Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 03:52
General
- Target 2026-07-05_374d62067fa7165391bc86eaee13f441_elex_wannacry.exe
- Size 72KB
- Sample260705-efb4aaht6v
- SHA256 3184d5d33417055b755173a566ab700198ecdff1805defc74575b5600c97bf27
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 42 IoCs
- UPX dump on OEP (original entry point) 42 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- UPX packed file 42 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_374d62067fa7165391bc86eaee13f441_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_374d62067fa7165391bc86eaee13f441_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99D675D9-3152-4bb2-AFEF-80D2B2C1A666}.exeC:\Windows\{99D675D9-3152-4bb2-AFEF-80D2B2C1A666}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B9DD62E-BA7A-489b-A84F-1D5B5E3B8DB8}.exeC:\Windows\{3B9DD62E-BA7A-489b-A84F-1D5B5E3B8DB8}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13E17C35-2BFB-4c61-9DFC-86F481A91D38}.exeC:\Windows\{13E17C35-2BFB-4c61-9DFC-86F481A91D38}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AAD26ED7-F662-4645-82C0-83CCB073CD98}.exeC:\Windows\{AAD26ED7-F662-4645-82C0-83CCB073CD98}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4285FE47-6C46-4983-953A-71FF241A243D}.exeC:\Windows\{4285FE47-6C46-4983-953A-71FF241A243D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B4B3592B-4063-4b27-9801-898C035FD7DA}.exeC:\Windows\{B4B3592B-4063-4b27-9801-898C035FD7DA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3EF453ED-594D-428e-A2B8-173084A36EEB}.exeC:\Windows\{3EF453ED-594D-428e-A2B8-173084A36EEB}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C1412DD9-6F08-402f-AD4D-4D8EAFE7A31E}.exeC:\Windows\{C1412DD9-6F08-402f-AD4D-4D8EAFE7A31E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A93F868-047E-441c-9C95-01EC1AF8CCD3}.exeC:\Windows\{4A93F868-047E-441c-9C95-01EC1AF8CCD3}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E092278-A281-46f3-984F-21E5B0E2AC88}.exeC:\Windows\{9E092278-A281-46f3-984F-21E5B0E2AC88}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A93F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1412~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3EF45~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4B35~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4285F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAD26~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13E17~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B9DD~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99D67~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{13E17C35-2BFB-4c61-9DFC-86F481A91D38}.exe
{3B9DD62E-BA7A-489b-A84F-1D5B5E3B8DB8}.exe
{3EF453ED-594D-428e-A2B8-173084A36EEB}.exe
{4285FE47-6C46-4983-953A-71FF241A243D}.exe
{4A93F868-047E-441c-9C95-01EC1AF8CCD3}.exe
{99D675D9-3152-4bb2-AFEF-80D2B2C1A666}.exe
{9E092278-A281-46f3-984F-21E5B0E2AC88}.exe
{AAD26ED7-F662-4645-82C0-83CCB073CD98}.exe
{B4B3592B-4063-4b27-9801-898C035FD7DA}.exe
{C1412DD9-6F08-402f-AD4D-4D8EAFE7A31E}.exe
memory/1908-69-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1908-65-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1908-63-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1956-21-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1956-15-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1956-17-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2544-9-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2544-13-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2544-7-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2696-8-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2696-0-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2696-1-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3232-61-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3232-55-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3232-57-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3504-41-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3504-47-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3504-38-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3876-39-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3876-33-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3876-30-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4120-25-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4120-32-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4120-23-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4292-79-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4292-81-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5432-71-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5432-73-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5432-77-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5760-46-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5760-54-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5760-49-0x0000000000400000-0x0000000000413000-memory.dmp