Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
02/07/2026, 16:00
General
- Target 2026-07-02_feb4be1a5c493ded69e0109ab056ff66_elex_rincux_wannacry.exe
- Size 64KB
- Sample260702-tftewset3j
- SHA256 8cf6c4de7b222ebbc8caa7b061a40d977014eef41070791f42e4a59c2e26c350
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Detects Windows executables referencing non-Windows User-Agents 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_feb4be1a5c493ded69e0109ab056ff66_elex_rincux_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_feb4be1a5c493ded69e0109ab056ff66_elex_rincux_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B7FFFF12-2ECC-44c0-AA02-3AA0AB4A1C7B}.exeC:\Windows\{B7FFFF12-2ECC-44c0-AA02-3AA0AB4A1C7B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77782732-010D-4c0d-854B-A39FB60DE48C}.exeC:\Windows\{77782732-010D-4c0d-854B-A39FB60DE48C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9103B26C-8D21-473d-9CAD-C204E523D9AF}.exeC:\Windows\{9103B26C-8D21-473d-9CAD-C204E523D9AF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7BE44897-F615-4129-862E-2621831E8AB2}.exeC:\Windows\{7BE44897-F615-4129-862E-2621831E8AB2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{245D7BF1-285F-4742-B1A7-7D56EBC6B2E6}.exeC:\Windows\{245D7BF1-285F-4742-B1A7-7D56EBC6B2E6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8D4C642A-5902-42be-8254-9735D71F6027}.exeC:\Windows\{8D4C642A-5902-42be-8254-9735D71F6027}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FCB29607-6725-44b2-A0E9-745F750ABAE1}.exeC:\Windows\{FCB29607-6725-44b2-A0E9-745F750ABAE1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FCBE67CE-F791-4514-8E5A-F7A5A3F39F3F}.exeC:\Windows\{FCBE67CE-F791-4514-8E5A-F7A5A3F39F3F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{363FBEB8-F308-449f-BCDF-91F58066C334}.exeC:\Windows\{363FBEB8-F308-449f-BCDF-91F58066C334}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D6D4E14-276E-4ac0-9A20-B283187A872C}.exeC:\Windows\{5D6D4E14-276E-4ac0-9A20-B283187A872C}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{363FB~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FCBE6~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FCB29~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D4C6~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{245D7~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7BE44~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9103B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77782~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7FFF~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{245D7BF1-285F-4742-B1A7-7D56EBC6B2E6}.exe
{363FBEB8-F308-449f-BCDF-91F58066C334}.exe
{5D6D4E14-276E-4ac0-9A20-B283187A872C}.exe
{77782732-010D-4c0d-854B-A39FB60DE48C}.exe
{7BE44897-F615-4129-862E-2621831E8AB2}.exe
{8D4C642A-5902-42be-8254-9735D71F6027}.exe
{9103B26C-8D21-473d-9CAD-C204E523D9AF}.exe
{B7FFFF12-2ECC-44c0-AA02-3AA0AB4A1C7B}.exe
{FCB29607-6725-44b2-A0E9-745F750ABAE1}.exe
{FCBE67CE-F791-4514-8E5A-F7A5A3F39F3F}.exe
memory/1216-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1216-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2056-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2056-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2412-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2412-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5408-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5408-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5408-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5544-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5544-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5544-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5836-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5836-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5920-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6196-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6196-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6616-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6616-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6732-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6732-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6796-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6796-20-0x0000000000400000-0x0000000000410000-memory.dmp