Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/08/2026, 07:55
General
- Target 2026-08-16_4ed8ee6b154656d260f1ba0757620b24_elex_wannacry.exe
- Size 84KB
- Sample260816-jsg8aashpc
- SHA256 65214db224912092e43012c483b477759c1c9320402ec34ff4e8c85fa782f6b9
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 24 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_4ed8ee6b154656d260f1ba0757620b24_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4ed8ee6b154656d260f1ba0757620b24_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{390D1304-DFD9-4e47-97D0-14193671700E}.exeC:\Windows\{390D1304-DFD9-4e47-97D0-14193671700E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EEF11973-31F9-40f3-B065-8BFB422AD231}.exeC:\Windows\{EEF11973-31F9-40f3-B065-8BFB422AD231}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19FA752B-BE71-48ff-B643-539CBF965F9E}.exeC:\Windows\{19FA752B-BE71-48ff-B643-539CBF965F9E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18554CFB-EE6D-4ba2-A351-03D725B4BDE5}.exeC:\Windows\{18554CFB-EE6D-4ba2-A351-03D725B4BDE5}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FBE6B66A-DF73-4310-9180-1575D46EBA92}.exeC:\Windows\{FBE6B66A-DF73-4310-9180-1575D46EBA92}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCBC1190-290B-4479-A7B5-3048E2547996}.exeC:\Windows\{CCBC1190-290B-4479-A7B5-3048E2547996}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB89A511-1B6B-46da-8A31-6A76E8C28842}.exeC:\Windows\{AB89A511-1B6B-46da-8A31-6A76E8C28842}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ACC587FD-DEA9-4ded-BBEA-A561D7C8C1C7}.exeC:\Windows\{ACC587FD-DEA9-4ded-BBEA-A561D7C8C1C7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD946C1C-43A1-4c8c-A21E-5B4549BA2042}.exeC:\Windows\{AD946C1C-43A1-4c8c-A21E-5B4549BA2042}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DD41683-4B52-408d-8B67-A97454552761}.exeC:\Windows\{1DD41683-4B52-408d-8B67-A97454552761}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89C98620-09FE-4e3c-805A-FEA8B3B92369}.exeC:\Windows\{89C98620-09FE-4e3c-805A-FEA8B3B92369}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DD41~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD946~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ACC58~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB89A~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCBC1~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBE6B~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18554~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19FA7~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EEF11~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{390D1~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{18554CFB-EE6D-4ba2-A351-03D725B4BDE5}.exe
{19FA752B-BE71-48ff-B643-539CBF965F9E}.exe
{1DD41683-4B52-408d-8B67-A97454552761}.exe
{390D1304-DFD9-4e47-97D0-14193671700E}.exe
{89C98620-09FE-4e3c-805A-FEA8B3B92369}.exe
{AB89A511-1B6B-46da-8A31-6A76E8C28842}.exe
{ACC587FD-DEA9-4ded-BBEA-A561D7C8C1C7}.exe
{AD946C1C-43A1-4c8c-A21E-5B4549BA2042}.exe
{CCBC1190-290B-4479-A7B5-3048E2547996}.exe
{EEF11973-31F9-40f3-B065-8BFB422AD231}.exe
{FBE6B66A-DF73-4310-9180-1575D46EBA92}.exe
memory/1388-52-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1640-10-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2356-27-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3188-58-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3528-16-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3528-12-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3564-64-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3836-34-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4040-0-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4040-5-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4388-46-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4756-39-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4916-21-0x0000000000400000-0x0000000000416000-memory.dmp