Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 14:02
General
- Target 2026-07-12_21415ef9012134781a10f770176a4333_elex_wannacry.exe
- Size 98KB
- Sample260712-rcjeeabs5m
- SHA256 a9f09431d5a25deb8e92fa3131e633a718e5c1b82ede12d28a5686f9371883b1
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_21415ef9012134781a10f770176a4333_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_21415ef9012134781a10f770176a4333_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D40F0E39-261E-44bf-AF08-0386B22ACEFB}.exeC:\Windows\{D40F0E39-261E-44bf-AF08-0386B22ACEFB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC9082FA-86AD-40c3-9EF5-CDDA8DDB1FA4}.exeC:\Windows\{AC9082FA-86AD-40c3-9EF5-CDDA8DDB1FA4}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{72012F36-57D6-4ed3-B1BE-95E8EBCCBA95}.exeC:\Windows\{72012F36-57D6-4ed3-B1BE-95E8EBCCBA95}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ADFB1EFF-9075-4e5c-8603-81A50FD2C976}.exeC:\Windows\{ADFB1EFF-9075-4e5c-8603-81A50FD2C976}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2D848E6-23AB-47ca-840A-28CCF7815556}.exeC:\Windows\{A2D848E6-23AB-47ca-840A-28CCF7815556}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53588F85-4EF9-489c-862F-AC45709F829C}.exeC:\Windows\{53588F85-4EF9-489c-862F-AC45709F829C}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A386467-5FC0-46a2-A1D3-4E34345AC672}.exeC:\Windows\{4A386467-5FC0-46a2-A1D3-4E34345AC672}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF5FD643-A007-4948-9AA7-22B981F8AEBE}.exeC:\Windows\{EF5FD643-A007-4948-9AA7-22B981F8AEBE}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{138AF75A-5AFD-4021-8B77-FDDA07DB12A0}.exeC:\Windows\{138AF75A-5AFD-4021-8B77-FDDA07DB12A0}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D90B28FC-3849-4204-9E53-8B73EE7DC36F}.exeC:\Windows\{D90B28FC-3849-4204-9E53-8B73EE7DC36F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CEF80826-C7DB-4fb4-9A6A-678C2AC85D93}.exeC:\Windows\{CEF80826-C7DB-4fb4-9A6A-678C2AC85D93}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D90B2~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{138AF~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF5FD~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A386~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53588~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2D84~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ADFB1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72012~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC908~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D40F0~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{138AF75A-5AFD-4021-8B77-FDDA07DB12A0}.exe
{4A386467-5FC0-46a2-A1D3-4E34345AC672}.exe
{53588F85-4EF9-489c-862F-AC45709F829C}.exe
{72012F36-57D6-4ed3-B1BE-95E8EBCCBA95}.exe
{A2D848E6-23AB-47ca-840A-28CCF7815556}.exe
{AC9082FA-86AD-40c3-9EF5-CDDA8DDB1FA4}.exe
{ADFB1EFF-9075-4e5c-8603-81A50FD2C976}.exe
{CEF80826-C7DB-4fb4-9A6A-678C2AC85D93}.exe
{D40F0E39-261E-44bf-AF08-0386B22ACEFB}.exe
{D90B28FC-3849-4204-9E53-8B73EE7DC36F}.exe
{EF5FD643-A007-4948-9AA7-22B981F8AEBE}.exe
memory/1124-15-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1124-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1144-43-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1144-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1496-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1496-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1948-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1948-62-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3204-76-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3204-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4284-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4284-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4284-9-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4336-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4412-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4412-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4484-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4484-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4592-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4592-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5544-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5544-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5660-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5660-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5660-0-0x0000000000400000-0x0000000000411000-memory.dmp