Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 00:52
General
- Target 2026-07-10_81a891d8a3413bb9bb4cb146324545e3_elex_wannacry.exe
- Size 59KB
- Sample260711-a72e2ab18v
- SHA256 8a6002b346ae8b9a2a4d7d319afac582101a7d73d79b80b4f0fb9f87b392f198
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_81a891d8a3413bb9bb4cb146324545e3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_81a891d8a3413bb9bb4cb146324545e3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8469A745-D5CD-4eb8-B38C-6CEC7DA93D87}.exeC:\Windows\{8469A745-D5CD-4eb8-B38C-6CEC7DA93D87}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94B4A5E3-AA26-4533-95D0-03278CEE9D15}.exeC:\Windows\{94B4A5E3-AA26-4533-95D0-03278CEE9D15}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3DAC045A-CDF2-473b-90E9-9F94889C2811}.exeC:\Windows\{3DAC045A-CDF2-473b-90E9-9F94889C2811}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F96C6A4-192D-424e-B9CE-513596984A19}.exeC:\Windows\{7F96C6A4-192D-424e-B9CE-513596984A19}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{88B1646D-485F-4e6c-93D2-7226690F2364}.exeC:\Windows\{88B1646D-485F-4e6c-93D2-7226690F2364}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A08DD2B-0DAE-4ca4-8173-F5130C090601}.exeC:\Windows\{8A08DD2B-0DAE-4ca4-8173-F5130C090601}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50C1249A-161D-4da1-A64D-43E8B0BB0400}.exeC:\Windows\{50C1249A-161D-4da1-A64D-43E8B0BB0400}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05139FAB-A918-4a55-9970-EA59318E8EB5}.exeC:\Windows\{05139FAB-A918-4a55-9970-EA59318E8EB5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A9256009-9427-4b56-A6B6-8AD2E584E675}.exeC:\Windows\{A9256009-9427-4b56-A6B6-8AD2E584E675}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FAB600A5-9867-4fd1-9317-A23B57A38940}.exeC:\Windows\{FAB600A5-9867-4fd1-9317-A23B57A38940}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C0A9ACB3-1A53-40cb-84E6-0DB03EA58A92}.exeC:\Windows\{C0A9ACB3-1A53-40cb-84E6-0DB03EA58A92}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FAB60~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9256~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05139~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50C12~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A08D~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88B16~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F96C~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3DAC0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94B4A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8469A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{05139FAB-A918-4a55-9970-EA59318E8EB5}.exe
{3DAC045A-CDF2-473b-90E9-9F94889C2811}.exe
{50C1249A-161D-4da1-A64D-43E8B0BB0400}.exe
{7F96C6A4-192D-424e-B9CE-513596984A19}.exe
{8469A745-D5CD-4eb8-B38C-6CEC7DA93D87}.exe
{88B1646D-485F-4e6c-93D2-7226690F2364}.exe
{8A08DD2B-0DAE-4ca4-8173-F5130C090601}.exe
{94B4A5E3-AA26-4533-95D0-03278CEE9D15}.exe
{A9256009-9427-4b56-A6B6-8AD2E584E675}.exe
{C0A9ACB3-1A53-40cb-84E6-0DB03EA58A92}.exe
{FAB600A5-9867-4fd1-9317-A23B57A38940}.exe