Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 17:29
General
- Target 2026-08-08_a3f6f5e8744428c8e25e31977bb76cb3_elex_wannacry.exe
- Size 60KB
- Sample260808-v2rnvsef53
- SHA256 921b5f0711438c971d9f20b80815784d0d4065b6686c32525e816558fb4b5f52
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a3f6f5e8744428c8e25e31977bb76cb3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a3f6f5e8744428c8e25e31977bb76cb3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C575137A-F3C2-48c1-A159-284B6404E0B6}.exeC:\Windows\{C575137A-F3C2-48c1-A159-284B6404E0B6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD1FEFB8-C4FD-4401-8392-EAE33528A7FF}.exeC:\Windows\{FD1FEFB8-C4FD-4401-8392-EAE33528A7FF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6FAE5715-1391-4470-9DEE-E9AF3985C947}.exeC:\Windows\{6FAE5715-1391-4470-9DEE-E9AF3985C947}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32EFB100-1B59-448c-B76B-2CB6F2EA89B2}.exeC:\Windows\{32EFB100-1B59-448c-B76B-2CB6F2EA89B2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0AC2F4F-7C8A-4c39-B083-E986DBA52B85}.exeC:\Windows\{F0AC2F4F-7C8A-4c39-B083-E986DBA52B85}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C6C24DA-B8F2-4392-B16F-AE6280478274}.exeC:\Windows\{9C6C24DA-B8F2-4392-B16F-AE6280478274}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F71CDB8-8F7A-47f6-983A-24ADE032D188}.exeC:\Windows\{2F71CDB8-8F7A-47f6-983A-24ADE032D188}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{648DFB67-8CB7-48c4-AE70-DB9C42BEC561}.exeC:\Windows\{648DFB67-8CB7-48c4-AE70-DB9C42BEC561}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85687679-0A06-4774-B365-1818302B233B}.exeC:\Windows\{85687679-0A06-4774-B365-1818302B233B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED24515F-66C2-45d2-B41A-BFAA4538D603}.exeC:\Windows\{ED24515F-66C2-45d2-B41A-BFAA4538D603}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5F83C835-29B9-4885-A287-0DC03208F9B3}.exeC:\Windows\{5F83C835-29B9-4885-A287-0DC03208F9B3}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED245~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85687~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{648DF~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F71C~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C6C2~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0AC2~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32EFB~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6FAE5~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD1FE~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5751~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2F71CDB8-8F7A-47f6-983A-24ADE032D188}.exe
{32EFB100-1B59-448c-B76B-2CB6F2EA89B2}.exe
{5F83C835-29B9-4885-A287-0DC03208F9B3}.exe
{648DFB67-8CB7-48c4-AE70-DB9C42BEC561}.exe
{6FAE5715-1391-4470-9DEE-E9AF3985C947}.exe
{85687679-0A06-4774-B365-1818302B233B}.exe
{9C6C24DA-B8F2-4392-B16F-AE6280478274}.exe
{C575137A-F3C2-48c1-A159-284B6404E0B6}.exe
{ED24515F-66C2-45d2-B41A-BFAA4538D603}.exe
{F0AC2F4F-7C8A-4c39-B083-E986DBA52B85}.exe
{FD1FEFB8-C4FD-4401-8392-EAE33528A7FF}.exe
memory/1524-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1728-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1728-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1736-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1736-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1736-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2076-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2076-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2364-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2364-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2716-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2716-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2808-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2808-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2808-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3028-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3028-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4620-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4620-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4748-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4748-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5984-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5984-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6100-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6100-43-0x0000000000400000-0x0000000000410000-memory.dmp