Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
29/06/2026, 04:37
General
- Target 2026-06-27_9d54ec542f3507c567787eae48bcfb15_elex_wannacry.exe
- Size 64KB
- Sample260629-e89j9ads4t
- SHA256 c792ed9f03ff03316ba1f9402a9df640fbaff8127c3adbcb5da3761b5fe5be88
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_9d54ec542f3507c567787eae48bcfb15_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9d54ec542f3507c567787eae48bcfb15_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C10D1938-3AA5-4ee6-B3EB-223C46249C48}.exeC:\Windows\{C10D1938-3AA5-4ee6-B3EB-223C46249C48}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3738E451-A241-41d1-8F8A-CEE4204718D7}.exeC:\Windows\{3738E451-A241-41d1-8F8A-CEE4204718D7}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2BB11871-C6FE-454b-A057-EC5DAB41862D}.exeC:\Windows\{2BB11871-C6FE-454b-A057-EC5DAB41862D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3184B0C7-AADC-47ef-BE95-10AE3BCED45B}.exeC:\Windows\{3184B0C7-AADC-47ef-BE95-10AE3BCED45B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A251050-0017-4339-A344-84D51B8F4BAD}.exeC:\Windows\{8A251050-0017-4339-A344-84D51B8F4BAD}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDFE3536-BE82-4067-AB7D-4A53BD09732F}.exeC:\Windows\{CDFE3536-BE82-4067-AB7D-4A53BD09732F}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{152D655F-3632-442d-BA1D-034047A2AFE4}.exeC:\Windows\{152D655F-3632-442d-BA1D-034047A2AFE4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F07C6BE0-740A-4593-AA84-B1BA35F583F0}.exeC:\Windows\{F07C6BE0-740A-4593-AA84-B1BA35F583F0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{55118EEB-0C4B-4a20-8AC3-80CE8653E0FC}.exeC:\Windows\{55118EEB-0C4B-4a20-8AC3-80CE8653E0FC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5737D074-A354-453b-B9CF-DA60AE7B2BCF}.exeC:\Windows\{5737D074-A354-453b-B9CF-DA60AE7B2BCF}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7AF1211C-6008-451f-A22C-45BE8532836E}.exeC:\Windows\{7AF1211C-6008-451f-A22C-45BE8532836E}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5737D~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55118~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F07C6~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{152D6~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDFE3~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A251~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3184B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2BB11~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3738E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C10D1~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{152D655F-3632-442d-BA1D-034047A2AFE4}.exe
{2BB11871-C6FE-454b-A057-EC5DAB41862D}.exe
{3184B0C7-AADC-47ef-BE95-10AE3BCED45B}.exe
{3738E451-A241-41d1-8F8A-CEE4204718D7}.exe
{55118EEB-0C4B-4a20-8AC3-80CE8653E0FC}.exe
{5737D074-A354-453b-B9CF-DA60AE7B2BCF}.exe
{7AF1211C-6008-451f-A22C-45BE8532836E}.exe
{8A251050-0017-4339-A344-84D51B8F4BAD}.exe
{C10D1938-3AA5-4ee6-B3EB-223C46249C48}.exe
{CDFE3536-BE82-4067-AB7D-4A53BD09732F}.exe
{F07C6BE0-740A-4593-AA84-B1BA35F583F0}.exe
memory/1440-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1440-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1440-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1540-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1540-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1680-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1680-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2044-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2044-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3304-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3480-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3480-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4188-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4188-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4376-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4376-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4496-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4496-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5208-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5208-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5328-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5328-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5544-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5544-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5544-21-0x0000000000400000-0x0000000000410000-memory.dmp