Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 21:57
General
- Target 2026-08-12_c72d410adbc9b458452a281a3db31b13_elex_wannacry.exe
- Size 64KB
- Sample260812-1tw69seq6v
- SHA256 79b74708c281a12d4b1d4f29fa79264617f44103378fe6fdeaf77c787fd22f8c
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_c72d410adbc9b458452a281a3db31b13_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_c72d410adbc9b458452a281a3db31b13_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53BA9678-3F85-4486-BCBD-F30BD625509C}.exeC:\Windows\{53BA9678-3F85-4486-BCBD-F30BD625509C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{47BB5802-6CE1-4e7b-83BB-15EFA0D09005}.exeC:\Windows\{47BB5802-6CE1-4e7b-83BB-15EFA0D09005}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A953403-3B83-4e7d-88D8-6A195FEE2F20}.exeC:\Windows\{4A953403-3B83-4e7d-88D8-6A195FEE2F20}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD8D7D18-1676-41d3-A884-B0799EE97C2C}.exeC:\Windows\{AD8D7D18-1676-41d3-A884-B0799EE97C2C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F5E32BA6-3C4A-4914-B4E8-F97EF05D4E0F}.exeC:\Windows\{F5E32BA6-3C4A-4914-B4E8-F97EF05D4E0F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{30F1AC83-DA39-4a41-9CDD-D9EAB72E08B1}.exeC:\Windows\{30F1AC83-DA39-4a41-9CDD-D9EAB72E08B1}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3759D486-6DE7-46e3-AE7B-30C41E692F57}.exeC:\Windows\{3759D486-6DE7-46e3-AE7B-30C41E692F57}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EDFD09F4-E971-45a1-A3C2-F861EFE43B23}.exeC:\Windows\{EDFD09F4-E971-45a1-A3C2-F861EFE43B23}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92003E09-DD14-46be-8BD6-66463AA7D4FC}.exeC:\Windows\{92003E09-DD14-46be-8BD6-66463AA7D4FC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78C14438-C504-42b2-96BA-9E0ECA96CFAC}.exeC:\Windows\{78C14438-C504-42b2-96BA-9E0ECA96CFAC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7BB4536C-DAA8-40cb-963B-43F24EBE7D1D}.exeC:\Windows\{7BB4536C-DAA8-40cb-963B-43F24EBE7D1D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78C14~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92003~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EDFD0~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3759D~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30F1A~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5E32~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD8D7~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A953~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47BB5~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53BA9~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{30F1AC83-DA39-4a41-9CDD-D9EAB72E08B1}.exe
{3759D486-6DE7-46e3-AE7B-30C41E692F57}.exe
{47BB5802-6CE1-4e7b-83BB-15EFA0D09005}.exe
{4A953403-3B83-4e7d-88D8-6A195FEE2F20}.exe
{53BA9678-3F85-4486-BCBD-F30BD625509C}.exe
{78C14438-C504-42b2-96BA-9E0ECA96CFAC}.exe
{7BB4536C-DAA8-40cb-963B-43F24EBE7D1D}.exe
{92003E09-DD14-46be-8BD6-66463AA7D4FC}.exe
{AD8D7D18-1676-41d3-A884-B0799EE97C2C}.exe
{EDFD09F4-E971-45a1-A3C2-F861EFE43B23}.exe
{F5E32BA6-3C4A-4914-B4E8-F97EF05D4E0F}.exe
memory/936-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/936-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2492-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2492-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3248-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3248-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3276-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3276-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3740-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3740-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3740-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3848-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3848-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3848-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3912-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3912-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4788-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4788-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4852-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4852-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5176-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5176-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5440-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6104-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6104-57-0x0000000000400000-0x0000000000410000-memory.dmp