Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
13/08/2026, 01:11
General
- Target 2026-08-12_5102195758994fef12c30924a89d58cf_elex_wannacry.exe
- Size 60KB
- Sample260813-bj98psxtaz
- SHA256 5b6308de36713c55a46d2b2e831b34073b751edbeeb2227098d7231787d8ca4b
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 37 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_5102195758994fef12c30924a89d58cf_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_5102195758994fef12c30924a89d58cf_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{347965A1-247B-4f2d-B4C4-D01EDAC36113}.exeC:\Windows\{347965A1-247B-4f2d-B4C4-D01EDAC36113}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD4A466F-55B2-4f99-9457-11C29AF343BB}.exeC:\Windows\{CD4A466F-55B2-4f99-9457-11C29AF343BB}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F74B10C-805F-418e-9D3D-758C9FF65857}.exeC:\Windows\{4F74B10C-805F-418e-9D3D-758C9FF65857}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51DD11F5-9005-44cc-B986-5888410003FA}.exeC:\Windows\{51DD11F5-9005-44cc-B986-5888410003FA}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3061FC6E-75D0-45dc-A09C-085122FFF9D2}.exeC:\Windows\{3061FC6E-75D0-45dc-A09C-085122FFF9D2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4BB73589-1D45-49d6-9A26-9C48FD952BC6}.exeC:\Windows\{4BB73589-1D45-49d6-9A26-9C48FD952BC6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2227ADAC-3533-4e5e-B8C6-C2D0F78F7D7A}.exeC:\Windows\{2227ADAC-3533-4e5e-B8C6-C2D0F78F7D7A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{43D3E4F0-6276-46b8-9E2B-B308E3E80B27}.exeC:\Windows\{43D3E4F0-6276-46b8-9E2B-B308E3E80B27}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0AC608E1-930A-4077-B54D-7F7F4F0E39FD}.exeC:\Windows\{0AC608E1-930A-4077-B54D-7F7F4F0E39FD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8C3AE48-0E3A-4a8e-A5B5-F68AE2D7F29B}.exeC:\Windows\{A8C3AE48-0E3A-4a8e-A5B5-F68AE2D7F29B}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE6B3E60-B7C8-48dd-9849-F14434B902D9}.exeC:\Windows\{CE6B3E60-B7C8-48dd-9849-F14434B902D9}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8C3A~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0AC60~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{43D3E~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2227A~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4BB73~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3061F~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51DD1~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F74B~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD4A4~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34796~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0AC608E1-930A-4077-B54D-7F7F4F0E39FD}.exe
{2227ADAC-3533-4e5e-B8C6-C2D0F78F7D7A}.exe
{3061FC6E-75D0-45dc-A09C-085122FFF9D2}.exe
{347965A1-247B-4f2d-B4C4-D01EDAC36113}.exe
{43D3E4F0-6276-46b8-9E2B-B308E3E80B27}.exe
{4BB73589-1D45-49d6-9A26-9C48FD952BC6}.exe
{4F74B10C-805F-418e-9D3D-758C9FF65857}.exe
{51DD11F5-9005-44cc-B986-5888410003FA}.exe
{A8C3AE48-0E3A-4a8e-A5B5-F68AE2D7F29B}.exe
{CD4A466F-55B2-4f99-9457-11C29AF343BB}.exe
{CE6B3E60-B7C8-48dd-9849-F14434B902D9}.exe
memory/248-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/248-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1120-72-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1120-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1784-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1784-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2120-79-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2560-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2560-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2560-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2764-52-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2764-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4108-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4108-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4136-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4136-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5056-45-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5056-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5056-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5544-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5544-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5804-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5804-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5804-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5964-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5964-43-0x0000000000400000-0x0000000000410000-memory.dmp