Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 11:48
General
- Target 2026-08-08_5f75b78a8d3c9c80985fa051902bfd20_elex_wannacry.exe
- Size 64KB
- Sample260808-nyt69azxes
- SHA256 73c6db882f4f268d041536e682b0a0fa5c88ce01015ab209c82f2b03468ff682
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_5f75b78a8d3c9c80985fa051902bfd20_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5f75b78a8d3c9c80985fa051902bfd20_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{500C6351-C6E2-4a63-BE22-8C8B26F71119}.exeC:\Windows\{500C6351-C6E2-4a63-BE22-8C8B26F71119}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7322B524-FFD7-42d2-93FD-51AF50E0CD12}.exeC:\Windows\{7322B524-FFD7-42d2-93FD-51AF50E0CD12}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C0BA171-9108-46e2-9706-8573581CE9B9}.exeC:\Windows\{6C0BA171-9108-46e2-9706-8573581CE9B9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50DB5577-A1CF-444d-827C-ABE7F8161FD9}.exeC:\Windows\{50DB5577-A1CF-444d-827C-ABE7F8161FD9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C9B9A0FD-A52D-4c4c-AFF4-5E1A58ADA3CC}.exeC:\Windows\{C9B9A0FD-A52D-4c4c-AFF4-5E1A58ADA3CC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A551E978-DAF9-4d3a-A4BA-439A74C8B1DC}.exeC:\Windows\{A551E978-DAF9-4d3a-A4BA-439A74C8B1DC}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5ACEFB7D-F247-4c4a-B6BA-894E8CE1A246}.exeC:\Windows\{5ACEFB7D-F247-4c4a-B6BA-894E8CE1A246}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3AD58E61-B1E2-41e0-9EC6-09FC34DC01CF}.exeC:\Windows\{3AD58E61-B1E2-41e0-9EC6-09FC34DC01CF}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99CA42E3-3726-45ed-A567-7FEBF34ABEE8}.exeC:\Windows\{99CA42E3-3726-45ed-A567-7FEBF34ABEE8}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE39DBBF-1733-4b54-901A-3E8AE3AD356D}.exeC:\Windows\{CE39DBBF-1733-4b54-901A-3E8AE3AD356D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0DF10C3D-97C3-4748-B545-64067CF8D74D}.exeC:\Windows\{0DF10C3D-97C3-4748-B545-64067CF8D74D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE39D~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99CA4~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3AD58~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5ACEF~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A551E~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9B9A~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50DB5~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C0BA~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7322B~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{500C6~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0DF10C3D-97C3-4748-B545-64067CF8D74D}.exe
{3AD58E61-B1E2-41e0-9EC6-09FC34DC01CF}.exe
{500C6351-C6E2-4a63-BE22-8C8B26F71119}.exe
{50DB5577-A1CF-444d-827C-ABE7F8161FD9}.exe
{5ACEFB7D-F247-4c4a-B6BA-894E8CE1A246}.exe
{6C0BA171-9108-46e2-9706-8573581CE9B9}.exe
{7322B524-FFD7-42d2-93FD-51AF50E0CD12}.exe
{99CA42E3-3726-45ed-A567-7FEBF34ABEE8}.exe
{A551E978-DAF9-4d3a-A4BA-439A74C8B1DC}.exe
{C9B9A0FD-A52D-4c4c-AFF4-5E1A58ADA3CC}.exe
{CE39DBBF-1733-4b54-901A-3E8AE3AD356D}.exe
memory/892-32-0x0000000000400000-0x0000000000410000-memory.dmp
memory/892-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1304-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1304-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1656-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1656-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1656-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1956-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1956-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3372-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3372-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3372-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4124-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4124-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4272-60-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4272-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4724-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4724-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5280-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5280-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5532-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5532-67-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5960-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5960-41-0x0000000000400000-0x0000000000410000-memory.dmp