Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 21:33
General
- Target 2026-06-28_77788729a1a98068a4f9324d4d651ff5_elex_wannacry.exe
- Size 59KB
- Sample260628-1ecjbaew9s
- SHA256 09a385a6e4beb9d0ad9ca42aa832ca5dbfb2703d590b44bf6a361bb7a06fc615
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_77788729a1a98068a4f9324d4d651ff5_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_77788729a1a98068a4f9324d4d651ff5_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F495747A-7618-47a6-AA28-F86DEE8227A6}.exeC:\Windows\{F495747A-7618-47a6-AA28-F86DEE8227A6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFFCA144-B93F-46d5-8DA0-CC7559F14293}.exeC:\Windows\{BFFCA144-B93F-46d5-8DA0-CC7559F14293}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28A3B636-4268-4871-978A-B4E4824108CB}.exeC:\Windows\{28A3B636-4268-4871-978A-B4E4824108CB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CACEE560-B225-4778-A2E7-B983CE22966A}.exeC:\Windows\{CACEE560-B225-4778-A2E7-B983CE22966A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2EC510E9-795F-4516-9F84-9B64ACA6CFB7}.exeC:\Windows\{2EC510E9-795F-4516-9F84-9B64ACA6CFB7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7060362-A2F7-44ed-B824-731323FBE2F3}.exeC:\Windows\{E7060362-A2F7-44ed-B824-731323FBE2F3}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C90351DC-B6FE-4e0b-B9D2-5940F7B35B8B}.exeC:\Windows\{C90351DC-B6FE-4e0b-B9D2-5940F7B35B8B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44A248CC-C377-40f4-A4A2-A82D3E05DC4B}.exeC:\Windows\{44A248CC-C377-40f4-A4A2-A82D3E05DC4B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28FD496B-6ADA-4e2f-95C9-4F6A86BD4378}.exeC:\Windows\{28FD496B-6ADA-4e2f-95C9-4F6A86BD4378}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FBD97D88-732B-496b-BC5D-221C5CD600A2}.exeC:\Windows\{FBD97D88-732B-496b-BC5D-221C5CD600A2}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{382D4E8B-2F4A-4a2c-B474-A1000464FD2D}.exeC:\Windows\{382D4E8B-2F4A-4a2c-B474-A1000464FD2D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBD97~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28FD4~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44A24~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9035~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7060~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2EC51~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CACEE~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28A3B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFFCA~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4957~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{28A3B636-4268-4871-978A-B4E4824108CB}.exe
{28FD496B-6ADA-4e2f-95C9-4F6A86BD4378}.exe
{2EC510E9-795F-4516-9F84-9B64ACA6CFB7}.exe
{382D4E8B-2F4A-4a2c-B474-A1000464FD2D}.exe
{44A248CC-C377-40f4-A4A2-A82D3E05DC4B}.exe
{BFFCA144-B93F-46d5-8DA0-CC7559F14293}.exe
{C90351DC-B6FE-4e0b-B9D2-5940F7B35B8B}.exe
{CACEE560-B225-4778-A2E7-B983CE22966A}.exe
{E7060362-A2F7-44ed-B824-731323FBE2F3}.exe
{F495747A-7618-47a6-AA28-F86DEE8227A6}.exe
{FBD97D88-732B-496b-BC5D-221C5CD600A2}.exe