Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 17:57
General
- Target 2026-07-02_3a30fe4eddeed875d852d6defe876845_elex_wannacry.exe
- Size 64KB
- Sample260702-wjnpxsbt21
- SHA256 b388632e13493ad14de6fda2aa174e27d2cebd0e73c77071302fb516b2a006b3
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Detects Windows executables referencing non-Windows User-Agents 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_3a30fe4eddeed875d852d6defe876845_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_3a30fe4eddeed875d852d6defe876845_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7838331D-56C5-469d-84A1-B8196647DF9D}.exeC:\Windows\{7838331D-56C5-469d-84A1-B8196647DF9D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D1558F6-2AE3-44f2-A925-692D4FE5F0FD}.exeC:\Windows\{2D1558F6-2AE3-44f2-A925-692D4FE5F0FD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C06BD21A-C043-4ce7-8BD9-9EF80841680B}.exeC:\Windows\{C06BD21A-C043-4ce7-8BD9-9EF80841680B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7608FFFE-B26D-4185-A520-F1130DA7D48F}.exeC:\Windows\{7608FFFE-B26D-4185-A520-F1130DA7D48F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{23A1B11A-C0E6-4bd9-B01E-F78DEDAD89A5}.exeC:\Windows\{23A1B11A-C0E6-4bd9-B01E-F78DEDAD89A5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{332A0EE7-7940-4765-9C07-658FB83F54F5}.exeC:\Windows\{332A0EE7-7940-4765-9C07-658FB83F54F5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B1DDBCB6-0636-492a-B3E9-801774784AC5}.exeC:\Windows\{B1DDBCB6-0636-492a-B3E9-801774784AC5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2A2C3355-11CE-44f3-BB19-106107E8AC51}.exeC:\Windows\{2A2C3355-11CE-44f3-BB19-106107E8AC51}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0700426A-EFA8-4636-BBC3-E2AAEEAB7815}.exeC:\Windows\{0700426A-EFA8-4636-BBC3-E2AAEEAB7815}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F28D6EB8-C7A0-47cf-81EF-51EE2BF1708B}.exeC:\Windows\{F28D6EB8-C7A0-47cf-81EF-51EE2BF1708B}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07004~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A2C3~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1DDB~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{332A0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23A1B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7608F~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C06BD~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D155~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78383~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0700426A-EFA8-4636-BBC3-E2AAEEAB7815}.exe
{23A1B11A-C0E6-4bd9-B01E-F78DEDAD89A5}.exe
{2A2C3355-11CE-44f3-BB19-106107E8AC51}.exe
{2D1558F6-2AE3-44f2-A925-692D4FE5F0FD}.exe
{332A0EE7-7940-4765-9C07-658FB83F54F5}.exe
{7608FFFE-B26D-4185-A520-F1130DA7D48F}.exe
{7838331D-56C5-469d-84A1-B8196647DF9D}.exe
{B1DDBCB6-0636-492a-B3E9-801774784AC5}.exe
{C06BD21A-C043-4ce7-8BD9-9EF80841680B}.exe
{F28D6EB8-C7A0-47cf-81EF-51EE2BF1708B}.exe
memory/1124-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1124-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1560-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1868-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1868-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2228-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2228-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2436-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2436-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2740-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2740-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3968-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3968-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3968-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4296-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4296-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4788-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4788-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4788-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5728-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5728-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6004-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6004-36-0x0000000000400000-0x0000000000410000-memory.dmp