Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
05/07/2026, 16:16
General
- Target 2026-07-05_36a47e76bdc7ec305685ba5063470678_elex_wannacry.exe
- Size 90KB
- Sample260705-tqthmsdy7x
- SHA256 1c0173c10bb412be0e56dca58e0ce2bf339757b43ef4d9e270cbe7d6127b3230
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_36a47e76bdc7ec305685ba5063470678_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_36a47e76bdc7ec305685ba5063470678_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D913AF41-5D70-4910-BDAE-8BB7100A2B7A}.exeC:\Windows\{D913AF41-5D70-4910-BDAE-8BB7100A2B7A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FCC2D927-E741-4520-8088-A2B629D61DBF}.exeC:\Windows\{FCC2D927-E741-4520-8088-A2B629D61DBF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7EC45B4D-236F-48bd-96E6-23910B2B586D}.exeC:\Windows\{7EC45B4D-236F-48bd-96E6-23910B2B586D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F42EDCA-1446-47c6-9839-5474DFC3C4F7}.exeC:\Windows\{6F42EDCA-1446-47c6-9839-5474DFC3C4F7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1BCF8EF2-11FC-4e24-8056-61E86CE1441F}.exeC:\Windows\{1BCF8EF2-11FC-4e24-8056-61E86CE1441F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{38005F28-4CFD-4d1e-8786-BB7D8D6DFE58}.exeC:\Windows\{38005F28-4CFD-4d1e-8786-BB7D8D6DFE58}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{283EA6E0-7D94-44f6-A4CF-005D497BE56D}.exeC:\Windows\{283EA6E0-7D94-44f6-A4CF-005D497BE56D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE9D0637-660F-447e-8744-A3FCD4B1B294}.exeC:\Windows\{BE9D0637-660F-447e-8744-A3FCD4B1B294}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F1D62C1-6CC7-4f13-983D-4F5C0DD14BB4}.exeC:\Windows\{6F1D62C1-6CC7-4f13-983D-4F5C0DD14BB4}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5EAC2019-1C76-4d22-ACD6-8C93000912A6}.exeC:\Windows\{5EAC2019-1C76-4d22-ACD6-8C93000912A6}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F1D6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE9D0~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{283EA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38005~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1BCF8~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F42E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7EC45~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FCC2D~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D913A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1BCF8EF2-11FC-4e24-8056-61E86CE1441F}.exe
{283EA6E0-7D94-44f6-A4CF-005D497BE56D}.exe
{38005F28-4CFD-4d1e-8786-BB7D8D6DFE58}.exe
{5EAC2019-1C76-4d22-ACD6-8C93000912A6}.exe
{6F1D62C1-6CC7-4f13-983D-4F5C0DD14BB4}.exe
{6F42EDCA-1446-47c6-9839-5474DFC3C4F7}.exe
{7EC45B4D-236F-48bd-96E6-23910B2B586D}.exe
{BE9D0637-660F-447e-8744-A3FCD4B1B294}.exe
{D913AF41-5D70-4910-BDAE-8BB7100A2B7A}.exe
{FCC2D927-E741-4520-8088-A2B629D61DBF}.exe