Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/06/2026, 04:31
General
- Target 2026-06-27_a08265efda43152b4c3c80b5e16ad7d7_elex_wannacry.exe
- Size 60KB
- Sample260629-e5ntdac15s
- SHA256 c0b3de0b05682bc46f5e1bfcd63d07f9c23fa7cc03c165f22b079afcf4c8984d
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_a08265efda43152b4c3c80b5e16ad7d7_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a08265efda43152b4c3c80b5e16ad7d7_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{551E24B8-4A15-403e-B910-13E8AFB026FE}.exeC:\Windows\{551E24B8-4A15-403e-B910-13E8AFB026FE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCB2C1BE-6D56-4a98-B5C6-2D1CB8FDE44D}.exeC:\Windows\{CCB2C1BE-6D56-4a98-B5C6-2D1CB8FDE44D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B3187A5-53DB-4fe4-8FFA-5F8FF83E3962}.exeC:\Windows\{4B3187A5-53DB-4fe4-8FFA-5F8FF83E3962}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA048839-3D86-45d3-857D-584C005601C7}.exeC:\Windows\{DA048839-3D86-45d3-857D-584C005601C7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C1D8F68-8A3F-45a1-B929-DD6C5A233BC1}.exeC:\Windows\{6C1D8F68-8A3F-45a1-B929-DD6C5A233BC1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4D3A9CEB-3B4B-4791-946F-95D4AE5E7F7B}.exeC:\Windows\{4D3A9CEB-3B4B-4791-946F-95D4AE5E7F7B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A289AE4F-9ADF-4b39-9E90-4C0672B9CAC3}.exeC:\Windows\{A289AE4F-9ADF-4b39-9E90-4C0672B9CAC3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7018AB6-A97B-4417-B4A0-A321C4398085}.exeC:\Windows\{A7018AB6-A97B-4417-B4A0-A321C4398085}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18328776-0A19-4e2a-ADB9-B622E0ECDAFE}.exeC:\Windows\{18328776-0A19-4e2a-ADB9-B622E0ECDAFE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77BE4802-D29E-4463-8463-A47F5EA57624}.exeC:\Windows\{77BE4802-D29E-4463-8463-A47F5EA57624}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{680961C0-963A-4487-A07C-71DDA52AE5BC}.exeC:\Windows\{680961C0-963A-4487-A07C-71DDA52AE5BC}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77BE4~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18328~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7018~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A289A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D3A9~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C1D8~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA048~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B318~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCB2C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{551E2~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{18328776-0A19-4e2a-ADB9-B622E0ECDAFE}.exe
{4B3187A5-53DB-4fe4-8FFA-5F8FF83E3962}.exe
{4D3A9CEB-3B4B-4791-946F-95D4AE5E7F7B}.exe
{551E24B8-4A15-403e-B910-13E8AFB026FE}.exe
{680961C0-963A-4487-A07C-71DDA52AE5BC}.exe
{6C1D8F68-8A3F-45a1-B929-DD6C5A233BC1}.exe
{77BE4802-D29E-4463-8463-A47F5EA57624}.exe
{A289AE4F-9ADF-4b39-9E90-4C0672B9CAC3}.exe
{A7018AB6-A97B-4417-B4A0-A321C4398085}.exe
{CCB2C1BE-6D56-4a98-B5C6-2D1CB8FDE44D}.exe
{DA048839-3D86-45d3-857D-584C005601C7}.exe