Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 16:19
General
- Target 2026-07-05_213c59fb7d71103810488e6c573c367b_elex_wannacry.exe
- Size 76KB
- Sample260705-tshtxsdz2x
- SHA256 3acb4815ff55d06e19cb7e38a757372c83d9f164c118b986f4f6f45f368bcaa7
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_213c59fb7d71103810488e6c573c367b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_213c59fb7d71103810488e6c573c367b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0221180F-1620-4677-AA63-D8AEFC1E076E}.exeC:\Windows\{0221180F-1620-4677-AA63-D8AEFC1E076E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B33F73A-24E6-4942-A489-0F15C3BC6CF5}.exeC:\Windows\{3B33F73A-24E6-4942-A489-0F15C3BC6CF5}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{716C1035-6DDF-4ec1-ACA4-5F6020958923}.exeC:\Windows\{716C1035-6DDF-4ec1-ACA4-5F6020958923}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B2C3589-0809-4d65-9F12-72826AAD9E97}.exeC:\Windows\{0B2C3589-0809-4d65-9F12-72826AAD9E97}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE743C1E-7C97-44ee-975F-31669F6BBBD8}.exeC:\Windows\{CE743C1E-7C97-44ee-975F-31669F6BBBD8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCF4FD5C-52F8-4d63-809F-5E55A0861F94}.exeC:\Windows\{CCF4FD5C-52F8-4d63-809F-5E55A0861F94}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B56B251-D94B-41d7-A579-D68AEEEBE7D1}.exeC:\Windows\{1B56B251-D94B-41d7-A579-D68AEEEBE7D1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{553E5BA1-2BCC-4edd-BE0D-11D39CB2D900}.exeC:\Windows\{553E5BA1-2BCC-4edd-BE0D-11D39CB2D900}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99FA35B5-9B05-4a7f-9130-5EBD3302A7A8}.exeC:\Windows\{99FA35B5-9B05-4a7f-9130-5EBD3302A7A8}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D9A3F47-A622-493a-88FF-7D479B2E73EA}.exeC:\Windows\{3D9A3F47-A622-493a-88FF-7D479B2E73EA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CF8472E3-9891-466b-AF62-999407B5511F}.exeC:\Windows\{CF8472E3-9891-466b-AF62-999407B5511F}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D9A3~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99FA3~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{553E5~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B56B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCF4F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE743~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B2C3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{716C1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B33F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02211~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0221180F-1620-4677-AA63-D8AEFC1E076E}.exe
{0B2C3589-0809-4d65-9F12-72826AAD9E97}.exe
{1B56B251-D94B-41d7-A579-D68AEEEBE7D1}.exe
{3B33F73A-24E6-4942-A489-0F15C3BC6CF5}.exe
{3D9A3F47-A622-493a-88FF-7D479B2E73EA}.exe
{553E5BA1-2BCC-4edd-BE0D-11D39CB2D900}.exe
{716C1035-6DDF-4ec1-ACA4-5F6020958923}.exe
{99FA35B5-9B05-4a7f-9130-5EBD3302A7A8}.exe
{CCF4FD5C-52F8-4d63-809F-5E55A0861F94}.exe
{CE743C1E-7C97-44ee-975F-31669F6BBBD8}.exe
{CF8472E3-9891-466b-AF62-999407B5511F}.exe