Overview

overview

10

Static

static

10

2026-07-01...ry.exe

windows10-2004-x64

10

2026-07-01...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 18:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_e59df986461dc338539ebf4ac1b7c971_elex_wannacry.exe
  • Size 72KB
  • Sample260701-wtawtads91
  • SHA256 5e4da9c7d23dd20a8ded5f1289fc45694d5baba356e0e33f3c7e205ef25ee220
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverystormserpersistenceupxworm

Malware Config

Signatures

  • Family: Stormser, StormDDoS, StormAttack, Stormer

    Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.

    wormstormser
  • Detects Stormser aka Storm DDoS and StormAttack 45 IoCs
  • UPX dump on OEP (original entry point) 45 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 11 IoCs
  • UPX packed file 45 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_e59df986461dc338539ebf4ac1b7c971_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_e59df986461dc338539ebf4ac1b7c971_elex_wannacry.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Windows\{34AD00FF-A6CF-473e-8A40-DD9C1D4DECAF}.exe
      C:\Windows\{34AD00FF-A6CF-473e-8A40-DD9C1D4DECAF}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1488
      • C:\Windows\{5B3294AC-960D-4c4e-ACAF-041E5B7B8A40}.exe
        C:\Windows\{5B3294AC-960D-4c4e-ACAF-041E5B7B8A40}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Windows\{E186FFD3-7F1F-4b38-A7F9-FA525B11256B}.exe
          C:\Windows\{E186FFD3-7F1F-4b38-A7F9-FA525B11256B}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4736
          • C:\Windows\{AFA42FDC-ADA4-43e2-BBE1-C243E1A4A184}.exe
            C:\Windows\{AFA42FDC-ADA4-43e2-BBE1-C243E1A4A184}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3208
            • C:\Windows\{C9F13EB7-DA39-4220-B206-B5FF6D91E9BE}.exe
              C:\Windows\{C9F13EB7-DA39-4220-B206-B5FF6D91E9BE}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1308
              • C:\Windows\{D0FD697A-307B-4aee-9DEE-906B5D133FFC}.exe
                C:\Windows\{D0FD697A-307B-4aee-9DEE-906B5D133FFC}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2008
                • C:\Windows\{B71CACB7-C314-485d-A046-E95ABCD7DD09}.exe
                  C:\Windows\{B71CACB7-C314-485d-A046-E95ABCD7DD09}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1632
                  • C:\Windows\{CE204633-149D-4f44-8CC9-5691DEF038A9}.exe
                    C:\Windows\{CE204633-149D-4f44-8CC9-5691DEF038A9}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4892
                    • C:\Windows\{610B3B9E-3401-437c-8570-44BE3F7362AE}.exe
                      C:\Windows\{610B3B9E-3401-437c-8570-44BE3F7362AE}.exe
                      10⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2056
                      • C:\Windows\{12AD5A3E-3C34-43c3-9512-AC25F01B06FE}.exe
                        C:\Windows\{12AD5A3E-3C34-43c3-9512-AC25F01B06FE}.exe
                        11⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1832
                        • C:\Windows\{2BFDA427-1413-4122-9872-A4122918D44F}.exe
                          C:\Windows\{2BFDA427-1413-4122-9872-A4122918D44F}.exe
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:3976
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{12AD5~1.EXE > nul
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:3340
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{610B3~1.EXE > nul
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:1772
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{CE204~1.EXE > nul
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:5844
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{B71CA~1.EXE > nul
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:4240
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{D0FD6~1.EXE > nul
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:3008
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{C9F13~1.EXE > nul
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4648
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{AFA42~1.EXE > nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5088
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{E186F~1.EXE > nul
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4924
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{5B329~1.EXE > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4456
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{34AD0~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5480
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        {12AD5A3E-3C34-43c3-9512-AC25F01B06FE}.exe
        • Path C:\Windows\{12AD5A3E-3C34-43c3-9512-AC25F01B06FE}.exe
        • Size 72KB
        • SHA256 d7ca3be32dc7d0d7743cefe013f4a8acaca1aab62ea4612d7e9c6cb9d5f59874
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {2BFDA427-1413-4122-9872-A4122918D44F}.exe
        • Path C:\Windows\{2BFDA427-1413-4122-9872-A4122918D44F}.exe
        • Size 72KB
        • SHA256 bed3418e5b56bc3e49a71de50ef358da31ba62d8d99872a5d4cb9ce36ec14630
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {34AD00FF-A6CF-473e-8A40-DD9C1D4DECAF}.exe
        • Path C:\Windows\{34AD00FF-A6CF-473e-8A40-DD9C1D4DECAF}.exe
        • Size 72KB
        • SHA256 6ddd9d32f596a529070356e8a95d892189ae99d899d0a14616631d375be46ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {5B3294AC-960D-4c4e-ACAF-041E5B7B8A40}.exe
        • Path C:\Windows\{5B3294AC-960D-4c4e-ACAF-041E5B7B8A40}.exe
        • Size 72KB
        • SHA256 4a03fac02c2c064414c14529d210a3f1c0c63676cfaad176c402930a89c2b94f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {610B3B9E-3401-437c-8570-44BE3F7362AE}.exe
        • Path C:\Windows\{610B3B9E-3401-437c-8570-44BE3F7362AE}.exe
        • Size 72KB
        • SHA256 58bddf7ab61b41d21900022d59be1f8aaa8b44e7589f2a4fa746c64e2f6552dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {AFA42FDC-ADA4-43e2-BBE1-C243E1A4A184}.exe
        • Path C:\Windows\{AFA42FDC-ADA4-43e2-BBE1-C243E1A4A184}.exe
        • Size 72KB
        • SHA256 4f2a486dd9e0ab4d379e9e49df2f99dbe5481ffba5b71f5772a85826204cbfe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {B71CACB7-C314-485d-A046-E95ABCD7DD09}.exe
        • Path C:\Windows\{B71CACB7-C314-485d-A046-E95ABCD7DD09}.exe
        • Size 72KB
        • SHA256 7625bfddc604108eb9eb5821e8f9d1d630154f31feeb0357dd67274485a10764
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {C9F13EB7-DA39-4220-B206-B5FF6D91E9BE}.exe
        • Path C:\Windows\{C9F13EB7-DA39-4220-B206-B5FF6D91E9BE}.exe
        • Size 72KB
        • SHA256 e1130e54c5d85b8cf0f130a4ab22c6680c6cd12fdac2750bfa0498eecef3fac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {CE204633-149D-4f44-8CC9-5691DEF038A9}.exe
        • Path C:\Windows\{CE204633-149D-4f44-8CC9-5691DEF038A9}.exe
        • Size 72KB
        • SHA256 db2e309c946d0298b21a8b6511c6242658993ce44974dc02c429a42eaac1795e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {D0FD697A-307B-4aee-9DEE-906B5D133FFC}.exe
        • Path C:\Windows\{D0FD697A-307B-4aee-9DEE-906B5D133FFC}.exe
        • Size 72KB
        • SHA256 286bd1d14c33e349a7b49cf3bc9b6c33722a34ffbdf46444345b772d1a2d7449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {E186FFD3-7F1F-4b38-A7F9-FA525B11256B}.exe
        • Path C:\Windows\{E186FFD3-7F1F-4b38-A7F9-FA525B11256B}.exe
        • Size 72KB
        • SHA256 8d0a8d2f21b0778a40552e2f22dc4835c5acc043c3651acdbc52d2cd7d252945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/924-1-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/924-0-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/924-7-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1308-47-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1308-41-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1308-39-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1488-9-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1488-13-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1488-6-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1632-61-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1632-57-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1632-55-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1832-85-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1832-79-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1832-81-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1972-23-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1972-15-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1972-17-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2008-49-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2008-46-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2008-53-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2056-77-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2056-73-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2056-71-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3208-38-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3208-31-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3208-33-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3976-87-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4736-29-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4736-25-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4736-22-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4892-63-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4892-69-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4892-65-0x0000000000400000-0x0000000000413000-memory.dmp
        Download