Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
12/08/2026, 03:47
General
- Target 2026-08-12_17e073a36d8790a7f17b8f173c1280b5_elex_wannacry.exe
- Size 68KB
- Sample260812-eca2tavvb1
- SHA256 8d61c5dab10638b53041ffc76cb3100c0d4e2098079ac9b8ecad8a4e62a89976
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_17e073a36d8790a7f17b8f173c1280b5_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_17e073a36d8790a7f17b8f173c1280b5_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0AF0FF24-3192-4cdf-98BA-2D48BCDECF5A}.exeC:\Windows\{0AF0FF24-3192-4cdf-98BA-2D48BCDECF5A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9EA41AE1-48B1-4344-9ADC-A6565CDCC209}.exeC:\Windows\{9EA41AE1-48B1-4344-9ADC-A6565CDCC209}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{261460B0-440E-4220-A0EB-1AF3CE8B2578}.exeC:\Windows\{261460B0-440E-4220-A0EB-1AF3CE8B2578}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DBA487CA-B08C-4a68-9076-17C834F4C865}.exeC:\Windows\{DBA487CA-B08C-4a68-9076-17C834F4C865}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF9CEA37-9EED-43c5-895D-E4DFCFCFEA45}.exeC:\Windows\{DF9CEA37-9EED-43c5-895D-E4DFCFCFEA45}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{70380E55-0FDC-4f57-B0C5-91F496EDCD2B}.exeC:\Windows\{70380E55-0FDC-4f57-B0C5-91F496EDCD2B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3221AEA9-52C2-4efe-9EB4-9B81C501CD64}.exeC:\Windows\{3221AEA9-52C2-4efe-9EB4-9B81C501CD64}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B599E2F-5A8B-43e5-B8F9-EAFD00BB339C}.exeC:\Windows\{0B599E2F-5A8B-43e5-B8F9-EAFD00BB339C}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{756DADA4-6480-4ae6-9D93-C53F024BDD80}.exeC:\Windows\{756DADA4-6480-4ae6-9D93-C53F024BDD80}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D3E4761-84A0-4fb5-9AD0-3DF4D78E0C08}.exeC:\Windows\{1D3E4761-84A0-4fb5-9AD0-3DF4D78E0C08}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E96311D6-B071-4c8a-B567-ECFF2449EE15}.exeC:\Windows\{E96311D6-B071-4c8a-B567-ECFF2449EE15}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D3E4~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{756DA~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B599~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3221A~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70380~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF9CE~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBA48~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26146~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EA41~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0AF0F~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0AF0FF24-3192-4cdf-98BA-2D48BCDECF5A}.exe
{0B599E2F-5A8B-43e5-B8F9-EAFD00BB339C}.exe
{1D3E4761-84A0-4fb5-9AD0-3DF4D78E0C08}.exe
{261460B0-440E-4220-A0EB-1AF3CE8B2578}.exe
{3221AEA9-52C2-4efe-9EB4-9B81C501CD64}.exe
{70380E55-0FDC-4f57-B0C5-91F496EDCD2B}.exe
{756DADA4-6480-4ae6-9D93-C53F024BDD80}.exe
{9EA41AE1-48B1-4344-9ADC-A6565CDCC209}.exe
{DBA487CA-B08C-4a68-9076-17C834F4C865}.exe
{DF9CEA37-9EED-43c5-895D-E4DFCFCFEA45}.exe
{E96311D6-B071-4c8a-B567-ECFF2449EE15}.exe
memory/436-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/436-43-0x0000000000400000-0x0000000000411000-memory.dmp
memory/828-65-0x0000000000400000-0x0000000000411000-memory.dmp
memory/828-62-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1128-31-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1128-25-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1700-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1700-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1700-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2148-37-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2148-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2864-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2864-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2864-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3368-68-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4156-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4156-32-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4228-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4228-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4316-54-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4316-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4460-24-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4460-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4920-18-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4920-13-0x0000000000400000-0x0000000000411000-memory.dmp