Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 00:58
General
- Target 2026-06-30_089119e01979a30e85be6fc929b9475e_elex_wannacry.exe
- Size 64KB
- Sample260701-bbkm3sdv8y
- SHA256 c94f07fc4d1f1000eb07697bf06434173f424c6a686263336ee939c6adf39f6d
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_089119e01979a30e85be6fc929b9475e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_089119e01979a30e85be6fc929b9475e_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F47ABD5B-C9BB-4da9-A09F-2A57AECD6A1F}.exeC:\Windows\{F47ABD5B-C9BB-4da9-A09F-2A57AECD6A1F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3EE232C7-E518-4e2f-BFDB-9821253B9A34}.exeC:\Windows\{3EE232C7-E518-4e2f-BFDB-9821253B9A34}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10EC563D-5B4E-4bd9-85D1-D1F0C99C88D8}.exeC:\Windows\{10EC563D-5B4E-4bd9-85D1-D1F0C99C88D8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D69FDBE7-56FE-4da1-B64D-83D277B30DCC}.exeC:\Windows\{D69FDBE7-56FE-4da1-B64D-83D277B30DCC}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{572B2EA0-0E47-4b6d-AFDF-286488D5FF0C}.exeC:\Windows\{572B2EA0-0E47-4b6d-AFDF-286488D5FF0C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A914D548-D9C2-484c-B7C5-81B59F84808A}.exeC:\Windows\{A914D548-D9C2-484c-B7C5-81B59F84808A}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F949026-874C-442b-9CDE-1BB5BD98A845}.exeC:\Windows\{2F949026-874C-442b-9CDE-1BB5BD98A845}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{020016C8-C42E-4b8d-A85B-74F6ECE31315}.exeC:\Windows\{020016C8-C42E-4b8d-A85B-74F6ECE31315}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE023015-C4C0-4243-8DFB-E8F4033B31A0}.exeC:\Windows\{AE023015-C4C0-4243-8DFB-E8F4033B31A0}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F9262C7-17A1-4220-8A6F-FF915EF52CD5}.exeC:\Windows\{0F9262C7-17A1-4220-8A6F-FF915EF52CD5}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F4297B2-2589-4823-833B-D2956F79586A}.exeC:\Windows\{7F4297B2-2589-4823-833B-D2956F79586A}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F926~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE023~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02001~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F949~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A914D~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{572B2~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D69FD~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10EC5~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3EE23~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F47AB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{020016C8-C42E-4b8d-A85B-74F6ECE31315}.exe
{0F9262C7-17A1-4220-8A6F-FF915EF52CD5}.exe
{10EC563D-5B4E-4bd9-85D1-D1F0C99C88D8}.exe
{2F949026-874C-442b-9CDE-1BB5BD98A845}.exe
{3EE232C7-E518-4e2f-BFDB-9821253B9A34}.exe
{572B2EA0-0E47-4b6d-AFDF-286488D5FF0C}.exe
{7F4297B2-2589-4823-833B-D2956F79586A}.exe
{A914D548-D9C2-484c-B7C5-81B59F84808A}.exe
{AE023015-C4C0-4243-8DFB-E8F4033B31A0}.exe
{D69FDBE7-56FE-4da1-B64D-83D277B30DCC}.exe
{F47ABD5B-C9BB-4da9-A09F-2A57AECD6A1F}.exe
memory/1124-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1388-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1388-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2368-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2368-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3056-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3056-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5396-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5396-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5896-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5896-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5924-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5924-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6076-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6076-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6076-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6092-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6092-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6448-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6448-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6800-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6800-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6800-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/7068-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/7068-28-0x0000000000400000-0x0000000000410000-memory.dmp