Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/07/2026, 04:27
General
- Target 2026-06-30_6ec93969c3de212d5e65bd932d12fb9d_elex_wannacry.exe
- Size 60KB
- Sample260701-e3b2ssgs9t
- SHA256 cad1ff7d5a3acf78eafcee392f733fae1fa2ac8625a01de27f7c4cb5e07d8c81
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 32 IoCs
- Detects Windows executables referencing non-Windows User-Agents 32 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_6ec93969c3de212d5e65bd932d12fb9d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6ec93969c3de212d5e65bd932d12fb9d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06C819DA-053A-4806-A39C-4BD970770A05}.exeC:\Windows\{06C819DA-053A-4806-A39C-4BD970770A05}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13EA3CF3-7511-4a43-8230-527C11D96B5A}.exeC:\Windows\{13EA3CF3-7511-4a43-8230-527C11D96B5A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F5B5576-D30A-472b-9432-F04233BF523F}.exeC:\Windows\{7F5B5576-D30A-472b-9432-F04233BF523F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C59E3E2D-6375-4dcf-A5B2-68789B72E0C5}.exeC:\Windows\{C59E3E2D-6375-4dcf-A5B2-68789B72E0C5}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9FD48C27-A962-4215-880F-46580EDD763A}.exeC:\Windows\{9FD48C27-A962-4215-880F-46580EDD763A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C137C9F-42DE-4b86-B90B-FAA51A7EA1F0}.exeC:\Windows\{1C137C9F-42DE-4b86-B90B-FAA51A7EA1F0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5E5B505-A4C4-42eb-95D3-7FB2360453F4}.exeC:\Windows\{D5E5B505-A4C4-42eb-95D3-7FB2360453F4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3BCEEB5-EF3C-4d35-BACA-3628857A4A87}.exeC:\Windows\{A3BCEEB5-EF3C-4d35-BACA-3628857A4A87}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED5E6153-104E-45ec-984E-1B1195C0091A}.exeC:\Windows\{ED5E6153-104E-45ec-984E-1B1195C0091A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1580B47B-C6AB-4d3c-ADCF-844749C9DABC}.exeC:\Windows\{1580B47B-C6AB-4d3c-ADCF-844749C9DABC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91D136AF-150B-483f-A99C-59ABA19ABFC0}.exeC:\Windows\{91D136AF-150B-483f-A99C-59ABA19ABFC0}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1580B~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED5E6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3BCE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5E5B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C137~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FD48~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C59E3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F5B5~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13EA3~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06C81~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{06C819DA-053A-4806-A39C-4BD970770A05}.exe
{13EA3CF3-7511-4a43-8230-527C11D96B5A}.exe
{1580B47B-C6AB-4d3c-ADCF-844749C9DABC}.exe
{1C137C9F-42DE-4b86-B90B-FAA51A7EA1F0}.exe
{7F5B5576-D30A-472b-9432-F04233BF523F}.exe
{91D136AF-150B-483f-A99C-59ABA19ABFC0}.exe
{9FD48C27-A962-4215-880F-46580EDD763A}.exe
{A3BCEEB5-EF3C-4d35-BACA-3628857A4A87}.exe
{C59E3E2D-6375-4dcf-A5B2-68789B72E0C5}.exe
{D5E5B505-A4C4-42eb-95D3-7FB2360453F4}.exe
{ED5E6153-104E-45ec-984E-1B1195C0091A}.exe
memory/2068-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2068-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2092-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2092-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2468-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2468-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2480-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2480-52-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3068-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4072-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4220-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4220-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4820-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4820-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4820-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4932-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5080-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5080-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5080-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5352-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5368-45-0x0000000000400000-0x0000000000410000-memory.dmp