Analysis
- max time kernel
148s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 17:06
General
- Target 2026-07-08_b28ba54e419f85b58b1c1c8173477c16_elex_wannacry.exe
- Size 90KB
- Sample260708-vmkl1aes9v
- SHA256 6c9490635a8c8ff68e1833c0e052336495447b122d33bdae80a4761af8aaefce
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 16 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 5 IoCs
- Drops file in Windows directory 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_b28ba54e419f85b58b1c1c8173477c16_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_b28ba54e419f85b58b1c1c8173477c16_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27CE337F-23A0-4983-92C6-B251EFBCD130}.exeC:\Windows\{27CE337F-23A0-4983-92C6-B251EFBCD130}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1C10882-88EF-4ebc-8F1B-9669005482D8}.exeC:\Windows\{A1C10882-88EF-4ebc-8F1B-9669005482D8}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85264876-A28A-42a0-B01A-2033856174C0}.exeC:\Windows\{85264876-A28A-42a0-B01A-2033856174C0}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{669B0FC4-CD6B-4b95-B5D1-1DD9777C468E}.exeC:\Windows\{669B0FC4-CD6B-4b95-B5D1-1DD9777C468E}.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85264~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1C10~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27CE3~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{669B0FC4-CD6B-4b95-B5D1-1DD9777C468E}.exe"C:\Windows\{669B0FC4-CD6B-4b95-B5D1-1DD9777C468E}.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{27CE337F-23A0-4983-92C6-B251EFBCD130}.exe
{669B0FC4-CD6B-4b95-B5D1-1DD9777C468E}.exe
{85264876-A28A-42a0-B01A-2033856174C0}.exe
{A1C10882-88EF-4ebc-8F1B-9669005482D8}.exe
memory/2644-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2644-9-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2644-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3532-23-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3532-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3812-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3812-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3812-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5408-30-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5652-15-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5652-17-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5652-22-0x0000000000400000-0x0000000000411000-memory.dmp