Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
29/06/2026, 07:37
General
- Target 2026-06-27_4ccad43882762ff8d30591346976d942_elex_rincux_wannacry.exe
- Size 64KB
- Sample260629-jf7meags91
- SHA256 0f63909626e4e6f135010ecb6406f2fa2e0fd984f05a656133728468bb002515
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 34 IoCs
- Detects Windows executables referencing non-Windows User-Agents 34 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_4ccad43882762ff8d30591346976d942_elex_rincux_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_4ccad43882762ff8d30591346976d942_elex_rincux_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF741B90-0BC6-4de6-A224-DEEE0A1B8AB0}.exeC:\Windows\{FF741B90-0BC6-4de6-A224-DEEE0A1B8AB0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2739741A-CD8F-4ec3-B07E-51DB61EB7962}.exeC:\Windows\{2739741A-CD8F-4ec3-B07E-51DB61EB7962}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73BA3E96-1958-4a20-9427-4F487B268811}.exeC:\Windows\{73BA3E96-1958-4a20-9427-4F487B268811}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{84C939FB-9400-4c7e-B7AE-1AC25DA97587}.exeC:\Windows\{84C939FB-9400-4c7e-B7AE-1AC25DA97587}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9C9842F-28F2-43ac-B9D0-3C52CF448425}.exeC:\Windows\{B9C9842F-28F2-43ac-B9D0-3C52CF448425}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C17B1CD5-BBBF-46fe-94EA-A9226DFC2BEA}.exeC:\Windows\{C17B1CD5-BBBF-46fe-94EA-A9226DFC2BEA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5076220-9BAE-4f71-AFD2-38C6C56F5D61}.exeC:\Windows\{A5076220-9BAE-4f71-AFD2-38C6C56F5D61}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB8A0DB3-8E36-49d6-8A23-81E46682108A}.exeC:\Windows\{AB8A0DB3-8E36-49d6-8A23-81E46682108A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{562E9B28-8279-4de9-9AF8-008E9374BC1D}.exeC:\Windows\{562E9B28-8279-4de9-9AF8-008E9374BC1D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{63EF72AA-D4B5-44e0-887F-5886BB539388}.exeC:\Windows\{63EF72AA-D4B5-44e0-887F-5886BB539388}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{562E9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB8A0~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5076~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C17B1~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9C98~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{84C93~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73BA3~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27397~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF741~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2739741A-CD8F-4ec3-B07E-51DB61EB7962}.exe
{562E9B28-8279-4de9-9AF8-008E9374BC1D}.exe
{63EF72AA-D4B5-44e0-887F-5886BB539388}.exe
{73BA3E96-1958-4a20-9427-4F487B268811}.exe
{84C939FB-9400-4c7e-B7AE-1AC25DA97587}.exe
{A5076220-9BAE-4f71-AFD2-38C6C56F5D61}.exe
{AB8A0DB3-8E36-49d6-8A23-81E46682108A}.exe
{B9C9842F-28F2-43ac-B9D0-3C52CF448425}.exe
{C17B1CD5-BBBF-46fe-94EA-A9226DFC2BEA}.exe
{FF741B90-0BC6-4de6-A224-DEEE0A1B8AB0}.exe
memory/1304-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1304-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1920-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1920-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1920-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2220-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2220-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2780-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2780-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2888-73-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3308-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3308-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3308-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3344-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3344-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3380-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3380-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3380-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3692-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3692-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4132-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4132-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5456-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5456-20-0x0000000000400000-0x0000000000410000-memory.dmp