Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 02:40
General
- Target 2026-06-30_d11ab21c1dad8c9d7cbdd06e895c188d_elex_wannacry.exe
- Size 68KB
- Sample260701-c6cfmacz6m
- SHA256 4713e998e6c9958aca3ec4ed9543d7da9a07bc68b26c89218639b2a9c6977e2e
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_d11ab21c1dad8c9d7cbdd06e895c188d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_d11ab21c1dad8c9d7cbdd06e895c188d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44C9A99E-5C76-4d89-9346-DFE54F9FA485}.exeC:\Windows\{44C9A99E-5C76-4d89-9346-DFE54F9FA485}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24966E7A-BBDC-475e-986B-1ADFB7EC13A1}.exeC:\Windows\{24966E7A-BBDC-475e-986B-1ADFB7EC13A1}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77DAE840-16A8-4222-8CCB-AA169C3B3209}.exeC:\Windows\{77DAE840-16A8-4222-8CCB-AA169C3B3209}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{41FD8DB9-2581-48e8-AEE5-6B8D8E1B3BDF}.exeC:\Windows\{41FD8DB9-2581-48e8-AEE5-6B8D8E1B3BDF}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A6ACD1F-64E3-472b-911E-B03ADA34BA1B}.exeC:\Windows\{1A6ACD1F-64E3-472b-911E-B03ADA34BA1B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B4301DE-0C54-4ef0-A08C-844702077416}.exeC:\Windows\{6B4301DE-0C54-4ef0-A08C-844702077416}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2EA1F3E-B23C-485f-B264-CF1EAF083823}.exeC:\Windows\{E2EA1F3E-B23C-485f-B264-CF1EAF083823}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFF375F9-B1AA-4d0c-8A85-2AE3C93FFF6C}.exeC:\Windows\{AFF375F9-B1AA-4d0c-8A85-2AE3C93FFF6C}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{63877898-D634-4fc2-B19C-642CB41DFD03}.exeC:\Windows\{63877898-D634-4fc2-B19C-642CB41DFD03}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA0124E9-4D27-48f0-998F-A7B0D3E3F80F}.exeC:\Windows\{DA0124E9-4D27-48f0-998F-A7B0D3E3F80F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7B750069-5428-49ad-AE9C-AEA0A9823B3B}.exeC:\Windows\{7B750069-5428-49ad-AE9C-AEA0A9823B3B}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA012~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63877~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFF37~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2EA1~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B430~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A6AC~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41FD8~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77DAE~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24966~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44C9A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1A6ACD1F-64E3-472b-911E-B03ADA34BA1B}.exe
{24966E7A-BBDC-475e-986B-1ADFB7EC13A1}.exe
{41FD8DB9-2581-48e8-AEE5-6B8D8E1B3BDF}.exe
{44C9A99E-5C76-4d89-9346-DFE54F9FA485}.exe
{63877898-D634-4fc2-B19C-642CB41DFD03}.exe
{6B4301DE-0C54-4ef0-A08C-844702077416}.exe
{77DAE840-16A8-4222-8CCB-AA169C3B3209}.exe
{7B750069-5428-49ad-AE9C-AEA0A9823B3B}.exe
{AFF375F9-B1AA-4d0c-8A85-2AE3C93FFF6C}.exe
{DA0124E9-4D27-48f0-998F-A7B0D3E3F80F}.exe
{E2EA1F3E-B23C-485f-B264-CF1EAF083823}.exe
memory/1832-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1832-75-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2408-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2408-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3008-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3008-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3932-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3932-54-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4116-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4116-68-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5792-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5792-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5824-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5824-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5824-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6196-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6720-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6720-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6736-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6736-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6844-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6844-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6932-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6932-33-0x0000000000400000-0x0000000000411000-memory.dmp