Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/07/2026, 16:34
General
- Target 2026-07-09_bf4797d030a5b63761314f62b08c91c3_elex_wannacry.exe
- Size 60KB
- Sample260709-t3e6saev8x
- SHA256 35bf50d06033942d1d9f1a1b0ae66a3ba69fdd0ac411315e6878dd9dd74eb79b
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_bf4797d030a5b63761314f62b08c91c3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_bf4797d030a5b63761314f62b08c91c3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6D5EEA60-2979-4c85-B8EB-CCD1657D7372}.exeC:\Windows\{6D5EEA60-2979-4c85-B8EB-CCD1657D7372}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9F69D58-8898-4d94-A625-A2A31CBAC220}.exeC:\Windows\{B9F69D58-8898-4d94-A625-A2A31CBAC220}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08C2952A-15B1-40d4-879D-3A99829C7124}.exeC:\Windows\{08C2952A-15B1-40d4-879D-3A99829C7124}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E766A99-EEFE-4199-B982-0BA263D1C820}.exeC:\Windows\{0E766A99-EEFE-4199-B982-0BA263D1C820}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35E5F5CE-9965-4b1a-96ED-6A99A776744D}.exeC:\Windows\{35E5F5CE-9965-4b1a-96ED-6A99A776744D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9EF3C6C-5611-44c2-9156-A5C971ACC204}.exeC:\Windows\{D9EF3C6C-5611-44c2-9156-A5C971ACC204}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0BB7D5E-3F3F-44cc-9B27-297358D8B0FF}.exeC:\Windows\{D0BB7D5E-3F3F-44cc-9B27-297358D8B0FF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{201494AB-523D-4d75-8A40-D23A079A63F6}.exeC:\Windows\{201494AB-523D-4d75-8A40-D23A079A63F6}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBDA9E9C-7D6E-4a85-AB58-B345955ED220}.exeC:\Windows\{BBDA9E9C-7D6E-4a85-AB58-B345955ED220}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A3CD049-701F-417b-B234-79F6FA3C0E84}.exeC:\Windows\{7A3CD049-701F-417b-B234-79F6FA3C0E84}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F3696C2-76F4-4820-A597-746DE138F7A4}.exeC:\Windows\{2F3696C2-76F4-4820-A597-746DE138F7A4}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A3CD~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBDA9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20149~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0BB7~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9EF3~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35E5F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E766~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08C29~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9F69~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D5EE~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{08C2952A-15B1-40d4-879D-3A99829C7124}.exe
{0E766A99-EEFE-4199-B982-0BA263D1C820}.exe
{201494AB-523D-4d75-8A40-D23A079A63F6}.exe
{2F3696C2-76F4-4820-A597-746DE138F7A4}.exe
{35E5F5CE-9965-4b1a-96ED-6A99A776744D}.exe
{6D5EEA60-2979-4c85-B8EB-CCD1657D7372}.exe
{7A3CD049-701F-417b-B234-79F6FA3C0E84}.exe
{B9F69D58-8898-4d94-A625-A2A31CBAC220}.exe
{BBDA9E9C-7D6E-4a85-AB58-B345955ED220}.exe
{D0BB7D5E-3F3F-44cc-9B27-297358D8B0FF}.exe
{D9EF3C6C-5611-44c2-9156-A5C971ACC204}.exe