Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
28/08/2026, 05:55
General
- Target 2026-08-28_f725991845b7f3239d79c19c3837b8e0_elex_wannacry.exe
- Size 68KB
- Sample260828-gmjg2stdkd
- SHA256 afa557583ca7897556e685e116511bdb434d1a4cef752da8c0ef509c8df46571
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 31 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_f725991845b7f3239d79c19c3837b8e0_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_f725991845b7f3239d79c19c3837b8e0_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D32245F-F772-4d9e-A03B-8342A56A5E4A}.exeC:\Windows\{2D32245F-F772-4d9e-A03B-8342A56A5E4A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE35DFA9-5BB0-46a2-9BE5-E24D62F0AB3A}.exeC:\Windows\{AE35DFA9-5BB0-46a2-9BE5-E24D62F0AB3A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ABDA9F83-986D-4090-9E1C-65DCD410E575}.exeC:\Windows\{ABDA9F83-986D-4090-9E1C-65DCD410E575}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A6446CFB-773D-4cb4-8E3E-56DF7C458813}.exeC:\Windows\{A6446CFB-773D-4cb4-8E3E-56DF7C458813}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{66446867-98BE-448d-9BF0-E00DFBA0B8A6}.exeC:\Windows\{66446867-98BE-448d-9BF0-E00DFBA0B8A6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9892FE25-6808-410c-8D97-9A50F1E4B8BF}.exeC:\Windows\{9892FE25-6808-410c-8D97-9A50F1E4B8BF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2A3BA27A-8F3C-4a51-8D5E-C81605206089}.exeC:\Windows\{2A3BA27A-8F3C-4a51-8D5E-C81605206089}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ECB7805C-F12A-4e03-8E71-CBB57F8AE9DC}.exeC:\Windows\{ECB7805C-F12A-4e03-8E71-CBB57F8AE9DC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C946D3DF-D5E0-4d8a-B70B-F64F85FAD0EF}.exeC:\Windows\{C946D3DF-D5E0-4d8a-B70B-F64F85FAD0EF}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2ED4C0C6-A31E-424a-AD8A-11BD5BC0C2DC}.exeC:\Windows\{2ED4C0C6-A31E-424a-AD8A-11BD5BC0C2DC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{872BAFE3-8691-4abf-A8F6-87EC745F798D}.exeC:\Windows\{872BAFE3-8691-4abf-A8F6-87EC745F798D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2ED4C~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C946D~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECB78~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A3BA~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9892F~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{66446~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6446~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ABDA9~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE35D~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D322~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2A3BA27A-8F3C-4a51-8D5E-C81605206089}.exe
{2D32245F-F772-4d9e-A03B-8342A56A5E4A}.exe
{2ED4C0C6-A31E-424a-AD8A-11BD5BC0C2DC}.exe
{66446867-98BE-448d-9BF0-E00DFBA0B8A6}.exe
{872BAFE3-8691-4abf-A8F6-87EC745F798D}.exe
{9892FE25-6808-410c-8D97-9A50F1E4B8BF}.exe
{A6446CFB-773D-4cb4-8E3E-56DF7C458813}.exe
{ABDA9F83-986D-4090-9E1C-65DCD410E575}.exe
{AE35DFA9-5BB0-46a2-9BE5-E24D62F0AB3A}.exe
{C946D3DF-D5E0-4d8a-B70B-F64F85FAD0EF}.exe
{ECB7805C-F12A-4e03-8E71-CBB57F8AE9DC}.exe
memory/520-11-0x0000000000400000-0x0000000000411000-memory.dmp
memory/520-16-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1184-44-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1184-39-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1260-17-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1260-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1304-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1304-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1304-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2092-62-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2092-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3844-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5480-10-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5588-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5588-33-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5812-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5812-46-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5996-51-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5996-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6048-38-0x0000000000400000-0x0000000000411000-memory.dmp