Analysis
- max time kernel
148s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 18:03
General
- Target 2026-07-08_49b6006c0e1d194a3c85809a55c8cbe3_elex_wannacry.exe
- Size 72KB
- Sample260708-wneb2sd15q
- SHA256 d9a3d6c1aacc2018c23fba05bafe15507b1e8ef2c6e926d31cbae136e79c9d4b
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 18 IoCs
- UPX dump on OEP (original entry point) 18 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 5 IoCs
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_49b6006c0e1d194a3c85809a55c8cbe3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_49b6006c0e1d194a3c85809a55c8cbe3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E6AAEED-FA29-426e-96C0-165BEB305858}.exeC:\Windows\{5E6AAEED-FA29-426e-96C0-165BEB305858}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83D8F3D1-B741-4c08-B5DE-B9598F90348D}.exeC:\Windows\{83D8F3D1-B741-4c08-B5DE-B9598F90348D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0500B887-D176-4988-8B7B-DFD104DC5228}.exeC:\Windows\{0500B887-D176-4988-8B7B-DFD104DC5228}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C73D9B4-2C7A-41f1-B14B-3CD712722BB2}.exeC:\Windows\{8C73D9B4-2C7A-41f1-B14B-3CD712722BB2}.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0500B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83D8F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E6AA~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C73D9B4-2C7A-41f1-B14B-3CD712722BB2}.exe"C:\Windows\{8C73D9B4-2C7A-41f1-B14B-3CD712722BB2}.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0500B887-D176-4988-8B7B-DFD104DC5228}.exe
{5E6AAEED-FA29-426e-96C0-165BEB305858}.exe
{83D8F3D1-B741-4c08-B5DE-B9598F90348D}.exe
{8C73D9B4-2C7A-41f1-B14B-3CD712722BB2}.exe
memory/1320-1-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1320-8-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1320-0-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3480-21-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3480-16-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3480-17-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4824-23-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4824-25-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4824-29-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5464-14-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5464-9-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5464-6-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5928-31-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5928-34-0x0000000000400000-0x0000000000413000-memory.dmp