Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 21:08
General
- Target 2026-08-13_150f30e3cb60f969c2fb44bea8e90df4_elex_wannacry.exe
- Size 60KB
- Sample260813-zy4apsyemc
- SHA256 2ca2f0a671d853defcd13bc78ebd65fe6fb671d0990ae3b2c495615ed7d5e6a6
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_150f30e3cb60f969c2fb44bea8e90df4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_150f30e3cb60f969c2fb44bea8e90df4_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6841D93E-C5F9-44ba-BAA6-FF8B9D0BBEFE}.exeC:\Windows\{6841D93E-C5F9-44ba-BAA6-FF8B9D0BBEFE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9914093A-C187-4fad-A34C-9586451B7B93}.exeC:\Windows\{9914093A-C187-4fad-A34C-9586451B7B93}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A9E33BF-F812-4733-95D6-2FDADEFC9A7A}.exeC:\Windows\{8A9E33BF-F812-4733-95D6-2FDADEFC9A7A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{468D0B4C-EF9F-4357-8A40-0F8D9E009BD9}.exeC:\Windows\{468D0B4C-EF9F-4357-8A40-0F8D9E009BD9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4BA1DD96-2B1F-48db-B120-1D44798C9373}.exeC:\Windows\{4BA1DD96-2B1F-48db-B120-1D44798C9373}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6ECE978-AD2A-4606-9585-8D1B32A4832A}.exeC:\Windows\{C6ECE978-AD2A-4606-9585-8D1B32A4832A}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4863DA51-6799-4495-808D-BCCB5124918C}.exeC:\Windows\{4863DA51-6799-4495-808D-BCCB5124918C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C51FFE8F-BB8B-42eb-9CA7-C460A54B43AC}.exeC:\Windows\{C51FFE8F-BB8B-42eb-9CA7-C460A54B43AC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4CDE2FC9-75AA-40dc-8A61-3EA192DAE899}.exeC:\Windows\{4CDE2FC9-75AA-40dc-8A61-3EA192DAE899}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64A581DF-6484-4e09-823C-313A60F27A20}.exeC:\Windows\{64A581DF-6484-4e09-823C-313A60F27A20}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F833C82-A4EB-4798-93FF-A2CC67D62CC9}.exeC:\Windows\{4F833C82-A4EB-4798-93FF-A2CC67D62CC9}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64A58~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4CDE2~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C51FF~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4863D~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6ECE~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4BA1D~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{468D0~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A9E3~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99140~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6841D~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{468D0B4C-EF9F-4357-8A40-0F8D9E009BD9}.exe
{4863DA51-6799-4495-808D-BCCB5124918C}.exe
{4BA1DD96-2B1F-48db-B120-1D44798C9373}.exe
{4CDE2FC9-75AA-40dc-8A61-3EA192DAE899}.exe
{4F833C82-A4EB-4798-93FF-A2CC67D62CC9}.exe
{64A581DF-6484-4e09-823C-313A60F27A20}.exe
{6841D93E-C5F9-44ba-BAA6-FF8B9D0BBEFE}.exe
{8A9E33BF-F812-4733-95D6-2FDADEFC9A7A}.exe
{9914093A-C187-4fad-A34C-9586451B7B93}.exe
{C51FFE8F-BB8B-42eb-9CA7-C460A54B43AC}.exe
{C6ECE978-AD2A-4606-9585-8D1B32A4832A}.exe