Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 07:18
General
- Target 2026-08-14_920e685b241638f911f939c9f8f9d45f_elex_wannacry.exe
- Size 92KB
- Sample260814-h5ga3sxelf
- SHA256 5a1b4d3bf64ced14f5983595ac52562d305b6feebdec8145bf9eba4385f7e7e8
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_920e685b241638f911f939c9f8f9d45f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_920e685b241638f911f939c9f8f9d45f_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1C10531-3054-4d26-B878-C42A3AD50105}.exeC:\Windows\{A1C10531-3054-4d26-B878-C42A3AD50105}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37ED6444-47EE-4c94-B038-39BC0C1CDD4A}.exeC:\Windows\{37ED6444-47EE-4c94-B038-39BC0C1CDD4A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94F7D7EF-F8EB-4539-8F10-14F1A0D35F6E}.exeC:\Windows\{94F7D7EF-F8EB-4539-8F10-14F1A0D35F6E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCD8482A-BD9F-40d8-9D81-F16F84BFC0BB}.exeC:\Windows\{CCD8482A-BD9F-40d8-9D81-F16F84BFC0BB}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21D5A54F-6778-44d2-919B-0CAEC0C4EF4D}.exeC:\Windows\{21D5A54F-6778-44d2-919B-0CAEC0C4EF4D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA58E857-571A-49d2-AFE4-92AFC2247DDF}.exeC:\Windows\{DA58E857-571A-49d2-AFE4-92AFC2247DDF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4D07EAE-E76C-4f94-86E8-F0138041E5BC}.exeC:\Windows\{A4D07EAE-E76C-4f94-86E8-F0138041E5BC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2853797-BF7E-4fac-BAF7-BA8944C5DC86}.exeC:\Windows\{F2853797-BF7E-4fac-BAF7-BA8944C5DC86}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A982BDF4-3A0A-40a3-8A30-E5CD8FDB9D65}.exeC:\Windows\{A982BDF4-3A0A-40a3-8A30-E5CD8FDB9D65}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83F4920C-CE5A-4196-947B-3328E82B5273}.exeC:\Windows\{83F4920C-CE5A-4196-947B-3328E82B5273}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA459FCA-8060-450c-ACA3-4B32036638AA}.exeC:\Windows\{CA459FCA-8060-450c-ACA3-4B32036638AA}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83F49~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A982B~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2853~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4D07~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA58E~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21D5A~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCD84~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94F7D~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37ED6~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1C10~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{21D5A54F-6778-44d2-919B-0CAEC0C4EF4D}.exe
{37ED6444-47EE-4c94-B038-39BC0C1CDD4A}.exe
{83F4920C-CE5A-4196-947B-3328E82B5273}.exe
{94F7D7EF-F8EB-4539-8F10-14F1A0D35F6E}.exe
{A1C10531-3054-4d26-B878-C42A3AD50105}.exe
{A4D07EAE-E76C-4f94-86E8-F0138041E5BC}.exe
{A982BDF4-3A0A-40a3-8A30-E5CD8FDB9D65}.exe
{CA459FCA-8060-450c-ACA3-4B32036638AA}.exe
{CCD8482A-BD9F-40d8-9D81-F16F84BFC0BB}.exe
{DA58E857-571A-49d2-AFE4-92AFC2247DDF}.exe
{F2853797-BF7E-4fac-BAF7-BA8944C5DC86}.exe
memory/1084-61-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1084-56-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1908-28-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1908-20-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2260-69-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2260-63-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2280-1-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2280-7-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2280-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2976-54-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2976-49-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3692-47-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3692-42-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3708-21-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3708-14-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4752-77-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4848-12-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4848-8-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5736-34-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5736-40-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5768-27-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5768-35-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5960-70-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5960-76-0x0000000000400000-0x0000000000417000-memory.dmp