Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 03:24
General
- Target 2026-08-22_dbc92388ca42d5df4e49474a221012a5_elex_wannacry.exe
- Size 59KB
- Sample260822-dye28aea95
- SHA256 54233f56cec6b6b6eacead3d0325d6bd37e3f0679563b9f0ba1872468c4046d3
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_dbc92388ca42d5df4e49474a221012a5_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_dbc92388ca42d5df4e49474a221012a5_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0D3A42F1-E2F4-4ca1-83D1-4FC45A3F8C09}.exeC:\Windows\{0D3A42F1-E2F4-4ca1-83D1-4FC45A3F8C09}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C1DF2E9C-0588-4afd-8532-7D4F1F0D6C6E}.exeC:\Windows\{C1DF2E9C-0588-4afd-8532-7D4F1F0D6C6E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{40EB1E86-E801-409d-9197-101E29DF4631}.exeC:\Windows\{40EB1E86-E801-409d-9197-101E29DF4631}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A946FD7-4491-470d-93A7-594009240E2C}.exeC:\Windows\{7A946FD7-4491-470d-93A7-594009240E2C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{755F0CD0-8AA9-4f9b-A3A1-E60E8D774DC8}.exeC:\Windows\{755F0CD0-8AA9-4f9b-A3A1-E60E8D774DC8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E0DFEC9A-61A3-4c3c-88E6-46849CF716D6}.exeC:\Windows\{E0DFEC9A-61A3-4c3c-88E6-46849CF716D6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E800C2E4-4223-47ca-A333-6CF7FFA0FEC5}.exeC:\Windows\{E800C2E4-4223-47ca-A333-6CF7FFA0FEC5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A100D889-A84A-4616-BDE2-F15CA0DC2787}.exeC:\Windows\{A100D889-A84A-4616-BDE2-F15CA0DC2787}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13334A93-0861-4cb6-94B7-B52917D50110}.exeC:\Windows\{13334A93-0861-4cb6-94B7-B52917D50110}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5711E3C2-8B82-48a9-B1E2-7B14DE4FFD96}.exeC:\Windows\{5711E3C2-8B82-48a9-B1E2-7B14DE4FFD96}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80D5C1C7-332D-4025-A0C2-6005FB6538C0}.exeC:\Windows\{80D5C1C7-332D-4025-A0C2-6005FB6538C0}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5711E~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13334~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A100D~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E800C~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0DFE~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{755F0~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A946~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40EB1~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1DF2~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D3A4~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0D3A42F1-E2F4-4ca1-83D1-4FC45A3F8C09}.exe
{13334A93-0861-4cb6-94B7-B52917D50110}.exe
{40EB1E86-E801-409d-9197-101E29DF4631}.exe
{5711E3C2-8B82-48a9-B1E2-7B14DE4FFD96}.exe
{755F0CD0-8AA9-4f9b-A3A1-E60E8D774DC8}.exe
{7A946FD7-4491-470d-93A7-594009240E2C}.exe
{80D5C1C7-332D-4025-A0C2-6005FB6538C0}.exe
{A100D889-A84A-4616-BDE2-F15CA0DC2787}.exe
{C1DF2E9C-0588-4afd-8532-7D4F1F0D6C6E}.exe
{E0DFEC9A-61A3-4c3c-88E6-46849CF716D6}.exe
{E800C2E4-4223-47ca-A333-6CF7FFA0FEC5}.exe