Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 04:27
General
- Target 2026-08-10_8ca168be7197a8aa8e08666a3feb5264_elex_wannacry.exe
- Size 98KB
- Sample260810-e273vaar9v
- SHA256 d8bb24320da23e0569150046d1c26ae232a50f5832e2790a9a89079bdf250817
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_8ca168be7197a8aa8e08666a3feb5264_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8ca168be7197a8aa8e08666a3feb5264_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8AF56BAA-080E-4eb4-8EFA-5456BDD68ED3}.exeC:\Windows\{8AF56BAA-080E-4eb4-8EFA-5456BDD68ED3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7B63A9F-A5A5-469a-AC51-95857E81602E}.exeC:\Windows\{A7B63A9F-A5A5-469a-AC51-95857E81602E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4406F96-E8BC-4676-88F6-7BDF8D01E5A5}.exeC:\Windows\{E4406F96-E8BC-4676-88F6-7BDF8D01E5A5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A69E39E5-55FC-43b4-A48C-322AF22AC12D}.exeC:\Windows\{A69E39E5-55FC-43b4-A48C-322AF22AC12D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4130B1C2-0379-4b6a-867D-66B91632F65D}.exeC:\Windows\{4130B1C2-0379-4b6a-867D-66B91632F65D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87F01429-B344-45d9-8170-E1166A6E3F36}.exeC:\Windows\{87F01429-B344-45d9-8170-E1166A6E3F36}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D760D8E4-54C2-4a5a-AEA3-8C87EB6F3DC3}.exeC:\Windows\{D760D8E4-54C2-4a5a-AEA3-8C87EB6F3DC3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{889799B0-2DE5-4721-8463-800A1BA649FC}.exeC:\Windows\{889799B0-2DE5-4721-8463-800A1BA649FC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{539EABDD-4814-4052-A300-9613454FF52E}.exeC:\Windows\{539EABDD-4814-4052-A300-9613454FF52E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A9D7801-89C0-4a45-B5E7-8D3FA4883076}.exeC:\Windows\{1A9D7801-89C0-4a45-B5E7-8D3FA4883076}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D0B7895-F33E-4808-B2CF-BD17E132CF97}.exeC:\Windows\{9D0B7895-F33E-4808-B2CF-BD17E132CF97}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A9D7~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{539EA~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88979~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D760D~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87F01~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4130B~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A69E3~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4406~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7B63~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AF56~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1A9D7801-89C0-4a45-B5E7-8D3FA4883076}.exe
{4130B1C2-0379-4b6a-867D-66B91632F65D}.exe
{539EABDD-4814-4052-A300-9613454FF52E}.exe
{87F01429-B344-45d9-8170-E1166A6E3F36}.exe
{889799B0-2DE5-4721-8463-800A1BA649FC}.exe
{8AF56BAA-080E-4eb4-8EFA-5456BDD68ED3}.exe
{9D0B7895-F33E-4808-B2CF-BD17E132CF97}.exe
{A69E39E5-55FC-43b4-A48C-322AF22AC12D}.exe
{A7B63A9F-A5A5-469a-AC51-95857E81602E}.exe
{D760D8E4-54C2-4a5a-AEA3-8C87EB6F3DC3}.exe
{E4406F96-E8BC-4676-88F6-7BDF8D01E5A5}.exe
memory/540-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/540-40-0x0000000000400000-0x0000000000411000-memory.dmp
memory/552-11-0x0000000000400000-0x0000000000411000-memory.dmp
memory/552-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/556-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/884-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/884-53-0x0000000000400000-0x0000000000411000-memory.dmp
memory/948-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/948-17-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1636-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1636-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1636-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3400-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4296-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4368-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4368-46-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4368-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4380-24-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4380-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4756-33-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5096-54-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5096-59-0x0000000000400000-0x0000000000411000-memory.dmp