Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/08/2026, 12:44
General
- Target 2026-08-18_dfb19f0558604b090854a49d93d03761_elex_wannacry.exe
- Size 90KB
- Sample260818-pym9datwfv
- SHA256 7ecf12b60789bdc8ab524a87105804f8a4ee9b99f51251f7aa356201cebb414f
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 31 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- Executes a command shell one-liner 1 TTPs 10 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_dfb19f0558604b090854a49d93d03761_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_dfb19f0558604b090854a49d93d03761_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5E05B03-D554-4657-886A-2054BC280DB7}.exeC:\Windows\{D5E05B03-D554-4657-886A-2054BC280DB7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{711C6CE7-4760-4564-A2E6-44144BF2C7F8}.exeC:\Windows\{711C6CE7-4760-4564-A2E6-44144BF2C7F8}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C8D79FD-D34B-4ab0-9F71-C2178E824B8D}.exeC:\Windows\{7C8D79FD-D34B-4ab0-9F71-C2178E824B8D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D9802D3-40B0-4b99-9CA1-074816664E92}.exeC:\Windows\{1D9802D3-40B0-4b99-9CA1-074816664E92}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9FB6D51D-EE2F-4411-83F7-4A2B8C696716}.exeC:\Windows\{9FB6D51D-EE2F-4411-83F7-4A2B8C696716}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6869E72B-6C36-4639-A602-20DCD54E82B9}.exeC:\Windows\{6869E72B-6C36-4639-A602-20DCD54E82B9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{307AC592-647D-405c-B386-D6BF72694048}.exeC:\Windows\{307AC592-647D-405c-B386-D6BF72694048}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DBF32F30-B786-4d4e-B31B-2ADFED9E9DB8}.exeC:\Windows\{DBF32F30-B786-4d4e-B31B-2ADFED9E9DB8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC1F3FC0-59C2-4c2a-8CE7-B96081DC4816}.exeC:\Windows\{AC1F3FC0-59C2-4c2a-8CE7-B96081DC4816}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{068A122D-1DA0-43a0-A65E-0275A70A0479}.exeC:\Windows\{068A122D-1DA0-43a0-A65E-0275A70A0479}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC1F3~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBF32~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{307AC~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6869E~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FB6D~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D980~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C8D7~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{711C6~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5E05~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{068A122D-1DA0-43a0-A65E-0275A70A0479}.exe
{1D9802D3-40B0-4b99-9CA1-074816664E92}.exe
{307AC592-647D-405c-B386-D6BF72694048}.exe
{6869E72B-6C36-4639-A602-20DCD54E82B9}.exe
{711C6CE7-4760-4564-A2E6-44144BF2C7F8}.exe
{7C8D79FD-D34B-4ab0-9F71-C2178E824B8D}.exe
{9FB6D51D-EE2F-4411-83F7-4A2B8C696716}.exe
{AC1F3FC0-59C2-4c2a-8CE7-B96081DC4816}.exe
{D5E05B03-D554-4657-886A-2054BC280DB7}.exe
{DBF32F30-B786-4d4e-B31B-2ADFED9E9DB8}.exe
memory/804-18-0x0000000000400000-0x0000000000411000-memory.dmp
memory/804-23-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1248-24-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1248-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2160-46-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2160-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2824-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2824-52-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3080-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3080-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3080-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3160-10-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4220-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4220-30-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4500-58-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4500-53-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4504-59-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4684-40-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4724-16-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4724-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4724-11-0x0000000000400000-0x0000000000411000-memory.dmp