Analysis
- max time kernel
148s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 12:26
General
- Target 2026-08-16_f768840f88550d8d20404ef5aec4d8a8_elex_wannacry.exe
- Size 68KB
- Sample260816-pmccqsxerd
- SHA256 4228eeceac158f87cfcfd3ad3a122fbbff21b8cbdab6457370f2349546957fa1
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_f768840f88550d8d20404ef5aec4d8a8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f768840f88550d8d20404ef5aec4d8a8_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16956C10-25C4-4bba-9B96-5F0A54B76674}.exeC:\Windows\{16956C10-25C4-4bba-9B96-5F0A54B76674}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF98FC72-EF68-4914-A7F9-94F6A2EF2103}.exeC:\Windows\{AF98FC72-EF68-4914-A7F9-94F6A2EF2103}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5F417C6-64A6-4543-8701-EE6BEE12422F}.exeC:\Windows\{E5F417C6-64A6-4543-8701-EE6BEE12422F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E73CB7EF-1C46-40ba-9A48-17C00F23612B}.exeC:\Windows\{E73CB7EF-1C46-40ba-9A48-17C00F23612B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{385EE3EF-ED06-4a65-8936-00C3887DA4D8}.exeC:\Windows\{385EE3EF-ED06-4a65-8936-00C3887DA4D8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33039F42-454D-4397-9FA8-5F9D658451D5}.exeC:\Windows\{33039F42-454D-4397-9FA8-5F9D658451D5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FBDC71BA-EFA2-4bf3-9B1F-41335BC44F88}.exeC:\Windows\{FBDC71BA-EFA2-4bf3-9B1F-41335BC44F88}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02510D54-F17B-4611-9FAB-67FF6BB1FCFB}.exeC:\Windows\{02510D54-F17B-4611-9FAB-67FF6BB1FCFB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{216C54FB-2884-4cfb-8B0C-41B6C8E4C274}.exeC:\Windows\{216C54FB-2884-4cfb-8B0C-41B6C8E4C274}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4073F92D-A569-4729-B749-0A8D0080702F}.exeC:\Windows\{4073F92D-A569-4729-B749-0A8D0080702F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB96C960-9434-49de-BC60-E57D9D85A850}.exeC:\Windows\{BB96C960-9434-49de-BC60-E57D9D85A850}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4073F~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{216C5~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02510~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBDC7~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33039~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{385EE~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E73CB~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5F41~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF98F~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16956~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{02510D54-F17B-4611-9FAB-67FF6BB1FCFB}.exe
{16956C10-25C4-4bba-9B96-5F0A54B76674}.exe
{216C54FB-2884-4cfb-8B0C-41B6C8E4C274}.exe
{33039F42-454D-4397-9FA8-5F9D658451D5}.exe
{385EE3EF-ED06-4a65-8936-00C3887DA4D8}.exe
{4073F92D-A569-4729-B749-0A8D0080702F}.exe
{AF98FC72-EF68-4914-A7F9-94F6A2EF2103}.exe
{BB96C960-9434-49de-BC60-E57D9D85A850}.exe
{E5F417C6-64A6-4543-8701-EE6BEE12422F}.exe
{E73CB7EF-1C46-40ba-9A48-17C00F23612B}.exe
{FBDC71BA-EFA2-4bf3-9B1F-41335BC44F88}.exe
memory/420-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/420-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/568-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1948-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1948-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2696-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2696-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2696-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3712-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3712-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4988-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4988-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5044-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5044-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5116-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5116-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5588-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5588-43-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5684-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5684-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6000-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6000-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6084-23-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6084-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6084-28-0x0000000000400000-0x0000000000411000-memory.dmp