Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/07/2026, 16:41
General
- Target 2026-07-08_dc15b96e0db383c0ce4dd71fc4f968b5_elex_wannacry.exe
- Size 64KB
- Sample260708-t7capady6t
- SHA256 e07d324c636cb84ab68d133d168beb5b7e807c2f5c6bd42c4d234a2755056e12
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_dc15b96e0db383c0ce4dd71fc4f968b5_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_dc15b96e0db383c0ce4dd71fc4f968b5_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8AA6AEF2-AF11-4649-B699-98F5951B3045}.exeC:\Windows\{8AA6AEF2-AF11-4649-B699-98F5951B3045}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1928642F-993C-4cb8-A5F7-B8DA0D55FD22}.exeC:\Windows\{1928642F-993C-4cb8-A5F7-B8DA0D55FD22}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{034D5EE1-AEFD-4e23-9528-5198048BDBAA}.exeC:\Windows\{034D5EE1-AEFD-4e23-9528-5198048BDBAA}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33E0FBA4-6041-4654-92FA-3D31066E41CA}.exeC:\Windows\{33E0FBA4-6041-4654-92FA-3D31066E41CA}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9A8C033-DFF8-4cbe-A600-DAB85F970B96}.exeC:\Windows\{D9A8C033-DFF8-4cbe-A600-DAB85F970B96}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D61A5CCE-A323-43ab-BFAA-E1E31CBE9BCD}.exeC:\Windows\{D61A5CCE-A323-43ab-BFAA-E1E31CBE9BCD}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7EFC00A-87F9-4a42-B336-17646AD413D3}.exeC:\Windows\{F7EFC00A-87F9-4a42-B336-17646AD413D3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC0DC53D-7E16-42c2-AA00-43710D866E2A}.exeC:\Windows\{CC0DC53D-7E16-42c2-AA00-43710D866E2A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D88AB012-A48A-4c03-A835-BAE91C9559A6}.exeC:\Windows\{D88AB012-A48A-4c03-A835-BAE91C9559A6}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86F40261-69CB-4750-AF7E-AAD71D576C91}.exeC:\Windows\{86F40261-69CB-4750-AF7E-AAD71D576C91}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19148FDC-A643-46bd-B5BE-5BD74540A68E}.exeC:\Windows\{19148FDC-A643-46bd-B5BE-5BD74540A68E}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86F40~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D88AB~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC0DC~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7EFC~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D61A5~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9A8C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33E0F~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{034D5~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19286~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AA6A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{034D5EE1-AEFD-4e23-9528-5198048BDBAA}.exe
{19148FDC-A643-46bd-B5BE-5BD74540A68E}.exe
{1928642F-993C-4cb8-A5F7-B8DA0D55FD22}.exe
{33E0FBA4-6041-4654-92FA-3D31066E41CA}.exe
{86F40261-69CB-4750-AF7E-AAD71D576C91}.exe
{8AA6AEF2-AF11-4649-B699-98F5951B3045}.exe
{CC0DC53D-7E16-42c2-AA00-43710D866E2A}.exe
{D61A5CCE-A323-43ab-BFAA-E1E31CBE9BCD}.exe
{D88AB012-A48A-4c03-A835-BAE91C9559A6}.exe
{D9A8C033-DFF8-4cbe-A600-DAB85F970B96}.exe
{F7EFC00A-87F9-4a42-B336-17646AD413D3}.exe