Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
19/08/2026, 14:02
General
- Target 2026-08-19_09a8acc61dd3e7346c8ebaf41c44ed94_elex_wannacry.exe
- Size 84KB
- Sample260819-rca32ack6z
- SHA256 589657b4068f321cd3adde6ac8f6693c5e9a2acf3bf3cc00fd1d3d42e0ee20f1
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 25 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_09a8acc61dd3e7346c8ebaf41c44ed94_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_09a8acc61dd3e7346c8ebaf41c44ed94_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04906D18-0159-4fdb-A6F3-6185BC33B828}.exeC:\Windows\{04906D18-0159-4fdb-A6F3-6185BC33B828}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB4E46AA-E065-44be-8320-AD28A0F42C97}.exeC:\Windows\{EB4E46AA-E065-44be-8320-AD28A0F42C97}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B4A84CFB-0FC2-414b-A025-1B8079C2D088}.exeC:\Windows\{B4A84CFB-0FC2-414b-A025-1B8079C2D088}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD02B81F-7FB6-4d0a-B594-36E5B03C96D0}.exeC:\Windows\{DD02B81F-7FB6-4d0a-B594-36E5B03C96D0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3918541-5A55-4ec1-9C63-0C349FBE8E50}.exeC:\Windows\{B3918541-5A55-4ec1-9C63-0C349FBE8E50}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8AA380E4-70E1-46f3-B887-CB0BBE971420}.exeC:\Windows\{8AA380E4-70E1-46f3-B887-CB0BBE971420}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2A2B9439-FBD8-4c64-B3A9-D8E26917D205}.exeC:\Windows\{2A2B9439-FBD8-4c64-B3A9-D8E26917D205}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B0F052B9-0DE9-4aee-9A3B-3C37190B2CAF}.exeC:\Windows\{B0F052B9-0DE9-4aee-9A3B-3C37190B2CAF}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F3C8A445-1F78-44a0-9CA9-DF1A68B7653C}.exeC:\Windows\{F3C8A445-1F78-44a0-9CA9-DF1A68B7653C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9EF31ACD-2F4F-42b3-92D4-3721161B61C6}.exeC:\Windows\{9EF31ACD-2F4F-42b3-92D4-3721161B61C6}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8EB55856-8C75-4550-9C7D-F589349135C6}.exeC:\Windows\{8EB55856-8C75-4550-9C7D-F589349135C6}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EF31~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3C8A~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0F05~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A2B9~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AA38~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3918~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD02B~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4A84~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB4E4~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04906~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{04906D18-0159-4fdb-A6F3-6185BC33B828}.exe
{2A2B9439-FBD8-4c64-B3A9-D8E26917D205}.exe
{8AA380E4-70E1-46f3-B887-CB0BBE971420}.exe
{8EB55856-8C75-4550-9C7D-F589349135C6}.exe
{9EF31ACD-2F4F-42b3-92D4-3721161B61C6}.exe
{B0F052B9-0DE9-4aee-9A3B-3C37190B2CAF}.exe
{B3918541-5A55-4ec1-9C63-0C349FBE8E50}.exe
{B4A84CFB-0FC2-414b-A025-1B8079C2D088}.exe
{DD02B81F-7FB6-4d0a-B594-36E5B03C96D0}.exe
{EB4E46AA-E065-44be-8320-AD28A0F42C97}.exe
{F3C8A445-1F78-44a0-9CA9-DF1A68B7653C}.exe
memory/1316-46-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1316-42-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1944-60-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2276-18-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2332-25-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3132-32-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4176-11-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4452-63-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4452-68-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4496-40-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4556-0-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4556-5-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4732-54-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5232-75-0x0000000000400000-0x0000000000416000-memory.dmp