Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 16:42
General
- Target 2026-07-04_fd85c5f3d3b53e921c534bd853e971e1_elex_wannacry.exe
- Size 59KB
- Sample260704-t7mreshz4v
- SHA256 116eda82bc4a816d67c5dcb70e5fda65f8655d1675bfcc3d99447b495dce0d33
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_fd85c5f3d3b53e921c534bd853e971e1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_fd85c5f3d3b53e921c534bd853e971e1_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26D11E89-1CA0-482e-850C-0D3FD5ECE7C2}.exeC:\Windows\{26D11E89-1CA0-482e-850C-0D3FD5ECE7C2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0D80203-FC27-430e-977C-89DFAEC63D7C}.exeC:\Windows\{D0D80203-FC27-430e-977C-89DFAEC63D7C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8DB78260-E38A-4c19-A5C5-3301ADBED9D3}.exeC:\Windows\{8DB78260-E38A-4c19-A5C5-3301ADBED9D3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7251824-18D0-4ded-A38E-7CB7FE0B35E1}.exeC:\Windows\{F7251824-18D0-4ded-A38E-7CB7FE0B35E1}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7495B05A-089F-44ea-A4CA-DC21DC5C544B}.exeC:\Windows\{7495B05A-089F-44ea-A4CA-DC21DC5C544B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB00E629-829D-4c53-8D44-823EE02D5158}.exeC:\Windows\{AB00E629-829D-4c53-8D44-823EE02D5158}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92B4D669-DC81-424e-807F-03E2F9A47043}.exeC:\Windows\{92B4D669-DC81-424e-807F-03E2F9A47043}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{346E14F1-E204-4fec-A651-7B57F07A8125}.exeC:\Windows\{346E14F1-E204-4fec-A651-7B57F07A8125}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBBD0B56-B2CB-4d87-BC50-7824F8A733DF}.exeC:\Windows\{BBBD0B56-B2CB-4d87-BC50-7824F8A733DF}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D8BD840-541F-4908-82EA-DA34D02D0A33}.exeC:\Windows\{9D8BD840-541F-4908-82EA-DA34D02D0A33}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{907A9DB3-14B0-4cda-A223-F78B03FB8F11}.exeC:\Windows\{907A9DB3-14B0-4cda-A223-F78B03FB8F11}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D8BD~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBBD0~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{346E1~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92B4D~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB00E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7495B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7251~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8DB78~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0D80~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26D11~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{26D11E89-1CA0-482e-850C-0D3FD5ECE7C2}.exe
{346E14F1-E204-4fec-A651-7B57F07A8125}.exe
{7495B05A-089F-44ea-A4CA-DC21DC5C544B}.exe
{8DB78260-E38A-4c19-A5C5-3301ADBED9D3}.exe
{907A9DB3-14B0-4cda-A223-F78B03FB8F11}.exe
{92B4D669-DC81-424e-807F-03E2F9A47043}.exe
{9D8BD840-541F-4908-82EA-DA34D02D0A33}.exe
{AB00E629-829D-4c53-8D44-823EE02D5158}.exe
{BBBD0B56-B2CB-4d87-BC50-7824F8A733DF}.exe
{D0D80203-FC27-430e-977C-89DFAEC63D7C}.exe
{F7251824-18D0-4ded-A38E-7CB7FE0B35E1}.exe