Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 13:10
General
- Target 2026-07-11_6e761aa2c2666bad451006f86331d077_elex_wannacry.exe
- Size 98KB
- Sample260711-qevpsabv2n
- SHA256 55bb32eaa25ba8281e673cf419116139a96721465daa0db823a3bd3e53a8ba94
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_6e761aa2c2666bad451006f86331d077_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_6e761aa2c2666bad451006f86331d077_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{40FC1A9A-6792-4f95-A1C2-0E999197EA10}.exeC:\Windows\{40FC1A9A-6792-4f95-A1C2-0E999197EA10}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5AA3F877-23E8-4299-970D-A9CB1858A1B0}.exeC:\Windows\{5AA3F877-23E8-4299-970D-A9CB1858A1B0}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A483851-65D0-429e-924B-A5A32A3624B8}.exeC:\Windows\{5A483851-65D0-429e-924B-A5A32A3624B8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E38D1EE1-BFA3-4cc6-B9C1-8320C50AC0F8}.exeC:\Windows\{E38D1EE1-BFA3-4cc6-B9C1-8320C50AC0F8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B8F18F9-3F30-4fa3-B7F9-2B4DBF2647AC}.exeC:\Windows\{6B8F18F9-3F30-4fa3-B7F9-2B4DBF2647AC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{708CA9B1-E79E-436d-A784-B56288BFBAA4}.exeC:\Windows\{708CA9B1-E79E-436d-A784-B56288BFBAA4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6325151F-6F2B-4cf6-BD76-02E60FAC0798}.exeC:\Windows\{6325151F-6F2B-4cf6-BD76-02E60FAC0798}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{38024774-34C2-433a-89F7-C7A71BBA3ECF}.exeC:\Windows\{38024774-34C2-433a-89F7-C7A71BBA3ECF}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4AF0E4C4-86B7-4401-86DE-7A2C2BBF2599}.exeC:\Windows\{4AF0E4C4-86B7-4401-86DE-7A2C2BBF2599}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A283F3E-1B4A-43b7-824F-D35780CE0CEE}.exeC:\Windows\{8A283F3E-1B4A-43b7-824F-D35780CE0CEE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27937A3D-0581-468d-B4A8-6F920330BCD2}.exeC:\Windows\{27937A3D-0581-468d-B4A8-6F920330BCD2}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A283~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4AF0E~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38024~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63251~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{708CA~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B8F1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E38D1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A483~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5AA3F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40FC1~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{27937A3D-0581-468d-B4A8-6F920330BCD2}.exe
{38024774-34C2-433a-89F7-C7A71BBA3ECF}.exe
{40FC1A9A-6792-4f95-A1C2-0E999197EA10}.exe
{4AF0E4C4-86B7-4401-86DE-7A2C2BBF2599}.exe
{5A483851-65D0-429e-924B-A5A32A3624B8}.exe
{5AA3F877-23E8-4299-970D-A9CB1858A1B0}.exe
{6325151F-6F2B-4cf6-BD76-02E60FAC0798}.exe
{6B8F18F9-3F30-4fa3-B7F9-2B4DBF2647AC}.exe
{708CA9B1-E79E-436d-A784-B56288BFBAA4}.exe
{8A283F3E-1B4A-43b7-824F-D35780CE0CEE}.exe
{E38D1EE1-BFA3-4cc6-B9C1-8320C50AC0F8}.exe
memory/1172-62-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1172-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2012-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2012-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2012-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2272-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2272-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3140-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3140-15-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4424-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4424-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4932-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4932-9-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4932-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5128-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5432-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5432-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5504-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5504-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5772-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5772-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5892-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5892-43-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5932-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5932-36-0x0000000000400000-0x0000000000411000-memory.dmp