Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 19:39
General
- Target 2026-07-04_1445a1d80ef65abcfbcd88aabad7a60b_elex_wannacry.exe
- Size 60KB
- Sample260704-ydf41agy6j
- SHA256 f73debdd870aca0dd606da40a1730feaec588be2054636d2d2f2e74b2aac95eb
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_1445a1d80ef65abcfbcd88aabad7a60b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_1445a1d80ef65abcfbcd88aabad7a60b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3952807C-2E63-4f5c-BA22-E2DD52152AFA}.exeC:\Windows\{3952807C-2E63-4f5c-BA22-E2DD52152AFA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05BDBE1F-D199-4309-945B-801698BB94A8}.exeC:\Windows\{05BDBE1F-D199-4309-945B-801698BB94A8}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{920A1D8E-F953-4a3e-B522-0A70D1C2CCAF}.exeC:\Windows\{920A1D8E-F953-4a3e-B522-0A70D1C2CCAF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{59B5FE4E-BF5D-4bbd-AF9A-307E5D130BD7}.exeC:\Windows\{59B5FE4E-BF5D-4bbd-AF9A-307E5D130BD7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6550C8FF-3922-402c-B855-DA0B5D8E9B9D}.exeC:\Windows\{6550C8FF-3922-402c-B855-DA0B5D8E9B9D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4200AACA-F9A5-4240-A329-DD435F43011C}.exeC:\Windows\{4200AACA-F9A5-4240-A329-DD435F43011C}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77BBD0C0-D28F-42a7-823C-D06D163A687D}.exeC:\Windows\{77BBD0C0-D28F-42a7-823C-D06D163A687D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{169C5376-ADDA-47c6-BDC3-8BB5CEA4F9CE}.exeC:\Windows\{169C5376-ADDA-47c6-BDC3-8BB5CEA4F9CE}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{693A580E-4AF4-48b9-9AD5-3E6E073A3446}.exeC:\Windows\{693A580E-4AF4-48b9-9AD5-3E6E073A3446}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31340A5C-D585-4d96-8081-2E51C1A2D576}.exeC:\Windows\{31340A5C-D585-4d96-8081-2E51C1A2D576}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13BF1D7A-61BB-4ea1-873E-3F7624064DED}.exeC:\Windows\{13BF1D7A-61BB-4ea1-873E-3F7624064DED}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31340~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{693A5~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{169C5~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77BBD~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4200A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6550C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59B5F~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{920A1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05BDB~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39528~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{05BDBE1F-D199-4309-945B-801698BB94A8}.exe
{13BF1D7A-61BB-4ea1-873E-3F7624064DED}.exe
{169C5376-ADDA-47c6-BDC3-8BB5CEA4F9CE}.exe
{31340A5C-D585-4d96-8081-2E51C1A2D576}.exe
{3952807C-2E63-4f5c-BA22-E2DD52152AFA}.exe
{4200AACA-F9A5-4240-A329-DD435F43011C}.exe
{59B5FE4E-BF5D-4bbd-AF9A-307E5D130BD7}.exe
{6550C8FF-3922-402c-B855-DA0B5D8E9B9D}.exe
{693A580E-4AF4-48b9-9AD5-3E6E073A3446}.exe
{77BBD0C0-D28F-42a7-823C-D06D163A687D}.exe
{920A1D8E-F953-4a3e-B522-0A70D1C2CCAF}.exe