Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/06/2026, 20:05
General
- Target 2026-06-25_be57e91a9d8e3c438224713f3275807c_elex_wannacry.exe
- Size 92KB
- Sample260629-ytwvdset2x
- SHA256 d037f3e601cd7201a5bfcf09b68412c87f0cd0fa18de8e2d8cf50cdebb3ea9e2
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 31 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_be57e91a9d8e3c438224713f3275807c_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_be57e91a9d8e3c438224713f3275807c_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{48840600-2F9C-48dd-AC74-44983DE459C4}.exeC:\Windows\{48840600-2F9C-48dd-AC74-44983DE459C4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C50915F6-1433-4f52-AA82-6DC5EA7386D2}.exeC:\Windows\{C50915F6-1433-4f52-AA82-6DC5EA7386D2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AECE35A3-D114-4465-84C0-B6F1F71DFF55}.exeC:\Windows\{AECE35A3-D114-4465-84C0-B6F1F71DFF55}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7BF8E3E7-0103-4053-9B8C-029C6C599334}.exeC:\Windows\{7BF8E3E7-0103-4053-9B8C-029C6C599334}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6844276F-8A87-4203-9055-A9F464E25E1D}.exeC:\Windows\{6844276F-8A87-4203-9055-A9F464E25E1D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C7A84A7-A60F-4e16-8368-97B4A3475979}.exeC:\Windows\{6C7A84A7-A60F-4e16-8368-97B4A3475979}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E7CFF37-3AE7-432f-8060-07B0EB171E5F}.exeC:\Windows\{1E7CFF37-3AE7-432f-8060-07B0EB171E5F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29CE5D2C-25D9-4891-A840-7C5249EDC8FB}.exeC:\Windows\{29CE5D2C-25D9-4891-A840-7C5249EDC8FB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{88DD9D0D-BC91-4b9b-AF5D-4FC8B704011E}.exeC:\Windows\{88DD9D0D-BC91-4b9b-AF5D-4FC8B704011E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F4D31B80-ADB9-4461-B221-D7BA9BBB9D73}.exeC:\Windows\{F4D31B80-ADB9-4461-B221-D7BA9BBB9D73}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78007B74-7715-41cb-8342-583DBA94689D}.exeC:\Windows\{78007B74-7715-41cb-8342-583DBA94689D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4D31~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88DD9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29CE5~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E7CF~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C7A8~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68442~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7BF8E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AECE3~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5091~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48840~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1E7CFF37-3AE7-432f-8060-07B0EB171E5F}.exe
{29CE5D2C-25D9-4891-A840-7C5249EDC8FB}.exe
{48840600-2F9C-48dd-AC74-44983DE459C4}.exe
{6844276F-8A87-4203-9055-A9F464E25E1D}.exe
{6C7A84A7-A60F-4e16-8368-97B4A3475979}.exe
{78007B74-7715-41cb-8342-583DBA94689D}.exe
{7BF8E3E7-0103-4053-9B8C-029C6C599334}.exe
{88DD9D0D-BC91-4b9b-AF5D-4FC8B704011E}.exe
{AECE35A3-D114-4465-84C0-B6F1F71DFF55}.exe
{C50915F6-1433-4f52-AA82-6DC5EA7386D2}.exe
{F4D31B80-ADB9-4461-B221-D7BA9BBB9D73}.exe
memory/532-17-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1996-57-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1996-52-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2100-1-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2100-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2100-7-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2188-62-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2416-39-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2416-34-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2896-32-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2896-28-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3128-40-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3128-44-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3376-22-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3384-63-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3624-45-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3624-51-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3788-27-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5096-5-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5096-12-0x0000000000400000-0x0000000000417000-memory.dmp