Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/06/2026, 05:59
General
- Target 2026-06-29_99bdde2bee3fc9550818f2ebf39d50fc_elex_wannacry.exe
- Size 372KB
- Sample260630-gp3npsfy21
- SHA256 69e9943042fe6a780dba6f158a44cc2186f35101e95dff54ee7acb7a45325092
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_99bdde2bee3fc9550818f2ebf39d50fc_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_99bdde2bee3fc9550818f2ebf39d50fc_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A7F6F7C-215A-40fa-9284-7DE54E4E329C}.exeC:\Windows\{6A7F6F7C-215A-40fa-9284-7DE54E4E329C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3AF226E6-55DD-4e42-A86B-7F20863F3C8E}.exeC:\Windows\{3AF226E6-55DD-4e42-A86B-7F20863F3C8E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E24E45F9-74FB-4410-A5B1-0F09A438D1B5}.exeC:\Windows\{E24E45F9-74FB-4410-A5B1-0F09A438D1B5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FFC35E5A-36EF-4c8e-AB6C-A2C0D64E754B}.exeC:\Windows\{FFC35E5A-36EF-4c8e-AB6C-A2C0D64E754B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57EEA997-72FF-4f89-9481-D3383946E9D2}.exeC:\Windows\{57EEA997-72FF-4f89-9481-D3383946E9D2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5DC49CF5-DA4D-4945-9F49-D7CECE7F690D}.exeC:\Windows\{5DC49CF5-DA4D-4945-9F49-D7CECE7F690D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6D1F47E4-7815-4842-88C4-BE4CA8285C13}.exeC:\Windows\{6D1F47E4-7815-4842-88C4-BE4CA8285C13}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0511619-2561-4c13-B2F7-E01F255F1E2B}.exeC:\Windows\{F0511619-2561-4c13-B2F7-E01F255F1E2B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA1CC779-6F20-4098-B617-808113829A91}.exeC:\Windows\{AA1CC779-6F20-4098-B617-808113829A91}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75ADF11A-3D0F-4eca-A594-98A3F6D4D874}.exeC:\Windows\{75ADF11A-3D0F-4eca-A594-98A3F6D4D874}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C8BAE8A6-C270-4802-8CBB-771CD066F2E7}.exeC:\Windows\{C8BAE8A6-C270-4802-8CBB-771CD066F2E7}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75ADF~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA1CC~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0511~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D1F4~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5DC49~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57EEA~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFC35~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E24E4~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3AF22~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A7F6~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{3AF226E6-55DD-4e42-A86B-7F20863F3C8E}.exe
{57EEA997-72FF-4f89-9481-D3383946E9D2}.exe
{5DC49CF5-DA4D-4945-9F49-D7CECE7F690D}.exe
{6A7F6F7C-215A-40fa-9284-7DE54E4E329C}.exe
{6D1F47E4-7815-4842-88C4-BE4CA8285C13}.exe
{75ADF11A-3D0F-4eca-A594-98A3F6D4D874}.exe
{AA1CC779-6F20-4098-B617-808113829A91}.exe
{C8BAE8A6-C270-4802-8CBB-771CD066F2E7}.exe
{E24E45F9-74FB-4410-A5B1-0F09A438D1B5}.exe
{F0511619-2561-4c13-B2F7-E01F255F1E2B}.exe
{FFC35E5A-36EF-4c8e-AB6C-A2C0D64E754B}.exe