Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
12/07/2026, 16:48
General
- Target 2026-07-12_7ad35223761f831e3b4bde70bc5f123a_elex_wannacry.exe
- Size 90KB
- Sample260712-vbg2qsfw21
- SHA256 a73551a0a10a2c1ccee7ddb38ece2b7584b0fee2e0c6c9916b355c553bfde7f3
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_7ad35223761f831e3b4bde70bc5f123a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_7ad35223761f831e3b4bde70bc5f123a_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{121E38CA-0EC2-448e-A5B1-E969EE52E52D}.exeC:\Windows\{121E38CA-0EC2-448e-A5B1-E969EE52E52D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42E9B8CB-2F5E-4bbe-96CB-6590ECF5909A}.exeC:\Windows\{42E9B8CB-2F5E-4bbe-96CB-6590ECF5909A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7F7F87F-071C-4f6b-881D-A1D6257CB74A}.exeC:\Windows\{F7F7F87F-071C-4f6b-881D-A1D6257CB74A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE56AF3B-94A7-4af9-95BD-5E1CD30DEA31}.exeC:\Windows\{AE56AF3B-94A7-4af9-95BD-5E1CD30DEA31}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58BD8545-432D-4c7b-94DB-97918F0D72D9}.exeC:\Windows\{58BD8545-432D-4c7b-94DB-97918F0D72D9}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CEDD4094-A4B8-486a-8040-983F8DA59954}.exeC:\Windows\{CEDD4094-A4B8-486a-8040-983F8DA59954}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A23F1BE0-E4BC-46d5-A770-B94A479A3C5C}.exeC:\Windows\{A23F1BE0-E4BC-46d5-A770-B94A479A3C5C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86C07836-B1FE-47a0-9397-DE9037A64F84}.exeC:\Windows\{86C07836-B1FE-47a0-9397-DE9037A64F84}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A72CF08A-B0AD-47ff-8A55-C16F602B3CD5}.exeC:\Windows\{A72CF08A-B0AD-47ff-8A55-C16F602B3CD5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94A90CD2-C28E-4d0e-9A24-AC9EF737C5C3}.exeC:\Windows\{94A90CD2-C28E-4d0e-9A24-AC9EF737C5C3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7EE45671-262A-413d-A56C-A3B0F558BF0C}.exeC:\Windows\{7EE45671-262A-413d-A56C-A3B0F558BF0C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94A90~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A72CF~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86C07~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A23F1~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CEDD4~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58BD8~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE56A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7F7F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42E9B~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{121E3~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{121E38CA-0EC2-448e-A5B1-E969EE52E52D}.exe
{42E9B8CB-2F5E-4bbe-96CB-6590ECF5909A}.exe
{58BD8545-432D-4c7b-94DB-97918F0D72D9}.exe
{7EE45671-262A-413d-A56C-A3B0F558BF0C}.exe
{86C07836-B1FE-47a0-9397-DE9037A64F84}.exe
{94A90CD2-C28E-4d0e-9A24-AC9EF737C5C3}.exe
{A23F1BE0-E4BC-46d5-A770-B94A479A3C5C}.exe
{A72CF08A-B0AD-47ff-8A55-C16F602B3CD5}.exe
{AE56AF3B-94A7-4af9-95BD-5E1CD30DEA31}.exe
{CEDD4094-A4B8-486a-8040-983F8DA59954}.exe
{F7F7F87F-071C-4f6b-881D-A1D6257CB74A}.exe