Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/08/2026, 09:10
General
- Target 2026-08-17_91b3ba7d0f4bffa9655feb98e64b3e32_elex_wannacry.exe
- Size 84KB
- Sample260817-k45cmaxaqe
- SHA256 edc72ec787a2110ddf1e87835c377ee83dbb293725b6855ed3b301e26369c5d0
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 24 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_91b3ba7d0f4bffa9655feb98e64b3e32_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_91b3ba7d0f4bffa9655feb98e64b3e32_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FFB591A-9811-4a07-B40D-15E0C7ABC778}.exeC:\Windows\{0FFB591A-9811-4a07-B40D-15E0C7ABC778}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8D3027B-7000-4f3b-A188-38589FCCDDA0}.exeC:\Windows\{B8D3027B-7000-4f3b-A188-38589FCCDDA0}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D10BFFEB-A552-45c4-BFC0-019C12E8BC02}.exeC:\Windows\{D10BFFEB-A552-45c4-BFC0-019C12E8BC02}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5253C8D-5AF6-4cea-B745-A3380B13D121}.exeC:\Windows\{D5253C8D-5AF6-4cea-B745-A3380B13D121}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4D56492F-A532-4c89-A4F4-6587323168A3}.exeC:\Windows\{4D56492F-A532-4c89-A4F4-6587323168A3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D8A44345-DCDA-4519-93DB-6FFD9CAACAC7}.exeC:\Windows\{D8A44345-DCDA-4519-93DB-6FFD9CAACAC7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E750823-AB19-4120-AED0-8535B9D0E70F}.exeC:\Windows\{4E750823-AB19-4120-AED0-8535B9D0E70F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5CA326E1-17ED-451d-9B11-943BFC46D44B}.exeC:\Windows\{5CA326E1-17ED-451d-9B11-943BFC46D44B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{54D3E820-7DFB-4830-BCA3-AD0191CD4444}.exeC:\Windows\{54D3E820-7DFB-4830-BCA3-AD0191CD4444}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{954D49E1-9DEB-461d-9882-55DB97321C5E}.exeC:\Windows\{954D49E1-9DEB-461d-9882-55DB97321C5E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A6D5E9B3-51BE-4683-9D71-F01B132A6933}.exeC:\Windows\{A6D5E9B3-51BE-4683-9D71-F01B132A6933}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{954D4~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{54D3E~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CA32~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E750~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8A44~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D564~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5253~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D10BF~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8D30~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FFB5~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0FFB591A-9811-4a07-B40D-15E0C7ABC778}.exe
{4D56492F-A532-4c89-A4F4-6587323168A3}.exe
{4E750823-AB19-4120-AED0-8535B9D0E70F}.exe
{54D3E820-7DFB-4830-BCA3-AD0191CD4444}.exe
{5CA326E1-17ED-451d-9B11-943BFC46D44B}.exe
{954D49E1-9DEB-461d-9882-55DB97321C5E}.exe
{A6D5E9B3-51BE-4683-9D71-F01B132A6933}.exe
{B8D3027B-7000-4f3b-A188-38589FCCDDA0}.exe
{D10BFFEB-A552-45c4-BFC0-019C12E8BC02}.exe
{D5253C8D-5AF6-4cea-B745-A3380B13D121}.exe
{D8A44345-DCDA-4519-93DB-6FFD9CAACAC7}.exe
memory/120-21-0x0000000000400000-0x0000000000416000-memory.dmp
memory/120-26-0x0000000000400000-0x0000000000416000-memory.dmp
memory/824-0-0x0000000000400000-0x0000000000416000-memory.dmp
memory/824-5-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1460-11-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2560-39-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3276-61-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3296-53-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3876-74-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4868-32-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4936-18-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5092-47-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5372-68-0x0000000000400000-0x0000000000416000-memory.dmp