Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
16/08/2026, 17:29
General
- Target 2026-08-16_89b606b07855ff4e9272a3acc8d7124a_elex_wannacry.exe
- Size 60KB
- Sample260816-v225lashrd
- SHA256 64018a3c9d0d0ad64d5aace59338dd0481d8685915dbf5749c1c42af0dde126a
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_89b606b07855ff4e9272a3acc8d7124a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_89b606b07855ff4e9272a3acc8d7124a_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A351A788-1791-4910-A075-62C8A3018613}.exeC:\Windows\{A351A788-1791-4910-A075-62C8A3018613}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3249CC53-5C96-49e1-A235-C287C4C0CA17}.exeC:\Windows\{3249CC53-5C96-49e1-A235-C287C4C0CA17}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CE84908-5DA1-4913-8E8B-C07B192F4325}.exeC:\Windows\{9CE84908-5DA1-4913-8E8B-C07B192F4325}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28DE6FF9-D6F7-4681-A950-B4737AA42B90}.exeC:\Windows\{28DE6FF9-D6F7-4681-A950-B4737AA42B90}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{120ADA96-C3D6-49f4-8B58-B3DC8A126A1C}.exeC:\Windows\{120ADA96-C3D6-49f4-8B58-B3DC8A126A1C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DAC4435B-AA88-4522-B64A-35A753EE3323}.exeC:\Windows\{DAC4435B-AA88-4522-B64A-35A753EE3323}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5F06FB8F-754D-4e0c-A55A-8120191A920B}.exeC:\Windows\{5F06FB8F-754D-4e0c-A55A-8120191A920B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E71CD49-52C4-4928-B205-52D55AFF8042}.exeC:\Windows\{4E71CD49-52C4-4928-B205-52D55AFF8042}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{416588F3-8E29-42e2-83B6-74CC5464C158}.exeC:\Windows\{416588F3-8E29-42e2-83B6-74CC5464C158}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9180F172-3BDB-42b5-8EC9-1E700FA00A68}.exeC:\Windows\{9180F172-3BDB-42b5-8EC9-1E700FA00A68}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{807AEE5B-FE30-4532-BF34-AC6F6F1FE5D6}.exeC:\Windows\{807AEE5B-FE30-4532-BF34-AC6F6F1FE5D6}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9180F~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41658~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E71C~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5F06F~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAC44~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{120AD~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28DE6~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CE84~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3249C~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A351A~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{120ADA96-C3D6-49f4-8B58-B3DC8A126A1C}.exe
{28DE6FF9-D6F7-4681-A950-B4737AA42B90}.exe
{3249CC53-5C96-49e1-A235-C287C4C0CA17}.exe
{416588F3-8E29-42e2-83B6-74CC5464C158}.exe
{4E71CD49-52C4-4928-B205-52D55AFF8042}.exe
{5F06FB8F-754D-4e0c-A55A-8120191A920B}.exe
{807AEE5B-FE30-4532-BF34-AC6F6F1FE5D6}.exe
{9180F172-3BDB-42b5-8EC9-1E700FA00A68}.exe
{9CE84908-5DA1-4913-8E8B-C07B192F4325}.exe
{A351A788-1791-4910-A075-62C8A3018613}.exe
{DAC4435B-AA88-4522-B64A-35A753EE3323}.exe
memory/1308-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1388-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1388-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1728-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1728-75-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2912-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2912-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3376-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3376-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3380-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3380-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3380-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3472-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3472-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3584-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3584-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4188-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4188-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4572-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4572-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4988-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4988-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5404-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5404-42-0x0000000000400000-0x0000000000410000-memory.dmp