Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 07:29
General
- Target 2026-07-07_93e78444def7fcfed5fdc9e7a424ff61_elex_wannacry.exe
- Size 64KB
- Sample260707-jbee3acv81
- SHA256 36525c6ea60168e8cd42b9c9cf722e3d9982e1f2bade6a617dac487be5811e04
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_93e78444def7fcfed5fdc9e7a424ff61_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_93e78444def7fcfed5fdc9e7a424ff61_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A812E996-E5E0-4562-A79C-50E891143658}.exeC:\Windows\{A812E996-E5E0-4562-A79C-50E891143658}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37C9CFA4-E000-4f34-A525-AFA2674EB760}.exeC:\Windows\{37C9CFA4-E000-4f34-A525-AFA2674EB760}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ADEA8314-DD59-4d7d-B135-8D3F8E0AC4DE}.exeC:\Windows\{ADEA8314-DD59-4d7d-B135-8D3F8E0AC4DE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF048970-BF05-4fcc-A6BE-C7176A8BFC55}.exeC:\Windows\{EF048970-BF05-4fcc-A6BE-C7176A8BFC55}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E3129A09-5179-4339-8591-5E8012F25070}.exeC:\Windows\{E3129A09-5179-4339-8591-5E8012F25070}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1EF10E1B-2143-401f-8FD5-8E59983FD479}.exeC:\Windows\{1EF10E1B-2143-401f-8FD5-8E59983FD479}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5F227ECF-FB32-483e-9179-73769707D5CF}.exeC:\Windows\{5F227ECF-FB32-483e-9179-73769707D5CF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E4C801E-1FB2-4d33-A098-761A0D432787}.exeC:\Windows\{0E4C801E-1FB2-4d33-A098-761A0D432787}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A61ECA60-BF0D-4e9a-A9C9-337E3EB17180}.exeC:\Windows\{A61ECA60-BF0D-4e9a-A9C9-337E3EB17180}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2B899B6-B52B-4ce3-90D7-5FCD5F90A043}.exeC:\Windows\{E2B899B6-B52B-4ce3-90D7-5FCD5F90A043}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56288B83-6036-4948-8A7B-8F9B4C61AE71}.exeC:\Windows\{56288B83-6036-4948-8A7B-8F9B4C61AE71}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2B89~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A61EC~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E4C8~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5F227~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1EF10~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3129~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF048~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ADEA8~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37C9C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A812E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0E4C801E-1FB2-4d33-A098-761A0D432787}.exe
{1EF10E1B-2143-401f-8FD5-8E59983FD479}.exe
{37C9CFA4-E000-4f34-A525-AFA2674EB760}.exe
{56288B83-6036-4948-8A7B-8F9B4C61AE71}.exe
{5F227ECF-FB32-483e-9179-73769707D5CF}.exe
{A61ECA60-BF0D-4e9a-A9C9-337E3EB17180}.exe
{A812E996-E5E0-4562-A79C-50E891143658}.exe
{ADEA8314-DD59-4d7d-B135-8D3F8E0AC4DE}.exe
{E2B899B6-B52B-4ce3-90D7-5FCD5F90A043}.exe
{E3129A09-5179-4339-8591-5E8012F25070}.exe
{EF048970-BF05-4fcc-A6BE-C7176A8BFC55}.exe
memory/1372-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1372-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1984-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1984-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3088-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3088-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3488-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3488-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3792-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3792-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3828-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3828-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3968-75-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3968-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4008-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4008-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4568-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4568-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4780-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4780-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5040-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5536-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5536-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5536-1-0x0000000000400000-0x0000000000410000-memory.dmp