Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/06/2026, 04:38
General
- Target 2026-06-29_b4642a4b722c4854791e5cfb842a02f5_elex_wannacry.exe
- Size 80KB
- Sample260630-e9kyaaex3t
- SHA256 f4e6bd31f67467cb56a5f158661c87b105983e447843626bc3b5841ae02fbcac
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_b4642a4b722c4854791e5cfb842a02f5_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b4642a4b722c4854791e5cfb842a02f5_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D15AA0F1-B7B4-40ae-B4D7-DCC15C25D651}.exeC:\Windows\{D15AA0F1-B7B4-40ae-B4D7-DCC15C25D651}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15236688-43A7-4576-AEDB-0ABF8E7A73C2}.exeC:\Windows\{15236688-43A7-4576-AEDB-0ABF8E7A73C2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE8164F6-701C-4503-B0ED-4819574AC249}.exeC:\Windows\{DE8164F6-701C-4503-B0ED-4819574AC249}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2BE662A9-561B-4622-B6C6-B06382CED698}.exeC:\Windows\{2BE662A9-561B-4622-B6C6-B06382CED698}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B52E9F6-B226-4fb2-ADC4-DA1B800B4517}.exeC:\Windows\{1B52E9F6-B226-4fb2-ADC4-DA1B800B4517}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA6A702B-F8EC-4522-B767-C669CB0A57EE}.exeC:\Windows\{AA6A702B-F8EC-4522-B767-C669CB0A57EE}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4ABA522-726B-4648-926D-D6B0B0836CF5}.exeC:\Windows\{A4ABA522-726B-4648-926D-D6B0B0836CF5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01802CB8-EC22-4ec0-8DE7-D665E2AE7240}.exeC:\Windows\{01802CB8-EC22-4ec0-8DE7-D665E2AE7240}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE96D7AC-5F48-48a0-8F9A-FEBDC3C9432B}.exeC:\Windows\{BE96D7AC-5F48-48a0-8F9A-FEBDC3C9432B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FEBB1EE2-7F4D-4d77-830D-1C2EC5C6DC22}.exeC:\Windows\{FEBB1EE2-7F4D-4d77-830D-1C2EC5C6DC22}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A5F8842-2F45-454d-9CB2-D30EDA5AF00C}.exeC:\Windows\{7A5F8842-2F45-454d-9CB2-D30EDA5AF00C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FEBB1~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE96D~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01802~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4ABA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA6A7~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B52E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2BE66~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE816~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15236~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D15AA~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{01802CB8-EC22-4ec0-8DE7-D665E2AE7240}.exe
{15236688-43A7-4576-AEDB-0ABF8E7A73C2}.exe
{1B52E9F6-B226-4fb2-ADC4-DA1B800B4517}.exe
{2BE662A9-561B-4622-B6C6-B06382CED698}.exe
{7A5F8842-2F45-454d-9CB2-D30EDA5AF00C}.exe
{A4ABA522-726B-4648-926D-D6B0B0836CF5}.exe
{AA6A702B-F8EC-4522-B767-C669CB0A57EE}.exe
{BE96D7AC-5F48-48a0-8F9A-FEBDC3C9432B}.exe
{D15AA0F1-B7B4-40ae-B4D7-DCC15C25D651}.exe
{DE8164F6-701C-4503-B0ED-4819574AC249}.exe
{FEBB1EE2-7F4D-4d77-830D-1C2EC5C6DC22}.exe