Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 08:32
General
- Target 2026-06-29_69deba8ea629abcba523858bdc2674ec_elex_wannacry.exe
- Size 60KB
- Sample260630-kfd6jaay91
- SHA256 1bdcaad41ccea2b73431bf1f4b9624c832450c357bf3297a3c4069a3d4f682e9
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_69deba8ea629abcba523858bdc2674ec_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_69deba8ea629abcba523858bdc2674ec_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4DAE4DC5-B5A0-4292-BEF1-BEDC19966679}.exeC:\Windows\{4DAE4DC5-B5A0-4292-BEF1-BEDC19966679}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2E2E1FB-C11F-4259-93B4-BBD48EBCBDFE}.exeC:\Windows\{B2E2E1FB-C11F-4259-93B4-BBD48EBCBDFE}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56F43D33-82D0-44b1-A0BB-0D17A6EB3F06}.exeC:\Windows\{56F43D33-82D0-44b1-A0BB-0D17A6EB3F06}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93730711-767B-4214-98EB-1E850C13DD6C}.exeC:\Windows\{93730711-767B-4214-98EB-1E850C13DD6C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{34CC3F5D-7684-4e8a-A1EC-A264E6EC8ECE}.exeC:\Windows\{34CC3F5D-7684-4e8a-A1EC-A264E6EC8ECE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76DA5F21-31CE-4f0a-9394-E9F8B531F8AF}.exeC:\Windows\{76DA5F21-31CE-4f0a-9394-E9F8B531F8AF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C2B6A51-5717-43fe-AB9C-E5A48F376BA3}.exeC:\Windows\{8C2B6A51-5717-43fe-AB9C-E5A48F376BA3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA05AC17-0A22-469e-A1BC-BBA3AE037CD2}.exeC:\Windows\{EA05AC17-0A22-469e-A1BC-BBA3AE037CD2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D238A0B-6489-4fc4-94FC-D4C9D8E8F6BA}.exeC:\Windows\{7D238A0B-6489-4fc4-94FC-D4C9D8E8F6BA}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2952F22-8AEE-423c-855C-04760E89EEE6}.exeC:\Windows\{B2952F22-8AEE-423c-855C-04760E89EEE6}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD8F71F6-7D1B-4d8e-8E0E-BA21B9D1249F}.exeC:\Windows\{DD8F71F6-7D1B-4d8e-8E0E-BA21B9D1249F}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2952~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D238~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA05A~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C2B6~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76DA5~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34CC3~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93730~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56F43~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2E2E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4DAE4~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{34CC3F5D-7684-4e8a-A1EC-A264E6EC8ECE}.exe
{4DAE4DC5-B5A0-4292-BEF1-BEDC19966679}.exe
{56F43D33-82D0-44b1-A0BB-0D17A6EB3F06}.exe
{76DA5F21-31CE-4f0a-9394-E9F8B531F8AF}.exe
{7D238A0B-6489-4fc4-94FC-D4C9D8E8F6BA}.exe
{8C2B6A51-5717-43fe-AB9C-E5A48F376BA3}.exe
{93730711-767B-4214-98EB-1E850C13DD6C}.exe
{B2952F22-8AEE-423c-855C-04760E89EEE6}.exe
{B2E2E1FB-C11F-4259-93B4-BBD48EBCBDFE}.exe
{DD8F71F6-7D1B-4d8e-8E0E-BA21B9D1249F}.exe
{EA05AC17-0A22-469e-A1BC-BBA3AE037CD2}.exe
memory/1152-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1152-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1760-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1760-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2028-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2780-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2780-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2788-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2788-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3424-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3424-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3896-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3896-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3896-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4300-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4300-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5196-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5196-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5196-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5796-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5796-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5852-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5852-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6464-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6464-43-0x0000000000400000-0x0000000000410000-memory.dmp