Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 02:30
General
- Target 2026-06-27_d54217bcbbe01788d122118b190b9fb8_elex_wannacry.exe
- Size 64KB
- Sample260629-czfjpscv2k
- SHA256 322bb2b065fa1b94c20e7e0df13216eedc1a34d44d8a332b18a698d9ec4ae18f
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_d54217bcbbe01788d122118b190b9fb8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_d54217bcbbe01788d122118b190b9fb8_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9103F221-0CF7-45fe-8929-B9081FD45095}.exeC:\Windows\{9103F221-0CF7-45fe-8929-B9081FD45095}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{82DAC418-D2AD-4a6c-B87F-792BBB9433F1}.exeC:\Windows\{82DAC418-D2AD-4a6c-B87F-792BBB9433F1}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A978B21-9779-4a75-959B-8A8ED4B66C2C}.exeC:\Windows\{6A978B21-9779-4a75-959B-8A8ED4B66C2C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{048ED8FD-EB9F-4489-A2C1-B03B5C646F6C}.exeC:\Windows\{048ED8FD-EB9F-4489-A2C1-B03B5C646F6C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB71F96E-A6F1-46c0-9398-9441127D4299}.exeC:\Windows\{CB71F96E-A6F1-46c0-9398-9441127D4299}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{637D2D20-5B77-4e31-BEC8-4C2F53643BF2}.exeC:\Windows\{637D2D20-5B77-4e31-BEC8-4C2F53643BF2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A640299F-7EDB-49e3-9DEF-0D18DE124F07}.exeC:\Windows\{A640299F-7EDB-49e3-9DEF-0D18DE124F07}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60878326-3CDC-47c8-8FDF-D8837768CF53}.exeC:\Windows\{60878326-3CDC-47c8-8FDF-D8837768CF53}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{487C0C7A-967B-4b03-BBB2-2FA0CB5D8693}.exeC:\Windows\{487C0C7A-967B-4b03-BBB2-2FA0CB5D8693}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3802CE9-6F6B-4354-B8CB-EC3AD4521DB5}.exeC:\Windows\{B3802CE9-6F6B-4354-B8CB-EC3AD4521DB5}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C7EBC41-3CB8-4ddb-A4C1-1D47B5E30EF1}.exeC:\Windows\{0C7EBC41-3CB8-4ddb-A4C1-1D47B5E30EF1}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3802~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{487C0~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60878~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6402~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{637D2~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB71F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{048ED~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A978~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82DAC~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9103F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{048ED8FD-EB9F-4489-A2C1-B03B5C646F6C}.exe
{0C7EBC41-3CB8-4ddb-A4C1-1D47B5E30EF1}.exe
{487C0C7A-967B-4b03-BBB2-2FA0CB5D8693}.exe
{60878326-3CDC-47c8-8FDF-D8837768CF53}.exe
{637D2D20-5B77-4e31-BEC8-4C2F53643BF2}.exe
{6A978B21-9779-4a75-959B-8A8ED4B66C2C}.exe
{82DAC418-D2AD-4a6c-B87F-792BBB9433F1}.exe
{9103F221-0CF7-45fe-8929-B9081FD45095}.exe
{A640299F-7EDB-49e3-9DEF-0D18DE124F07}.exe
{B3802CE9-6F6B-4354-B8CB-EC3AD4521DB5}.exe
{CB71F96E-A6F1-46c0-9398-9441127D4299}.exe
memory/1000-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1000-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1236-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1748-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1748-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1748-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3276-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3276-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4108-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4108-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4136-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4136-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4428-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4428-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5872-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5872-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5872-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6056-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6056-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6180-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6180-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6392-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6392-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6772-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6772-57-0x0000000000400000-0x0000000000410000-memory.dmp