Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 10:56
General
- Target 2026-08-15_880ad9b2a69de9c12936d45f20db8887_elex_wannacry.exe
- Size 64KB
- Sample260815-m11ldafc84
- SHA256 ad09abcd330e4486d55fdd8cc1974765e701f6c3b7c99253ee7d0ca841b5352f
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_880ad9b2a69de9c12936d45f20db8887_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_880ad9b2a69de9c12936d45f20db8887_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56433427-F5CB-4c5e-9EF0-7810E4A5447D}.exeC:\Windows\{56433427-F5CB-4c5e-9EF0-7810E4A5447D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A72B441E-CAC3-42a2-96BA-68D6C0C7B41B}.exeC:\Windows\{A72B441E-CAC3-42a2-96BA-68D6C0C7B41B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{46718C42-6E80-4cb7-8C95-EDAA333E405B}.exeC:\Windows\{46718C42-6E80-4cb7-8C95-EDAA333E405B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9488F70-7445-407f-909F-A4B5BD6DDB94}.exeC:\Windows\{B9488F70-7445-407f-909F-A4B5BD6DDB94}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DFE96F80-F523-4055-BE21-21A0B54C464D}.exeC:\Windows\{DFE96F80-F523-4055-BE21-21A0B54C464D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5379106A-ABDF-40c2-A581-FAE88C2B61B9}.exeC:\Windows\{5379106A-ABDF-40c2-A581-FAE88C2B61B9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C752CE06-47D6-401b-BED9-83D16FCCEDB3}.exeC:\Windows\{C752CE06-47D6-401b-BED9-83D16FCCEDB3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{54EA83F5-AF10-4e02-A10E-F118D5BCFAD1}.exeC:\Windows\{54EA83F5-AF10-4e02-A10E-F118D5BCFAD1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F4A9BBCD-D985-4a7c-81B8-9E9AFE6EFE9F}.exeC:\Windows\{F4A9BBCD-D985-4a7c-81B8-9E9AFE6EFE9F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B95B8D3-EEA1-4111-B91B-B615D14C89F6}.exeC:\Windows\{9B95B8D3-EEA1-4111-B91B-B615D14C89F6}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8EE0ABDF-8DFE-459d-A1DB-AB532200C76D}.exeC:\Windows\{8EE0ABDF-8DFE-459d-A1DB-AB532200C76D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B95B~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4A9B~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{54EA8~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C752C~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53791~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DFE96~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9488~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46718~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A72B4~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56433~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{46718C42-6E80-4cb7-8C95-EDAA333E405B}.exe
{5379106A-ABDF-40c2-A581-FAE88C2B61B9}.exe
{54EA83F5-AF10-4e02-A10E-F118D5BCFAD1}.exe
{56433427-F5CB-4c5e-9EF0-7810E4A5447D}.exe
{8EE0ABDF-8DFE-459d-A1DB-AB532200C76D}.exe
{9B95B8D3-EEA1-4111-B91B-B615D14C89F6}.exe
{A72B441E-CAC3-42a2-96BA-68D6C0C7B41B}.exe
{B9488F70-7445-407f-909F-A4B5BD6DDB94}.exe
{C752CE06-47D6-401b-BED9-83D16FCCEDB3}.exe
{DFE96F80-F523-4055-BE21-21A0B54C464D}.exe
{F4A9BBCD-D985-4a7c-81B8-9E9AFE6EFE9F}.exe