Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 17:49
General
- Target 2026-07-07_ae4ae0c95f3004425576cbd6d40654ee_elex_wannacry.exe
- Size 89KB
- Sample260707-wee7zsa161
- SHA256 8cfbf08085ba47d755d0117e1ff7980b1f175b767072a850678a29f7af7c999c
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_ae4ae0c95f3004425576cbd6d40654ee_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_ae4ae0c95f3004425576cbd6d40654ee_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDEC53F6-2121-455b-B950-FAB1739EE039}.exeC:\Windows\{CDEC53F6-2121-455b-B950-FAB1739EE039}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F1F14C4-8F87-4c68-A959-07E3F3CF7F67}.exeC:\Windows\{0F1F14C4-8F87-4c68-A959-07E3F3CF7F67}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B522F336-0171-4050-924F-672206F19564}.exeC:\Windows\{B522F336-0171-4050-924F-672206F19564}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ACAC82E2-410E-4173-9CF0-C2C4E594AE24}.exeC:\Windows\{ACAC82E2-410E-4173-9CF0-C2C4E594AE24}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4683C2EE-2005-455f-ABEB-AD8D91806F31}.exeC:\Windows\{4683C2EE-2005-455f-ABEB-AD8D91806F31}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FDF338FF-D1B3-4a19-AF1B-BAFC7B961E4F}.exeC:\Windows\{FDF338FF-D1B3-4a19-AF1B-BAFC7B961E4F}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C85DDAB2-7F3D-42cb-9148-43B291EE86E7}.exeC:\Windows\{C85DDAB2-7F3D-42cb-9148-43B291EE86E7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A01BBA5-1598-48b3-858F-1821EB038368}.exeC:\Windows\{5A01BBA5-1598-48b3-858F-1821EB038368}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{72F6F3C0-7412-4297-A50A-4969CCADEFAD}.exeC:\Windows\{72F6F3C0-7412-4297-A50A-4969CCADEFAD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28783619-362E-4814-8ED0-52E39D42AA34}.exeC:\Windows\{28783619-362E-4814-8ED0-52E39D42AA34}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78BD4737-A82D-4980-8CD4-F845946F309C}.exeC:\Windows\{78BD4737-A82D-4980-8CD4-F845946F309C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28783~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72F6F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A01B~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C85DD~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FDF33~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4683C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ACAC8~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B522F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F1F1~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDEC5~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0F1F14C4-8F87-4c68-A959-07E3F3CF7F67}.exe
{28783619-362E-4814-8ED0-52E39D42AA34}.exe
{4683C2EE-2005-455f-ABEB-AD8D91806F31}.exe
{5A01BBA5-1598-48b3-858F-1821EB038368}.exe
{72F6F3C0-7412-4297-A50A-4969CCADEFAD}.exe
{78BD4737-A82D-4980-8CD4-F845946F309C}.exe
{ACAC82E2-410E-4173-9CF0-C2C4E594AE24}.exe
{B522F336-0171-4050-924F-672206F19564}.exe
{C85DDAB2-7F3D-42cb-9148-43B291EE86E7}.exe
{CDEC53F6-2121-455b-B950-FAB1739EE039}.exe
{FDF338FF-D1B3-4a19-AF1B-BAFC7B961E4F}.exe