Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
14/08/2026, 10:48
General
- Target 2026-08-14_1c1e5f44bc8c6771976c18e88051ca2f_elex_wannacry.exe
- Size 64KB
- Sample260814-mv9xvsstdv
- SHA256 9a5b78267842f0a9c997560e54cb7488d357b15841dd5ae125a028a6d367ab5e
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 31 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_1c1e5f44bc8c6771976c18e88051ca2f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_1c1e5f44bc8c6771976c18e88051ca2f_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{181A378D-BB67-44c5-99EB-F7554EADF070}.exeC:\Windows\{181A378D-BB67-44c5-99EB-F7554EADF070}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{405C2F2E-4708-4319-96D8-AC5C3D63AA13}.exeC:\Windows\{405C2F2E-4708-4319-96D8-AC5C3D63AA13}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2067D3EC-4B8F-4727-B5C8-C06C1623D2FE}.exeC:\Windows\{2067D3EC-4B8F-4727-B5C8-C06C1623D2FE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ACBE099A-977B-4d2a-A748-77F91D91E001}.exeC:\Windows\{ACBE099A-977B-4d2a-A748-77F91D91E001}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D71131EB-5687-46f4-A346-2031F85DA4B5}.exeC:\Windows\{D71131EB-5687-46f4-A346-2031F85DA4B5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1FC8E5F1-08D3-41dd-913C-2DA418E22AD5}.exeC:\Windows\{1FC8E5F1-08D3-41dd-913C-2DA418E22AD5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E19CFBF-E53F-4559-9AF9-F9BE0150B57D}.exeC:\Windows\{4E19CFBF-E53F-4559-9AF9-F9BE0150B57D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2BA5FF78-5EDF-4578-BE69-A67B0A9E46EC}.exeC:\Windows\{2BA5FF78-5EDF-4578-BE69-A67B0A9E46EC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8CD42FE7-0324-41d1-873F-CBC98DCA7733}.exeC:\Windows\{8CD42FE7-0324-41d1-873F-CBC98DCA7733}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F6AB4C82-055F-470b-8E9D-C31C94CCD360}.exeC:\Windows\{F6AB4C82-055F-470b-8E9D-C31C94CCD360}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9300EC75-F19C-4d0a-A34F-034E447EA932}.exeC:\Windows\{9300EC75-F19C-4d0a-A34F-034E447EA932}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6AB4~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CD42~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2BA5F~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E19C~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1FC8E~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7113~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ACBE0~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2067D~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{405C2~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{181A3~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{181A378D-BB67-44c5-99EB-F7554EADF070}.exe
{1FC8E5F1-08D3-41dd-913C-2DA418E22AD5}.exe
{2067D3EC-4B8F-4727-B5C8-C06C1623D2FE}.exe
{2BA5FF78-5EDF-4578-BE69-A67B0A9E46EC}.exe
{405C2F2E-4708-4319-96D8-AC5C3D63AA13}.exe
{4E19CFBF-E53F-4559-9AF9-F9BE0150B57D}.exe
{8CD42FE7-0324-41d1-873F-CBC98DCA7733}.exe
{9300EC75-F19C-4d0a-A34F-034E447EA932}.exe
{ACBE099A-977B-4d2a-A748-77F91D91E001}.exe
{D71131EB-5687-46f4-A346-2031F85DA4B5}.exe
{F6AB4C82-055F-470b-8E9D-C31C94CCD360}.exe
memory/368-39-0x0000000000400000-0x0000000000410000-memory.dmp
memory/368-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/952-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/988-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/988-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/988-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1720-45-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2388-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2388-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2420-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2848-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2848-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2848-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4156-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4156-52-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4448-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4448-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4660-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4660-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4808-9-0x0000000000400000-0x0000000000410000-memory.dmp