Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
13/08/2026, 17:57
General
- Target 2026-08-13_b247af15a9ed69b92b2ff0bcd52a1b84_elex_wannacry.exe
- Size 84KB
- Sample260813-wjx9csvhjg
- SHA256 009e3e4a90bf09474a7fad164d1244dda1ece63d06cfffe6f0a178039f439a80
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 20 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 9 IoCs
- Drops file in Windows directory 9 IoCs
- Executes a command shell one-liner 1 TTPs 9 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_b247af15a9ed69b92b2ff0bcd52a1b84_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_b247af15a9ed69b92b2ff0bcd52a1b84_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A6D6E07-FD28-46bb-8FE2-64FF01D46C9F}.exeC:\Windows\{7A6D6E07-FD28-46bb-8FE2-64FF01D46C9F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9DCEF621-C008-4b2c-837C-0BD406A8F903}.exeC:\Windows\{9DCEF621-C008-4b2c-837C-0BD406A8F903}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E189F1F8-BF65-44c1-93F5-2D0E49D6D4AB}.exeC:\Windows\{E189F1F8-BF65-44c1-93F5-2D0E49D6D4AB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A959CB0-EA30-412e-8891-789813E663C0}.exeC:\Windows\{7A959CB0-EA30-412e-8891-789813E663C0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0EBF1FE1-C273-4a37-BA2A-212FD7FE0688}.exeC:\Windows\{0EBF1FE1-C273-4a37-BA2A-212FD7FE0688}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{326E811D-7007-4b4f-800F-B721B101CC96}.exeC:\Windows\{326E811D-7007-4b4f-800F-B721B101CC96}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44695426-70F6-46fe-871F-3C912D6B7F40}.exeC:\Windows\{44695426-70F6-46fe-871F-3C912D6B7F40}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2CD0779-E4F4-401a-A38B-6E41A5E17A7E}.exeC:\Windows\{F2CD0779-E4F4-401a-A38B-6E41A5E17A7E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF16365A-5248-4ef0-BF06-93448477F497}.exeC:\Windows\{AF16365A-5248-4ef0-BF06-93448477F497}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2CD0~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44695~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{326E8~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EBF1~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A959~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E189F~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9DCEF~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A6D6~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0EBF1FE1-C273-4a37-BA2A-212FD7FE0688}.exe
{326E811D-7007-4b4f-800F-B721B101CC96}.exe
{44695426-70F6-46fe-871F-3C912D6B7F40}.exe
{7A6D6E07-FD28-46bb-8FE2-64FF01D46C9F}.exe
{7A959CB0-EA30-412e-8891-789813E663C0}.exe
{9DCEF621-C008-4b2c-837C-0BD406A8F903}.exe
{AF16365A-5248-4ef0-BF06-93448477F497}.exe
{E189F1F8-BF65-44c1-93F5-2D0E49D6D4AB}.exe
{F2CD0779-E4F4-401a-A38B-6E41A5E17A7E}.exe
memory/1692-5-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1692-0-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1724-45-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1840-40-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1892-16-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2240-21-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2680-34-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3436-27-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4740-52-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5092-9-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5092-6-0x0000000000400000-0x0000000000416000-memory.dmp