\{775AE15A-2696-43ed-9ED1-7F2880E164BC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E968C3BC-4CCD-4a97-AD50-9C15B0235DFE}.exeC:\Windows\{E968C3BC-4CCD-4a97-AD50-9C15B0235DFE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9CD1EF3-534E-4a6e-A882-71C33193D911}.exeC:\Windows\{D9CD1EF3-534E-4a6e-A882-71C33193D911}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E968C~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{775AE~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFB06~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7811F~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24E2D~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E289D~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FC9C~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6434C~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC349~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED151~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{24E2D1EF-FF26-4405-A5ED-AAC4794A7839}.exe
{6434C0B6-1406-4d7b-85B7-AF4064122AE9}.exe
{775AE15A-2696-43ed-9ED1-7F2880E164BC}.exe
{7811FEE3-0AEF-447a-B2E8-903C81B5D0EA}.exe
{9FC9CDB1-4F4B-423a-8244-1B9C79520131}.exe
{AFB06BEE-AB00-42b1-950F-43F603E31527}.exe
{D9CD1EF3-534E-4a6e-A882-71C33193D911}.exe
{DC349749-BDF5-4207-B05C-BF65715029A4}.exe
{E289D131-6E50-41d5-9BE3-C91FB476BBF7}.exe
{E968C3BC-4CCD-4a97-AD50-9C15B0235DFE}.exe
{ED1517B3-52DF-470c-ADFD-9A8AD17F301A}.exe
memory/1780-75-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1780-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4028-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4028-26-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4176-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4176-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4472-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4472-40-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4816-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4816-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4840-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4840-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5084-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5084-68-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5720-54-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5720-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5732-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5952-33-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5952-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6084-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6084-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6084-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6116-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6116-61-0x0000000000400000-0x0000000000411000-memory.dmp