Overview

overview

10

Static

static

10

2026-07-11...ry.exe

windows10-2004-x64

10

2026-07-11...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    112s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 15:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_a7967aea7c983581759557e29dcb5a32_elex_wannacry.exe
  • Size 72KB
  • Sample260711-s2phdsd15j
  • SHA256 717004d0ee142ade2def3ec5993d8af0e3b2f576c65ba1718636f4b629935a85
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverystormserpersistenceupxworm

Malware Config

Signatures

  • Family: Stormser, StormDDoS, StormAttack, Stormer

    Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.

    wormstormser
  • Detects Stormser aka Storm DDoS and StormAttack 45 IoCs
  • UPX dump on OEP (original entry point) 45 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 11 IoCs
  • UPX packed file 45 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_a7967aea7c983581759557e29dcb5a32_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_a7967aea7c983581759557e29dcb5a32_elex_wannacry.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5216
    • C:\Windows\{008DB665-B5B8-41e2-9D51-8E66C4FFAE09}.exe
      C:\Windows\{008DB665-B5B8-41e2-9D51-8E66C4FFAE09}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\{0ED011D6-6A85-424a-9767-2867E61443C3}.exe
        C:\Windows\{0ED011D6-6A85-424a-9767-2867E61443C3}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3140
        • C:\Windows\{4F0B74B5-CC74-4a6b-BFD9-0D31F971D4FC}.exe
          C:\Windows\{4F0B74B5-CC74-4a6b-BFD9-0D31F971D4FC}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:6048
          • C:\Windows\{A79AA6D6-4D24-4132-AEDE-AACB2D1C8C70}.exe
            C:\Windows\{A79AA6D6-4D24-4132-AEDE-AACB2D1C8C70}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:52
            • C:\Windows\{41730DA2-3A1B-481d-9554-BDD598445160}.exe
              C:\Windows\{41730DA2-3A1B-481d-9554-BDD598445160}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1864
              • C:\Windows\{5ED70CD1-FAB4-45e8-8E4D-2C87EDA51D0A}.exe
                C:\Windows\{5ED70CD1-FAB4-45e8-8E4D-2C87EDA51D0A}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2548
                • C:\Windows\{E11274ED-8298-4e84-8231-97101E8BD190}.exe
                  C:\Windows\{E11274ED-8298-4e84-8231-97101E8BD190}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:5424
                  • C:\Windows\{39C2220A-0086-4089-96B0-415F73244FAB}.exe
                    C:\Windows\{39C2220A-0086-4089-96B0-415F73244FAB}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:5072
                    • C:\Windows\{82AB3A9F-6E15-4925-9EDE-6403953808FA}.exe
                      C:\Windows\{82AB3A9F-6E15-4925-9EDE-6403953808FA}.exe
                      10⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4764
                      • C:\Windows\{A70B96C7-1B98-4c0f-8EF7-748AFA5AAC9B}.exe
                        C:\Windows\{A70B96C7-1B98-4c0f-8EF7-748AFA5AAC9B}.exe
                        11⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1580
                        • C:\Windows\{D19B693E-ECBF-46aa-8DF3-12664F9A9C41}.exe
                          C:\Windows\{D19B693E-ECBF-46aa-8DF3-12664F9A9C41}.exe
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:796
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{A70B9~1.EXE > nul
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:556
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{82AB3~1.EXE > nul
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:1428
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{39C22~1.EXE > nul
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:4288
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{E1127~1.EXE > nul
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:716
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{5ED70~1.EXE > nul
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1460
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{41730~1.EXE > nul
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3840
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{A79AA~1.EXE > nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3340
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{4F0B7~1.EXE > nul
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2308
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{0ED01~1.EXE > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:616
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{008DB~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1948
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3212

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        {008DB665-B5B8-41e2-9D51-8E66C4FFAE09}.exe
        • Path C:\Windows\{008DB665-B5B8-41e2-9D51-8E66C4FFAE09}.exe
        • Size 72KB
        • SHA256 7656b1243748a94b4d7ffb50358aba1eef18f2747af4a32f6249b7f4f87fe5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {0ED011D6-6A85-424a-9767-2867E61443C3}.exe
        • Path C:\Windows\{0ED011D6-6A85-424a-9767-2867E61443C3}.exe
        • Size 72KB
        • SHA256 175e1771ed2a508a039620a1c06fe60e8f7cf842f358667e0d92c17f9bf227ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {39C2220A-0086-4089-96B0-415F73244FAB}.exe
        • Path C:\Windows\{39C2220A-0086-4089-96B0-415F73244FAB}.exe
        • Size 72KB
        • SHA256 aaddf78a9b44203c185f1eb55ab1fc5920837972896f15debe3e1ef2ae9965b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {41730DA2-3A1B-481d-9554-BDD598445160}.exe
        • Path C:\Windows\{41730DA2-3A1B-481d-9554-BDD598445160}.exe
        • Size 72KB
        • SHA256 290ed87bb6748ba725100af2a3f6284e2a8092243266a7f78d11b70562c3ada5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {4F0B74B5-CC74-4a6b-BFD9-0D31F971D4FC}.exe
        • Path C:\Windows\{4F0B74B5-CC74-4a6b-BFD9-0D31F971D4FC}.exe
        • Size 72KB
        • SHA256 dac8047aa3ce445d75f12733f21884516cb70c14f61b29e408d955403fbc7c51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {5ED70CD1-FAB4-45e8-8E4D-2C87EDA51D0A}.exe
        • Path C:\Windows\{5ED70CD1-FAB4-45e8-8E4D-2C87EDA51D0A}.exe
        • Size 72KB
        • SHA256 8f7a80eea95b08560819a51791f571a85291c00294fe8dbe4bfe173ee71b5cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {82AB3A9F-6E15-4925-9EDE-6403953808FA}.exe
        • Path C:\Windows\{82AB3A9F-6E15-4925-9EDE-6403953808FA}.exe
        • Size 72KB
        • SHA256 74b15a324928911825350172216b82a6ea8abfd93e40cbf47b0e30306cc3b586
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {A70B96C7-1B98-4c0f-8EF7-748AFA5AAC9B}.exe
        • Path C:\Windows\{A70B96C7-1B98-4c0f-8EF7-748AFA5AAC9B}.exe
        • Size 72KB
        • SHA256 aca006972c34b23702675547b4f03799b86e4c645ec9b483333d33cd4b613fc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {A79AA6D6-4D24-4132-AEDE-AACB2D1C8C70}.exe
        • Path C:\Windows\{A79AA6D6-4D24-4132-AEDE-AACB2D1C8C70}.exe
        • Size 72KB
        • SHA256 98b7610d217f88566421ef8f2dfe3ed82a738d4156ebec3641a65711537ebf25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {D19B693E-ECBF-46aa-8DF3-12664F9A9C41}.exe
        • Path C:\Windows\{D19B693E-ECBF-46aa-8DF3-12664F9A9C41}.exe
        • Size 72KB
        • SHA256 bada4aff89a260826d607bcb28a5bcc8117d091144c8b8f161390151a0c4dbf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {E11274ED-8298-4e84-8231-97101E8BD190}.exe
        • Path C:\Windows\{E11274ED-8298-4e84-8231-97101E8BD190}.exe
        • Size 72KB
        • SHA256 f19eb88c1da56efc865ebabb2ad6d6d435330e1ffbfdc69ca07a4f2a88e43bcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/52-31-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/52-33-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/52-37-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/796-87-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1580-85-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1580-81-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1580-79-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1864-41-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1864-45-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1864-39-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2548-47-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2548-49-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2548-54-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3140-21-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3140-14-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3140-17-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4540-6-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4540-9-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4540-15-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4764-73-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4764-71-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4764-77-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5072-65-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5072-69-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5072-63-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5216-0-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5216-7-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5216-1-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5424-61-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5424-57-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5424-55-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/6048-25-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/6048-23-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/6048-29-0x0000000000400000-0x0000000000413000-memory.dmp
        Download