Analysis
- max time kernel
148s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
09/08/2026, 04:04
General
- Target 2026-08-09_b153702fe52435e20fe4b5093c37ee18_elex_wannacry.exe
- Size 64KB
- Sample260809-em2brattfv
- SHA256 43d78dd06b7eec860940266c641c5a070efc436b437b4cbaa3fb34d87b253778
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_b153702fe52435e20fe4b5093c37ee18_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b153702fe52435e20fe4b5093c37ee18_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8F1306D-9EFC-46dd-9A8C-CF9B18EF7175}.exeC:\Windows\{E8F1306D-9EFC-46dd-9A8C-CF9B18EF7175}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A40E25E6-77D2-41ff-9AFA-178A0198278A}.exeC:\Windows\{A40E25E6-77D2-41ff-9AFA-178A0198278A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD5929D3-4C8E-4ff5-96D5-E04346966FAB}.exeC:\Windows\{DD5929D3-4C8E-4ff5-96D5-E04346966FAB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13264F0E-B0F1-4073-9098-B3586DF751F2}.exeC:\Windows\{13264F0E-B0F1-4073-9098-B3586DF751F2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DCF6F1E6-C43B-4e6e-9508-DB4038DEA944}.exeC:\Windows\{DCF6F1E6-C43B-4e6e-9508-DB4038DEA944}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E0A610AD-0CB2-40f9-9BEF-2F1D4674250D}.exeC:\Windows\{E0A610AD-0CB2-40f9-9BEF-2F1D4674250D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{049F5C92-71DF-4ea0-9865-641C6D2E85A7}.exeC:\Windows\{049F5C92-71DF-4ea0-9865-641C6D2E85A7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD329B34-B8B5-4f78-B4AD-A030EE890693}.exeC:\Windows\{DD329B34-B8B5-4f78-B4AD-A030EE890693}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01257B3A-834A-436b-9B9F-954D684C72E5}.exeC:\Windows\{01257B3A-834A-436b-9B9F-954D684C72E5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F40FCAD8-1AA2-4c4a-9181-3D4BD6291EA3}.exeC:\Windows\{F40FCAD8-1AA2-4c4a-9181-3D4BD6291EA3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D566C04-C6E8-4749-B017-50168C4ECD3C}.exeC:\Windows\{1D566C04-C6E8-4749-B017-50168C4ECD3C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F40FC~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01257~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD329~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{049F5~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0A61~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DCF6F~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13264~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD592~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A40E2~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8F13~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{01257B3A-834A-436b-9B9F-954D684C72E5}.exe
{049F5C92-71DF-4ea0-9865-641C6D2E85A7}.exe
{13264F0E-B0F1-4073-9098-B3586DF751F2}.exe
{1D566C04-C6E8-4749-B017-50168C4ECD3C}.exe
{A40E25E6-77D2-41ff-9AFA-178A0198278A}.exe
{DCF6F1E6-C43B-4e6e-9508-DB4038DEA944}.exe
{DD329B34-B8B5-4f78-B4AD-A030EE890693}.exe
{DD5929D3-4C8E-4ff5-96D5-E04346966FAB}.exe
{E0A610AD-0CB2-40f9-9BEF-2F1D4674250D}.exe
{E8F1306D-9EFC-46dd-9A8C-CF9B18EF7175}.exe
{F40FCAD8-1AA2-4c4a-9181-3D4BD6291EA3}.exe