Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 03:33
General
- Target 2026-08-15_8f512d7cdc6c4657b57d9756b98c0657_elex_wannacry.exe
- Size 64KB
- Sample260815-d4ecwayakd
- SHA256 450bed71701005c6c84fda69104a78efce38e7380de5950b10fdefcaef164c00
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_8f512d7cdc6c4657b57d9756b98c0657_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_8f512d7cdc6c4657b57d9756b98c0657_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A42B5A5D-04AC-41b0-B8D8-DB0BF1C3CC55}.exeC:\Windows\{A42B5A5D-04AC-41b0-B8D8-DB0BF1C3CC55}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6472BE3B-8F34-4728-B52C-7BB8532E6A33}.exeC:\Windows\{6472BE3B-8F34-4728-B52C-7BB8532E6A33}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E44A6CD-1CED-4df9-A3E4-2DF9DD0E3912}.exeC:\Windows\{3E44A6CD-1CED-4df9-A3E4-2DF9DD0E3912}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{84E5D587-272A-4f00-B406-1E8020735FC7}.exeC:\Windows\{84E5D587-272A-4f00-B406-1E8020735FC7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C3B34AC-C678-48c3-BDC4-7B1E3B0CA3E8}.exeC:\Windows\{9C3B34AC-C678-48c3-BDC4-7B1E3B0CA3E8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C4891C8-3ECE-40c7-96BB-859958717EC8}.exeC:\Windows\{6C4891C8-3ECE-40c7-96BB-859958717EC8}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8C97822-01A9-4258-9CC1-D361D819E347}.exeC:\Windows\{E8C97822-01A9-4258-9CC1-D361D819E347}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60729A57-602E-4393-8861-96310622303F}.exeC:\Windows\{60729A57-602E-4393-8861-96310622303F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53887AC1-F2EF-425e-828A-56EDDA3D8571}.exeC:\Windows\{53887AC1-F2EF-425e-828A-56EDDA3D8571}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA54B72C-7156-4465-B7BB-83C47233E53E}.exeC:\Windows\{DA54B72C-7156-4465-B7BB-83C47233E53E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D2C0C813-7B8C-44c9-95C0-08C29ED3F6D8}.exeC:\Windows\{D2C0C813-7B8C-44c9-95C0-08C29ED3F6D8}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA54B~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53887~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60729~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8C97~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C489~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C3B3~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{84E5D~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E44A~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6472B~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A42B5~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{3E44A6CD-1CED-4df9-A3E4-2DF9DD0E3912}.exe
{53887AC1-F2EF-425e-828A-56EDDA3D8571}.exe
{60729A57-602E-4393-8861-96310622303F}.exe
{6472BE3B-8F34-4728-B52C-7BB8532E6A33}.exe
{6C4891C8-3ECE-40c7-96BB-859958717EC8}.exe
{84E5D587-272A-4f00-B406-1E8020735FC7}.exe
{9C3B34AC-C678-48c3-BDC4-7B1E3B0CA3E8}.exe
{A42B5A5D-04AC-41b0-B8D8-DB0BF1C3CC55}.exe
{D2C0C813-7B8C-44c9-95C0-08C29ED3F6D8}.exe
{DA54B72C-7156-4465-B7BB-83C47233E53E}.exe
{E8C97822-01A9-4258-9CC1-D361D819E347}.exe
memory/832-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/832-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1420-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1420-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1420-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1912-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1912-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2260-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2260-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2352-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2352-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3852-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3852-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3912-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3912-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4224-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4224-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4752-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4752-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4980-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4980-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4992-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4992-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4992-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5488-78-0x0000000000400000-0x0000000000410000-memory.dmp