Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/07/2026, 16:28
General
- Target 2026-07-09_cb10682763c8c78f46222b55c87fd1b6_elex_wannacry.exe
- Size 90KB
- Sample260709-ty322sdv7l
- SHA256 3829120e061590409bec4ef977c317018511ecd8c8da5775cf87193516acd247
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_cb10682763c8c78f46222b55c87fd1b6_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_cb10682763c8c78f46222b55c87fd1b6_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75171BCE-2872-48ee-99C5-2BBE79539C28}.exeC:\Windows\{75171BCE-2872-48ee-99C5-2BBE79539C28}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C75A25BC-0360-4541-93AD-DBC50110DA67}.exeC:\Windows\{C75A25BC-0360-4541-93AD-DBC50110DA67}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DEC679DF-60CF-4d40-A8E1-60D24E31A8E8}.exeC:\Windows\{DEC679DF-60CF-4d40-A8E1-60D24E31A8E8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE38D3F3-6C21-4ee2-8396-E2E6AB9D6E45}.exeC:\Windows\{EE38D3F3-6C21-4ee2-8396-E2E6AB9D6E45}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85198039-8514-4094-928E-880F61CE4BEF}.exeC:\Windows\{85198039-8514-4094-928E-880F61CE4BEF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{856525E8-9F82-4652-AD7F-A414ED02C414}.exeC:\Windows\{856525E8-9F82-4652-AD7F-A414ED02C414}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B752CDD-62F1-4a4f-BFEF-BAE527C27FCC}.exeC:\Windows\{5B752CDD-62F1-4a4f-BFEF-BAE527C27FCC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6CA70AB7-9CDF-4398-A1F2-1419537AC9AD}.exeC:\Windows\{6CA70AB7-9CDF-4398-A1F2-1419537AC9AD}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB68116D-AC43-4968-BB53-45DD2E0758CD}.exeC:\Windows\{AB68116D-AC43-4968-BB53-45DD2E0758CD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0BA83BA-BCCC-4d92-99DB-7012B102880A}.exeC:\Windows\{D0BA83BA-BCCC-4d92-99DB-7012B102880A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A6EFEE8-8C60-484d-80CD-B68BB704B6BE}.exeC:\Windows\{8A6EFEE8-8C60-484d-80CD-B68BB704B6BE}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0BA8~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB681~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6CA70~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B752~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85652~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85198~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE38D~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEC67~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C75A2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75171~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{5B752CDD-62F1-4a4f-BFEF-BAE527C27FCC}.exe
{6CA70AB7-9CDF-4398-A1F2-1419537AC9AD}.exe
{75171BCE-2872-48ee-99C5-2BBE79539C28}.exe
{85198039-8514-4094-928E-880F61CE4BEF}.exe
{856525E8-9F82-4652-AD7F-A414ED02C414}.exe
{8A6EFEE8-8C60-484d-80CD-B68BB704B6BE}.exe
{AB68116D-AC43-4968-BB53-45DD2E0758CD}.exe
{C75A25BC-0360-4541-93AD-DBC50110DA67}.exe
{D0BA83BA-BCCC-4d92-99DB-7012B102880A}.exe
{DEC679DF-60CF-4d40-A8E1-60D24E31A8E8}.exe
{EE38D3F3-6C21-4ee2-8396-E2E6AB9D6E45}.exe