Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
12/07/2026, 14:02
General
- Target 2026-07-12_21415ef9012134781a10f770176a4333_elex_wannacry.exe
- Size 98KB
- Sample260712-rcjeeabs5m
- SHA256 a9f09431d5a25deb8e92fa3131e633a718e5c1b82ede12d28a5686f9371883b1
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 22 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 7 IoCs
- Drops file in Windows directory 7 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_21415ef9012134781a10f770176a4333_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_21415ef9012134781a10f770176a4333_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E89CC3CF-6DCA-48a0-A042-76F29E79AF4F}.exeC:\Windows\{E89CC3CF-6DCA-48a0-A042-76F29E79AF4F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8E01C450-D672-4cd8-9EDF-D779D27F0F9F}.exeC:\Windows\{8E01C450-D672-4cd8-9EDF-D779D27F0F9F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{47171A75-E8ED-487e-A2D8-B2DDB6D8E9E2}.exeC:\Windows\{47171A75-E8ED-487e-A2D8-B2DDB6D8E9E2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{70012BBB-9EEA-495e-BCE7-5502609F194B}.exeC:\Windows\{70012BBB-9EEA-495e-BCE7-5502609F194B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27221714-CC24-4eff-93C8-CD2D3DFA93B1}.exeC:\Windows\{27221714-CC24-4eff-93C8-CD2D3DFA93B1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6417B0E1-560A-44e4-8B10-29B52EAF5D0B}.exeC:\Windows\{6417B0E1-560A-44e4-8B10-29B52EAF5D0B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDE7DCD2-0714-4969-8153-F0BCE8AD9F2E}.exeC:\Windows\{BDE7DCD2-0714-4969-8153-F0BCE8AD9F2E}.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6417B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27221~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70012~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47171~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8E01C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E89CC~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{27221714-CC24-4eff-93C8-CD2D3DFA93B1}.exe
{47171A75-E8ED-487e-A2D8-B2DDB6D8E9E2}.exe
{6417B0E1-560A-44e4-8B10-29B52EAF5D0B}.exe
{70012BBB-9EEA-495e-BCE7-5502609F194B}.exe
{8E01C450-D672-4cd8-9EDF-D779D27F0F9F}.exe
{BDE7DCD2-0714-4969-8153-F0BCE8AD9F2E}.exe
{E89CC3CF-6DCA-48a0-A042-76F29E79AF4F}.exe
memory/688-33-0x0000000000400000-0x0000000000411000-memory.dmp
memory/688-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1624-26-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1788-17-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1788-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1852-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1852-10-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3628-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3988-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3988-39-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4340-40-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4340-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4952-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4952-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4952-1-0x0000000000400000-0x0000000000411000-memory.dmp