Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
13/08/2026, 13:32
General
- Target 2026-08-13_2b022a04a13d9bde7821afa8348f86de_elex_wannacry.exe
- Size 64KB
- Sample260813-qs6dfazxht
- SHA256 51360d0df9f8f8304f834f4938559a0bf11fc56700e56696afc538c36f60489b
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_2b022a04a13d9bde7821afa8348f86de_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_2b022a04a13d9bde7821afa8348f86de_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83DE982C-05E8-424f-8108-E9E9FB7B65E9}.exeC:\Windows\{83DE982C-05E8-424f-8108-E9E9FB7B65E9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F17C523-3A7A-43ee-8BD6-37E440B30938}.exeC:\Windows\{7F17C523-3A7A-43ee-8BD6-37E440B30938}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B3ED2C3-2FEC-40b6-B443-532F04E655F3}.exeC:\Windows\{0B3ED2C3-2FEC-40b6-B443-532F04E655F3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D4F6D0F-0D2B-4409-9122-7837ACD0712B}.exeC:\Windows\{5D4F6D0F-0D2B-4409-9122-7837ACD0712B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{871DABD6-DBEC-4c42-891C-71CFE9D316FE}.exeC:\Windows\{871DABD6-DBEC-4c42-891C-71CFE9D316FE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D134D71C-FD75-4dc1-8C2F-69806B06F1C3}.exeC:\Windows\{D134D71C-FD75-4dc1-8C2F-69806B06F1C3}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9654AF53-3566-43d3-AA9D-3CA6330A75D8}.exeC:\Windows\{9654AF53-3566-43d3-AA9D-3CA6330A75D8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D533510-7735-4e40-A570-549B718EB814}.exeC:\Windows\{3D533510-7735-4e40-A570-549B718EB814}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5EEC49D6-7249-4e72-B301-456654457FAA}.exeC:\Windows\{5EEC49D6-7249-4e72-B301-456654457FAA}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5BABC487-C32F-437c-8EE1-9C9BE5A1EFA7}.exeC:\Windows\{5BABC487-C32F-437c-8EE1-9C9BE5A1EFA7}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{094AC305-F56F-44cb-8E72-FC0B14B31522}.exeC:\Windows\{094AC305-F56F-44cb-8E72-FC0B14B31522}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5BABC~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5EEC4~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D533~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9654A~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D134D~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{871DA~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D4F6~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B3ED~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F17C~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83DE9~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{094AC305-F56F-44cb-8E72-FC0B14B31522}.exe
{0B3ED2C3-2FEC-40b6-B443-532F04E655F3}.exe
{3D533510-7735-4e40-A570-549B718EB814}.exe
{5BABC487-C32F-437c-8EE1-9C9BE5A1EFA7}.exe
{5D4F6D0F-0D2B-4409-9122-7837ACD0712B}.exe
{5EEC49D6-7249-4e72-B301-456654457FAA}.exe
{7F17C523-3A7A-43ee-8BD6-37E440B30938}.exe
{83DE982C-05E8-424f-8108-E9E9FB7B65E9}.exe
{871DABD6-DBEC-4c42-891C-71CFE9D316FE}.exe
{9654AF53-3566-43d3-AA9D-3CA6330A75D8}.exe
{D134D71C-FD75-4dc1-8C2F-69806B06F1C3}.exe
memory/276-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/276-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1292-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1292-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1612-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1612-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1616-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1616-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2500-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2500-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2500-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3288-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3288-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4448-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4668-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4668-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4668-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4720-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4720-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4788-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4788-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5252-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5252-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5940-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5940-76-0x0000000000400000-0x0000000000410000-memory.dmp