Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 12:54
General
- Target 2026-08-24_58ab68299a4cf46c8faccbfd31eb1035_elex_wannacry.exe
- Size 60KB
- Sample260825-p5hbpssele
- SHA256 a2fa32e1ad6fbc5d80bfa0276d17a5ac4e4c12559c8ce463faeec4aaa6c50482
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_58ab68299a4cf46c8faccbfd31eb1035_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_58ab68299a4cf46c8faccbfd31eb1035_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{09DC39ED-FE2E-45cb-AA28-AB91D8A4CE6E}.exeC:\Windows\{09DC39ED-FE2E-45cb-AA28-AB91D8A4CE6E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{884BFBE4-13C9-438b-9939-41B6421EA649}.exeC:\Windows\{884BFBE4-13C9-438b-9939-41B6421EA649}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E120A2F-146A-4c47-AE21-E16994C6B3B5}.exeC:\Windows\{5E120A2F-146A-4c47-AE21-E16994C6B3B5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C41BD8E-748A-4070-8186-A644E043F37B}.exeC:\Windows\{5C41BD8E-748A-4070-8186-A644E043F37B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{678D3672-64CF-487a-A78E-A05CC5D3E775}.exeC:\Windows\{678D3672-64CF-487a-A78E-A05CC5D3E775}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3060AC4D-59EC-46d2-ABBE-C56D90A70449}.exeC:\Windows\{3060AC4D-59EC-46d2-ABBE-C56D90A70449}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B996125-5D86-46a1-9D49-FB738C5BEFD3}.exeC:\Windows\{3B996125-5D86-46a1-9D49-FB738C5BEFD3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B5240BF-F5FB-4360-A539-32A65C254079}.exeC:\Windows\{0B5240BF-F5FB-4360-A539-32A65C254079}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD47E252-325C-4f4f-984E-86BBC016EC7A}.exeC:\Windows\{AD47E252-325C-4f4f-984E-86BBC016EC7A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E24196B0-7F00-4cef-A384-BFE7CAB18E24}.exeC:\Windows\{E24196B0-7F00-4cef-A384-BFE7CAB18E24}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F05C8F1-FC06-4c98-AB1C-42B95ADE0BE8}.exeC:\Windows\{7F05C8F1-FC06-4c98-AB1C-42B95ADE0BE8}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2419~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD47E~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B524~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B996~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3060A~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{678D3~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C41B~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E120~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{884BF~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09DC3~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{09DC39ED-FE2E-45cb-AA28-AB91D8A4CE6E}.exe
{0B5240BF-F5FB-4360-A539-32A65C254079}.exe
{3060AC4D-59EC-46d2-ABBE-C56D90A70449}.exe
{3B996125-5D86-46a1-9D49-FB738C5BEFD3}.exe
{5C41BD8E-748A-4070-8186-A644E043F37B}.exe
{5E120A2F-146A-4c47-AE21-E16994C6B3B5}.exe
{678D3672-64CF-487a-A78E-A05CC5D3E775}.exe
{7F05C8F1-FC06-4c98-AB1C-42B95ADE0BE8}.exe
{884BFBE4-13C9-438b-9939-41B6421EA649}.exe
{AD47E252-325C-4f4f-984E-86BBC016EC7A}.exe
{E24196B0-7F00-4cef-A384-BFE7CAB18E24}.exe
memory/1200-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1200-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3164-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3164-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3404-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3404-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3492-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3492-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3696-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3884-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3884-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3884-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4228-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4228-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4232-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4232-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4912-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4912-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4912-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4968-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4968-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5936-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5936-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6124-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6124-78-0x0000000000400000-0x0000000000410000-memory.dmp