Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 16:41
General
- Target 2026-07-11_3de26f161dd9cfa434724ad472e92e64_elex_wannacry.exe
- Size 89KB
- Sample260711-t7d5aaft2l
- SHA256 3c3b59e28e3ca7dd343d9285709502abf7720fd7654bff5738972df25a6dedab
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_3de26f161dd9cfa434724ad472e92e64_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_3de26f161dd9cfa434724ad472e92e64_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29B66358-5F18-4ecb-87DE-6779D68BC475}.exeC:\Windows\{29B66358-5F18-4ecb-87DE-6779D68BC475}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DAA9221A-864B-4854-B908-747286AF4FE6}.exeC:\Windows\{DAA9221A-864B-4854-B908-747286AF4FE6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{63139DFA-2A10-42d2-BF1F-9EDDCC519F81}.exeC:\Windows\{63139DFA-2A10-42d2-BF1F-9EDDCC519F81}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD10121D-7DED-44f1-B9C6-1FA2587E1B2B}.exeC:\Windows\{AD10121D-7DED-44f1-B9C6-1FA2587E1B2B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4EFD6123-6F35-4b5b-8B56-5D1C957FA386}.exeC:\Windows\{4EFD6123-6F35-4b5b-8B56-5D1C957FA386}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{14BE0431-7A97-4252-9D45-12408DF70A2D}.exeC:\Windows\{14BE0431-7A97-4252-9D45-12408DF70A2D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7DE62AAA-3EB1-4f55-84A6-902616507EC3}.exeC:\Windows\{7DE62AAA-3EB1-4f55-84A6-902616507EC3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE2BA67F-BB4B-4559-81B0-21251033A480}.exeC:\Windows\{AE2BA67F-BB4B-4559-81B0-21251033A480}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E9D18A8-626E-4787-817D-5D04528D9AA7}.exeC:\Windows\{2E9D18A8-626E-4787-817D-5D04528D9AA7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9ED41D96-D1C9-4ff1-8C3F-EDF1DB5E2075}.exeC:\Windows\{9ED41D96-D1C9-4ff1-8C3F-EDF1DB5E2075}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7A44DF0-8148-4705-BF5C-238940F99595}.exeC:\Windows\{E7A44DF0-8148-4705-BF5C-238940F99595}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9ED41~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E9D1~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE2BA~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DE62~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14BE0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4EFD6~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD101~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63139~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAA92~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29B66~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{14BE0431-7A97-4252-9D45-12408DF70A2D}.exe
{29B66358-5F18-4ecb-87DE-6779D68BC475}.exe
{2E9D18A8-626E-4787-817D-5D04528D9AA7}.exe
{4EFD6123-6F35-4b5b-8B56-5D1C957FA386}.exe
{63139DFA-2A10-42d2-BF1F-9EDDCC519F81}.exe
{7DE62AAA-3EB1-4f55-84A6-902616507EC3}.exe
{9ED41D96-D1C9-4ff1-8C3F-EDF1DB5E2075}.exe
{AD10121D-7DED-44f1-B9C6-1FA2587E1B2B}.exe
{AE2BA67F-BB4B-4559-81B0-21251033A480}.exe
{DAA9221A-864B-4854-B908-747286AF4FE6}.exe
{E7A44DF0-8148-4705-BF5C-238940F99595}.exe