Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 16:41
General
- Target 2026-07-08_dc15b96e0db383c0ce4dd71fc4f968b5_elex_wannacry.exe
- Size 64KB
- Sample260708-t7capady6t
- SHA256 e07d324c636cb84ab68d133d168beb5b7e807c2f5c6bd42c4d234a2755056e12
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_dc15b96e0db383c0ce4dd71fc4f968b5_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_dc15b96e0db383c0ce4dd71fc4f968b5_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{336B30A2-8879-43de-BE56-B5E5B912BE7E}.exeC:\Windows\{336B30A2-8879-43de-BE56-B5E5B912BE7E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A23C106-23F8-4af4-BE09-6C6FF509F2BC}.exeC:\Windows\{3A23C106-23F8-4af4-BE09-6C6FF509F2BC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31BC318C-5E80-46f4-A092-B27591603379}.exeC:\Windows\{31BC318C-5E80-46f4-A092-B27591603379}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE486C2C-8ADC-4f5e-A417-E07D22756B19}.exeC:\Windows\{BE486C2C-8ADC-4f5e-A417-E07D22756B19}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B3B0C81-9482-439b-99F4-0C419242BBF4}.exeC:\Windows\{4B3B0C81-9482-439b-99F4-0C419242BBF4}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DAD4CF0B-96AD-4968-8916-248033271D81}.exeC:\Windows\{DAD4CF0B-96AD-4968-8916-248033271D81}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75D42FC1-3B2E-4d01-B05A-DCFA99397747}.exeC:\Windows\{75D42FC1-3B2E-4d01-B05A-DCFA99397747}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3542B76-7FCA-4027-8AA5-3B502ED83DC1}.exeC:\Windows\{A3542B76-7FCA-4027-8AA5-3B502ED83DC1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10CEB7A2-6CAD-4d7d-ABB1-276389FF6CD0}.exeC:\Windows\{10CEB7A2-6CAD-4d7d-ABB1-276389FF6CD0}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C1E1653-7038-49fe-932D-60F717FF2B07}.exeC:\Windows\{8C1E1653-7038-49fe-932D-60F717FF2B07}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{374132EF-5405-41ff-9BB3-6C6919142B8F}.exeC:\Windows\{374132EF-5405-41ff-9BB3-6C6919142B8F}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C1E1~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10CEB~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3542~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75D42~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAD4C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B3B0~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE486~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31BC3~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A23C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{336B3~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{10CEB7A2-6CAD-4d7d-ABB1-276389FF6CD0}.exe
{31BC318C-5E80-46f4-A092-B27591603379}.exe
{336B30A2-8879-43de-BE56-B5E5B912BE7E}.exe
{374132EF-5405-41ff-9BB3-6C6919142B8F}.exe
{3A23C106-23F8-4af4-BE09-6C6FF509F2BC}.exe
{4B3B0C81-9482-439b-99F4-0C419242BBF4}.exe
{75D42FC1-3B2E-4d01-B05A-DCFA99397747}.exe
{8C1E1653-7038-49fe-932D-60F717FF2B07}.exe
{A3542B76-7FCA-4027-8AA5-3B502ED83DC1}.exe
{BE486C2C-8ADC-4f5e-A417-E07D22756B19}.exe
{DAD4CF0B-96AD-4968-8916-248033271D81}.exe