Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/08/2026, 09:37
General
- Target 2026-08-20_bebce2fc245a00b18415d20ed2a82b56_elex_wannacry.exe
- Size 96KB
- Sample260820-llws7stfjd
- SHA256 eab7331b1e1e9634b016d4a9210831bee8958c98189c7433c314768027c75a6f
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_bebce2fc245a00b18415d20ed2a82b56_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_bebce2fc245a00b18415d20ed2a82b56_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5CBB265D-58DC-4d4d-B74E-D4822FBB55C0}.exeC:\Windows\{5CBB265D-58DC-4d4d-B74E-D4822FBB55C0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E9D2364B-69BD-48c3-A63C-EE93AAF828C7}.exeC:\Windows\{E9D2364B-69BD-48c3-A63C-EE93AAF828C7}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FBEBBA08-E1E6-4fdb-B6E3-45273935DBD8}.exeC:\Windows\{FBEBBA08-E1E6-4fdb-B6E3-45273935DBD8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3323F707-F297-4a5b-8475-21CB613B4FB3}.exeC:\Windows\{3323F707-F297-4a5b-8475-21CB613B4FB3}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3F63DAA4-9480-46a1-8363-633B002B2F8A}.exeC:\Windows\{3F63DAA4-9480-46a1-8363-633B002B2F8A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D60AE4E9-C60D-45d9-8C47-62C978122F1C}.exeC:\Windows\{D60AE4E9-C60D-45d9-8C47-62C978122F1C}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{486ED42B-7C3A-4bf8-9B58-97416AE4CAA2}.exeC:\Windows\{486ED42B-7C3A-4bf8-9B58-97416AE4CAA2}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{713DCDED-6807-41cc-8781-C85F63ED1722}.exeC:\Windows\{713DCDED-6807-41cc-8781-C85F63ED1722}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6D8B9DA1-2ABA-4cab-9143-DE0318490A22}.exeC:\Windows\{6D8B9DA1-2ABA-4cab-9143-DE0318490A22}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24C55C1C-D979-49cd-B899-9AED56155161}.exeC:\Windows\{24C55C1C-D979-49cd-B899-9AED56155161}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA408F2B-53CB-47c7-8208-2B33B8419E7F}.exeC:\Windows\{FA408F2B-53CB-47c7-8208-2B33B8419E7F}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24C55~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D8B9~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{713DC~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{486ED~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D60AE~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3F63D~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3323F~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBEBB~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9D23~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CBB2~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{24C55C1C-D979-49cd-B899-9AED56155161}.exe
{3323F707-F297-4a5b-8475-21CB613B4FB3}.exe
{3F63DAA4-9480-46a1-8363-633B002B2F8A}.exe
{486ED42B-7C3A-4bf8-9B58-97416AE4CAA2}.exe
{5CBB265D-58DC-4d4d-B74E-D4822FBB55C0}.exe
{6D8B9DA1-2ABA-4cab-9143-DE0318490A22}.exe
{713DCDED-6807-41cc-8781-C85F63ED1722}.exe
{D60AE4E9-C60D-45d9-8C47-62C978122F1C}.exe
{E9D2364B-69BD-48c3-A63C-EE93AAF828C7}.exe
{FA408F2B-53CB-47c7-8208-2B33B8419E7F}.exe
{FBEBBA08-E1E6-4fdb-B6E3-45273935DBD8}.exe