Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/08/2026, 15:35
General
- Target 2026-08-20_4d9f76ff08cc521bc7bb0864b37ad26c_elex_wannacry.exe
- Size 72KB
- Sample260820-s1bvxattfv
- SHA256 38b467916f09101792d1848d790950a4308cd96882c95c4fb0773b80ec2240e4
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 45 IoCs
- UPX dump on OEP (original entry point) 45 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_4d9f76ff08cc521bc7bb0864b37ad26c_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_4d9f76ff08cc521bc7bb0864b37ad26c_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7386612B-F673-4756-AB3B-E6DA36243737}.exeC:\Windows\{7386612B-F673-4756-AB3B-E6DA36243737}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8EA8EE97-AB9A-41f1-90D9-DBE1B883A828}.exeC:\Windows\{8EA8EE97-AB9A-41f1-90D9-DBE1B883A828}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C6EE166-12B1-4297-AD0D-739E8BB88EA6}.exeC:\Windows\{8C6EE166-12B1-4297-AD0D-739E8BB88EA6}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7048CB48-4B8F-4885-BFCE-EEB8DD9BAD7F}.exeC:\Windows\{7048CB48-4B8F-4885-BFCE-EEB8DD9BAD7F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{461D7FE7-2C2A-4438-8F14-389FB4F24742}.exeC:\Windows\{461D7FE7-2C2A-4438-8F14-389FB4F24742}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B049243-C396-4d5e-A818-5AB0FDCE37B0}.exeC:\Windows\{2B049243-C396-4d5e-A818-5AB0FDCE37B0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{416CE86A-ADAB-4fe3-8D5E-37EF9B4E3DA8}.exeC:\Windows\{416CE86A-ADAB-4fe3-8D5E-37EF9B4E3DA8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4D44D9F6-B86A-45de-B5D5-996557D394BA}.exeC:\Windows\{4D44D9F6-B86A-45de-B5D5-996557D394BA}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8F9DAA4B-3056-4c46-A2F8-12019F8FA8D0}.exeC:\Windows\{8F9DAA4B-3056-4c46-A2F8-12019F8FA8D0}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4132433B-FE70-417c-B7F4-33AEC806680D}.exeC:\Windows\{4132433B-FE70-417c-B7F4-33AEC806680D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{284E963E-C161-4ac5-B76B-F6C6AEAC834F}.exeC:\Windows\{284E963E-C161-4ac5-B76B-F6C6AEAC834F}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41324~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8F9DA~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D44D~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{416CE~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B049~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{461D7~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7048C~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C6EE~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8EA8E~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73866~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{284E963E-C161-4ac5-B76B-F6C6AEAC834F}.exe
{2B049243-C396-4d5e-A818-5AB0FDCE37B0}.exe
{4132433B-FE70-417c-B7F4-33AEC806680D}.exe
{416CE86A-ADAB-4fe3-8D5E-37EF9B4E3DA8}.exe
{461D7FE7-2C2A-4438-8F14-389FB4F24742}.exe
{4D44D9F6-B86A-45de-B5D5-996557D394BA}.exe
{7048CB48-4B8F-4885-BFCE-EEB8DD9BAD7F}.exe
{7386612B-F673-4756-AB3B-E6DA36243737}.exe
{8C6EE166-12B1-4297-AD0D-739E8BB88EA6}.exe
{8EA8EE97-AB9A-41f1-90D9-DBE1B883A828}.exe
{8F9DAA4B-3056-4c46-A2F8-12019F8FA8D0}.exe
memory/408-33-0x0000000000400000-0x0000000000413000-memory.dmp
memory/408-38-0x0000000000400000-0x0000000000413000-memory.dmp
memory/408-31-0x0000000000400000-0x0000000000413000-memory.dmp
memory/568-61-0x0000000000400000-0x0000000000413000-memory.dmp
memory/568-57-0x0000000000400000-0x0000000000413000-memory.dmp
memory/568-55-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1268-41-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1268-39-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1268-46-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1812-79-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1812-81-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1812-85-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2124-70-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2124-73-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2124-77-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2500-7-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2500-1-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2500-0-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2756-49-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2756-53-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2756-47-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3524-87-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4572-17-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4572-21-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4572-15-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4988-71-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4988-65-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4988-63-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5948-29-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5948-25-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5948-23-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6092-6-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6092-9-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6092-13-0x0000000000400000-0x0000000000413000-memory.dmp