Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/07/2026, 04:37
General
- Target 2026-06-30_6544bd943c6d527eebb5e12bce93e9aa_elex_wannacry.exe
- Size 60KB
- Sample260701-e82jmsev3l
- SHA256 72ad7ef9b7e56f19067e9f3e1acccdeffeb6ae8b932e84d45f2de761ec272cb7
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 34 IoCs
- Detects Windows executables referencing non-Windows User-Agents 34 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_6544bd943c6d527eebb5e12bce93e9aa_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6544bd943c6d527eebb5e12bce93e9aa_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{556DD7AC-69FE-4322-A64A-F4F387B66D42}.exeC:\Windows\{556DD7AC-69FE-4322-A64A-F4F387B66D42}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B807E6A1-9567-4605-89C8-8FD4B600290F}.exeC:\Windows\{B807E6A1-9567-4605-89C8-8FD4B600290F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA34CF75-D663-4f46-9CA5-FF9A0C1E82CB}.exeC:\Windows\{FA34CF75-D663-4f46-9CA5-FF9A0C1E82CB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF742A8F-8FCA-4894-BC7B-BC965CEB36C6}.exeC:\Windows\{EF742A8F-8FCA-4894-BC7B-BC965CEB36C6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3135D416-76D3-460d-864F-C5054D6DBB13}.exeC:\Windows\{3135D416-76D3-460d-864F-C5054D6DBB13}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FAE48946-3BE8-426b-8392-F4CEBB78B1EE}.exeC:\Windows\{FAE48946-3BE8-426b-8392-F4CEBB78B1EE}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2BC65A3D-16B3-40f7-BAFB-33346CA4BDC5}.exeC:\Windows\{2BC65A3D-16B3-40f7-BAFB-33346CA4BDC5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{445F1740-A68D-4ec5-BC57-A4917135440F}.exeC:\Windows\{445F1740-A68D-4ec5-BC57-A4917135440F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF201AA6-0B14-458e-AF2F-686F71CF1313}.exeC:\Windows\{FF201AA6-0B14-458e-AF2F-686F71CF1313}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B5F76635-A9BE-4721-BF95-49C6F021A9A2}.exeC:\Windows\{B5F76635-A9BE-4721-BF95-49C6F021A9A2}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B7CB533-C55B-46a7-96BC-B6F636F21AC5}.exeC:\Windows\{9B7CB533-C55B-46a7-96BC-B6F636F21AC5}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5F76~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF201~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{445F1~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2BC65~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FAE48~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3135D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF742~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA34C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B807E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{556DD~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2BC65A3D-16B3-40f7-BAFB-33346CA4BDC5}.exe
{3135D416-76D3-460d-864F-C5054D6DBB13}.exe
{445F1740-A68D-4ec5-BC57-A4917135440F}.exe
{556DD7AC-69FE-4322-A64A-F4F387B66D42}.exe
{9B7CB533-C55B-46a7-96BC-B6F636F21AC5}.exe
{B5F76635-A9BE-4721-BF95-49C6F021A9A2}.exe
{B807E6A1-9567-4605-89C8-8FD4B600290F}.exe
{EF742A8F-8FCA-4894-BC7B-BC965CEB36C6}.exe
{FA34CF75-D663-4f46-9CA5-FF9A0C1E82CB}.exe
{FAE48946-3BE8-426b-8392-F4CEBB78B1EE}.exe
{FF201AA6-0B14-458e-AF2F-686F71CF1313}.exe
memory/1696-59-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1696-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1920-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3216-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3216-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3216-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3932-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3932-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3932-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4100-38-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4100-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4132-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4144-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4384-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4384-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4404-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4404-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4440-10-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4440-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4688-32-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4688-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4840-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4840-24-0x0000000000400000-0x0000000000410000-memory.dmp