Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/08/2026, 02:51
General
- Target 2026-08-22_ab065adf37262a93e5348dc494d918a3_elex_wannacry.exe
- Size 68KB
- Sample260823-dcbsnssbpe
- SHA256 1aaf0ae3de2733db68956287263797c12686dd2b90ea68dfd84977ba546690a6
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_ab065adf37262a93e5348dc494d918a3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_ab065adf37262a93e5348dc494d918a3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08284E2A-0078-4150-9E9C-6F75C5D6BBDD}.exeC:\Windows\{08284E2A-0078-4150-9E9C-6F75C5D6BBDD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E3ADFFA-2914-4d3c-8B5D-9E3B17A2AD8C}.exeC:\Windows\{3E3ADFFA-2914-4d3c-8B5D-9E3B17A2AD8C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92C9286A-5702-453e-8F70-A25F54346B06}.exeC:\Windows\{92C9286A-5702-453e-8F70-A25F54346B06}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B02ED4A9-1A13-4de0-8C10-F06F2271C147}.exeC:\Windows\{B02ED4A9-1A13-4de0-8C10-F06F2271C147}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA52A74C-27AA-4564-8017-65ACC8C42CC5}.exeC:\Windows\{FA52A74C-27AA-4564-8017-65ACC8C42CC5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60ABCCDF-7CEE-4332-A58B-CA79D8DD07AA}.exeC:\Windows\{60ABCCDF-7CEE-4332-A58B-CA79D8DD07AA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16BA5410-F05A-4d49-9E92-75F02A0738F1}.exeC:\Windows\{16BA5410-F05A-4d49-9E92-75F02A0738F1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD37133D-074E-4495-BF24-696D0A7D398B}.exeC:\Windows\{CD37133D-074E-4495-BF24-696D0A7D398B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCA02E90-91C3-476b-A863-6D64F11ECC2C}.exeC:\Windows\{CCA02E90-91C3-476b-A863-6D64F11ECC2C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35F329BD-27F1-42eb-B465-55C0E5BDBA3E}.exeC:\Windows\{35F329BD-27F1-42eb-B465-55C0E5BDBA3E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE7772E5-5BB8-4710-B44A-D211BA650308}.exeC:\Windows\{BE7772E5-5BB8-4710-B44A-D211BA650308}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35F32~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCA02~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD371~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16BA5~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60ABC~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA52A~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B02ED~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92C92~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E3AD~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08284~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{08284E2A-0078-4150-9E9C-6F75C5D6BBDD}.exe
{16BA5410-F05A-4d49-9E92-75F02A0738F1}.exe
{35F329BD-27F1-42eb-B465-55C0E5BDBA3E}.exe
{3E3ADFFA-2914-4d3c-8B5D-9E3B17A2AD8C}.exe
{60ABCCDF-7CEE-4332-A58B-CA79D8DD07AA}.exe
{92C9286A-5702-453e-8F70-A25F54346B06}.exe
{B02ED4A9-1A13-4de0-8C10-F06F2271C147}.exe
{BE7772E5-5BB8-4710-B44A-D211BA650308}.exe
{CCA02E90-91C3-476b-A863-6D64F11ECC2C}.exe
{CD37133D-074E-4495-BF24-696D0A7D398B}.exe
{FA52A74C-27AA-4564-8017-65ACC8C42CC5}.exe
memory/1368-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1368-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1508-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2092-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2092-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2092-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2428-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2428-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2772-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2772-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2864-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2864-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2904-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2904-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3048-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3048-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3664-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3664-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3892-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3892-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5908-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5908-51-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5908-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6588-62-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6588-57-0x0000000000400000-0x0000000000411000-memory.dmp