Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
01/07/2026, 18:59
General
- Target 2026-07-01_856ae833c2c0e8975ac78ee9ecdd4925_elex_wannacry.exe
- Size 88KB
- Sample260701-xnkphaew6v
- SHA256 f46332adae53cfc53ce2c5768b0b04b3c281807e63b21cc4b953b6f7c6db9e1d
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_856ae833c2c0e8975ac78ee9ecdd4925_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_856ae833c2c0e8975ac78ee9ecdd4925_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDD740CB-14D2-4cbc-80C6-E7E7EA1303BC}.exeC:\Windows\{CDD740CB-14D2-4cbc-80C6-E7E7EA1303BC}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B844F6CE-74C5-4fd3-B105-C064D52695CE}.exeC:\Windows\{B844F6CE-74C5-4fd3-B105-C064D52695CE}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85E19C15-9A88-4ef3-B15E-1883D9AFBE04}.exeC:\Windows\{85E19C15-9A88-4ef3-B15E-1883D9AFBE04}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D598953-F6D8-4e38-9E54-8582A2135868}.exeC:\Windows\{7D598953-F6D8-4e38-9E54-8582A2135868}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F4BA0FD-B7B8-4089-979B-AC801B125381}.exeC:\Windows\{0F4BA0FD-B7B8-4089-979B-AC801B125381}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7B28C1AA-D2CE-497f-B9C0-1531216158D2}.exeC:\Windows\{7B28C1AA-D2CE-497f-B9C0-1531216158D2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8ADD5807-14E1-47d9-A24E-704C147C17F9}.exeC:\Windows\{8ADD5807-14E1-47d9-A24E-704C147C17F9}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C4D5381-C368-4c62-9DDA-38E4EA1ECEA9}.exeC:\Windows\{9C4D5381-C368-4c62-9DDA-38E4EA1ECEA9}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{279589BA-92A8-42b9-A3A9-206DEF09AEF9}.exeC:\Windows\{279589BA-92A8-42b9-A3A9-206DEF09AEF9}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26480D0A-CB86-419c-9FA1-BB5918D239F7}.exeC:\Windows\{26480D0A-CB86-419c-9FA1-BB5918D239F7}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0714DC30-01F4-4a92-B6BB-F72A2E080814}.exeC:\Windows\{0714DC30-01F4-4a92-B6BB-F72A2E080814}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26480~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27958~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C4D5~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8ADD5~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B28C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F4BA~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D598~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85E19~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B844F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDD74~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0714DC30-01F4-4a92-B6BB-F72A2E080814}.exe
{0F4BA0FD-B7B8-4089-979B-AC801B125381}.exe
{26480D0A-CB86-419c-9FA1-BB5918D239F7}.exe
{279589BA-92A8-42b9-A3A9-206DEF09AEF9}.exe
{7B28C1AA-D2CE-497f-B9C0-1531216158D2}.exe
{7D598953-F6D8-4e38-9E54-8582A2135868}.exe
{85E19C15-9A88-4ef3-B15E-1883D9AFBE04}.exe
{8ADD5807-14E1-47d9-A24E-704C147C17F9}.exe
{9C4D5381-C368-4c62-9DDA-38E4EA1ECEA9}.exe
{B844F6CE-74C5-4fd3-B105-C064D52695CE}.exe
{CDD740CB-14D2-4cbc-80C6-E7E7EA1303BC}.exe
memory/236-9-0x0000000000400000-0x0000000000411000-memory.dmp
memory/236-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/236-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/804-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/804-15-0x0000000000400000-0x0000000000411000-memory.dmp
memory/952-76-0x0000000000400000-0x0000000000411000-memory.dmp
memory/952-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1220-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1220-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2744-43-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2744-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2748-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3252-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3252-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3472-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3472-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3864-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3864-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3924-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3924-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3956-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3956-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3956-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4744-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4744-63-0x0000000000400000-0x0000000000411000-memory.dmp