Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 12:45
General
- Target 2026-08-20_523e6f2b69da2959b4dd503785b224af_elex_wannacry.exe
- Size 368KB
- Sample260820-py9sdacm81
- SHA256 aed71fa2306f3064b2164f2aea8125586568479cffea554a975e0d406ebb325d
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_523e6f2b69da2959b4dd503785b224af_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_523e6f2b69da2959b4dd503785b224af_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC90797D-0764-46f6-B7E5-19150086BF45}.exeC:\Windows\{AC90797D-0764-46f6-B7E5-19150086BF45}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E0B3756-D006-4d87-B2E2-E9877F23050F}.exeC:\Windows\{9E0B3756-D006-4d87-B2E2-E9877F23050F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9599AF33-B825-4865-8DF2-CAFA0B01C314}.exeC:\Windows\{9599AF33-B825-4865-8DF2-CAFA0B01C314}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{335B93AA-BF33-41c2-B102-84A8C778875A}.exeC:\Windows\{335B93AA-BF33-41c2-B102-84A8C778875A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E0A1A21D-5EB0-4f57-989F-402B4BA3FE55}.exeC:\Windows\{E0A1A21D-5EB0-4f57-989F-402B4BA3FE55}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E34F735-6A98-4c8b-BDB2-FF1D4EF6F5E4}.exeC:\Windows\{5E34F735-6A98-4c8b-BDB2-FF1D4EF6F5E4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1987F86E-22B2-48a9-BB8C-C20ACCAA1A2E}.exeC:\Windows\{1987F86E-22B2-48a9-BB8C-C20ACCAA1A2E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9EE2EF7C-BEBC-4b35-AEA4-AA32F764B421}.exeC:\Windows\{9EE2EF7C-BEBC-4b35-AEA4-AA32F764B421}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{825A7D08-8A48-4183-8EBE-5F26171FEDF7}.exeC:\Windows\{825A7D08-8A48-4183-8EBE-5F26171FEDF7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87BA3CF7-4BC3-4509-8AC6-43B2E77CC706}.exeC:\Windows\{87BA3CF7-4BC3-4509-8AC6-43B2E77CC706}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B602EF84-BFC9-4406-9FCA-A73B4D85E810}.exeC:\Windows\{B602EF84-BFC9-4406-9FCA-A73B4D85E810}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87BA3~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{825A7~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EE2E~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1987F~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E34F~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0A1A~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{335B9~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9599A~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E0B3~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC907~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1987F86E-22B2-48a9-BB8C-C20ACCAA1A2E}.exe
{335B93AA-BF33-41c2-B102-84A8C778875A}.exe
{5E34F735-6A98-4c8b-BDB2-FF1D4EF6F5E4}.exe
{825A7D08-8A48-4183-8EBE-5F26171FEDF7}.exe
{87BA3CF7-4BC3-4509-8AC6-43B2E77CC706}.exe
{9599AF33-B825-4865-8DF2-CAFA0B01C314}.exe
{9E0B3756-D006-4d87-B2E2-E9877F23050F}.exe
{9EE2EF7C-BEBC-4b35-AEA4-AA32F764B421}.exe
{AC90797D-0764-46f6-B7E5-19150086BF45}.exe
{B602EF84-BFC9-4406-9FCA-A73B4D85E810}.exe
{E0A1A21D-5EB0-4f57-989F-402B4BA3FE55}.exe