Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
06/07/2026, 18:31
General
- Target 2026-07-06_01fa86a653050a9874ed3072afd19f6f_elex_wannacry.exe
- Size 98KB
- Sample260706-w6c7psby21
- SHA256 5fce9acb666ad84c47fc8df398b1ea1ed58168c307c7055f2643274b44fa7ca7
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_01fa86a653050a9874ed3072afd19f6f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_01fa86a653050a9874ed3072afd19f6f_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9462DF41-58BF-4f16-A4F8-417D0E3FB753}.exeC:\Windows\{9462DF41-58BF-4f16-A4F8-417D0E3FB753}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{25617367-1592-4cef-BF0F-5F1F56799258}.exeC:\Windows\{25617367-1592-4cef-BF0F-5F1F56799258}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2D991FE-942F-41df-84F2-1EBC1EE59579}.exeC:\Windows\{C2D991FE-942F-41df-84F2-1EBC1EE59579}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6367EC33-A2DA-46ee-ACC0-964801065B20}.exeC:\Windows\{6367EC33-A2DA-46ee-ACC0-964801065B20}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A918D454-AD4D-4bde-9354-67EA71B7D9E3}.exeC:\Windows\{A918D454-AD4D-4bde-9354-67EA71B7D9E3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3FBE0E29-191A-43d4-9E05-2B16C9EEFBE4}.exeC:\Windows\{3FBE0E29-191A-43d4-9E05-2B16C9EEFBE4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D55D0C7D-130B-4112-9381-9F06A5BFA0E4}.exeC:\Windows\{D55D0C7D-130B-4112-9381-9F06A5BFA0E4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC487085-2A5D-46c2-9A45-1C1C71835DC2}.exeC:\Windows\{EC487085-2A5D-46c2-9A45-1C1C71835DC2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91B798F6-E0D9-4016-B6DD-1EFB21953349}.exeC:\Windows\{91B798F6-E0D9-4016-B6DD-1EFB21953349}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1EB9BFE7-6429-42e3-87E3-38E8F5DACE03}.exeC:\Windows\{1EB9BFE7-6429-42e3-87E3-38E8F5DACE03}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EFDD1F67-C046-415b-B053-A393083700B4}.exeC:\Windows\{EFDD1F67-C046-415b-B053-A393083700B4}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1EB9B~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91B79~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC487~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D55D0~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3FBE0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A918D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6367E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2D99~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25617~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9462D~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1EB9BFE7-6429-42e3-87E3-38E8F5DACE03}.exe
{25617367-1592-4cef-BF0F-5F1F56799258}.exe
{3FBE0E29-191A-43d4-9E05-2B16C9EEFBE4}.exe
{6367EC33-A2DA-46ee-ACC0-964801065B20}.exe
{91B798F6-E0D9-4016-B6DD-1EFB21953349}.exe
{9462DF41-58BF-4f16-A4F8-417D0E3FB753}.exe
{A918D454-AD4D-4bde-9354-67EA71B7D9E3}.exe
{C2D991FE-942F-41df-84F2-1EBC1EE59579}.exe
{D55D0C7D-130B-4112-9381-9F06A5BFA0E4}.exe
{EC487085-2A5D-46c2-9A45-1C1C71835DC2}.exe
{EFDD1F67-C046-415b-B053-A393083700B4}.exe
memory/416-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/628-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/628-33-0x0000000000400000-0x0000000000411000-memory.dmp
memory/712-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/712-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2536-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2536-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2616-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2616-51-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2616-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4132-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4132-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4304-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4304-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4304-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4748-62-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4748-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5144-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5144-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5644-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5644-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5940-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5940-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6108-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/6108-21-0x0000000000400000-0x0000000000411000-memory.dmp