Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 18:46
General
- Target 2026-07-11_3b6eb40a5a55e8b0eb263dfefcd3339b_elex_wannacry.exe
- Size 87KB
- Sample260711-xesnrabt21
- SHA256 eb0f482407ca8fd2a60b838ff3551221aeb88779d0efc300e6d570b3ff4998a3
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_3b6eb40a5a55e8b0eb263dfefcd3339b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_3b6eb40a5a55e8b0eb263dfefcd3339b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E9A31BAC-8DBE-4b83-9AC2-00E8168A467F}.exeC:\Windows\{E9A31BAC-8DBE-4b83-9AC2-00E8168A467F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C73DE47A-5B52-4ae4-951E-68EEA0310C55}.exeC:\Windows\{C73DE47A-5B52-4ae4-951E-68EEA0310C55}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7934048A-9A91-4ed6-B0FC-B6D7B39AF917}.exeC:\Windows\{7934048A-9A91-4ed6-B0FC-B6D7B39AF917}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F9C626E-7577-4a2e-9C53-3A2CBB59E2E0}.exeC:\Windows\{7F9C626E-7577-4a2e-9C53-3A2CBB59E2E0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1971D9D9-C3CA-4087-B558-D733EDC8CBF3}.exeC:\Windows\{1971D9D9-C3CA-4087-B558-D733EDC8CBF3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2E5AFEB-7F9A-4c32-824F-C106AD9DFB94}.exeC:\Windows\{B2E5AFEB-7F9A-4c32-824F-C106AD9DFB94}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49D720E8-CD36-4839-960B-02E17B2739B0}.exeC:\Windows\{49D720E8-CD36-4839-960B-02E17B2739B0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A50363B9-507E-4014-B9CC-BB1C4BB986A9}.exeC:\Windows\{A50363B9-507E-4014-B9CC-BB1C4BB986A9}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7DEF4888-17C9-4bc6-907E-129DD5505CAE}.exeC:\Windows\{7DEF4888-17C9-4bc6-907E-129DD5505CAE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35006C26-0D8B-4bcf-8402-34D03F5B3CFA}.exeC:\Windows\{35006C26-0D8B-4bcf-8402-34D03F5B3CFA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{936CE275-79CC-4d9a-B06E-B71EF674423C}.exeC:\Windows\{936CE275-79CC-4d9a-B06E-B71EF674423C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35006~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DEF4~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5036~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49D72~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2E5A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1971D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F9C6~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79340~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C73DE~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9A31~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1971D9D9-C3CA-4087-B558-D733EDC8CBF3}.exe
{35006C26-0D8B-4bcf-8402-34D03F5B3CFA}.exe
{49D720E8-CD36-4839-960B-02E17B2739B0}.exe
{7934048A-9A91-4ed6-B0FC-B6D7B39AF917}.exe
{7DEF4888-17C9-4bc6-907E-129DD5505CAE}.exe
{7F9C626E-7577-4a2e-9C53-3A2CBB59E2E0}.exe
{936CE275-79CC-4d9a-B06E-B71EF674423C}.exe
{A50363B9-507E-4014-B9CC-BB1C4BB986A9}.exe
{B2E5AFEB-7F9A-4c32-824F-C106AD9DFB94}.exe
{C73DE47A-5B52-4ae4-951E-68EEA0310C55}.exe
{E9A31BAC-8DBE-4b83-9AC2-00E8168A467F}.exe
memory/252-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/252-54-0x0000000000400000-0x0000000000411000-memory.dmp
memory/752-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/752-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1652-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1652-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1652-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2856-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2856-75-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3296-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3296-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3320-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3320-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3332-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3332-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3844-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4104-26-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4104-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4256-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4256-68-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5160-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5160-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5196-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5196-34-0x0000000000400000-0x0000000000411000-memory.dmp