Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
12/07/2026, 20:20
General
- Target 2026-07-12_f9edeec5d7e79b3f365ac304826eb9ad_elex_wannacry.exe
- Size 88KB
- Sample260712-y4wmdaat4x
- SHA256 ae1459943e8cf74e15d6746cac9b2cf24b0da513d838ea689e6adf7e6bab20a8
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_f9edeec5d7e79b3f365ac304826eb9ad_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_f9edeec5d7e79b3f365ac304826eb9ad_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58B56D2C-44F3-4f4a-9BEC-C1E9A982753D}.exeC:\Windows\{58B56D2C-44F3-4f4a-9BEC-C1E9A982753D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1EF0C7D-DC4D-4738-ACD8-AEFA62B964A6}.exeC:\Windows\{F1EF0C7D-DC4D-4738-ACD8-AEFA62B964A6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{11A98F59-0A48-4514-8AA2-8748F66405AC}.exeC:\Windows\{11A98F59-0A48-4514-8AA2-8748F66405AC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{524F32B5-48F0-4c88-B9A6-A7A92C13493D}.exeC:\Windows\{524F32B5-48F0-4c88-B9A6-A7A92C13493D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAE6A938-9D59-47d4-82B6-3C6BBA68A2E5}.exeC:\Windows\{CAE6A938-9D59-47d4-82B6-3C6BBA68A2E5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C18D20B-F1A9-4008-95CE-F592F4D356A7}.exeC:\Windows\{7C18D20B-F1A9-4008-95CE-F592F4D356A7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56431416-388E-49f1-9694-3B1281FA31E3}.exeC:\Windows\{56431416-388E-49f1-9694-3B1281FA31E3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B11DA38-0199-4db1-AD2E-8396123807E3}.exeC:\Windows\{8B11DA38-0199-4db1-AD2E-8396123807E3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D97F85FF-95A4-458c-BCCD-32A7FD886656}.exeC:\Windows\{D97F85FF-95A4-458c-BCCD-32A7FD886656}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C8FE02D5-7AC8-41ad-8D40-731D73FF9C95}.exeC:\Windows\{C8FE02D5-7AC8-41ad-8D40-731D73FF9C95}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6DF98D7F-D808-4b68-BC03-8B29746AF36A}.exeC:\Windows\{6DF98D7F-D808-4b68-BC03-8B29746AF36A}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8FE0~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D97F8~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B11D~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56431~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C18D~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAE6A~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{524F3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11A98~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1EF0~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58B56~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{11A98F59-0A48-4514-8AA2-8748F66405AC}.exe
{524F32B5-48F0-4c88-B9A6-A7A92C13493D}.exe
{56431416-388E-49f1-9694-3B1281FA31E3}.exe
{58B56D2C-44F3-4f4a-9BEC-C1E9A982753D}.exe
{6DF98D7F-D808-4b68-BC03-8B29746AF36A}.exe
{7C18D20B-F1A9-4008-95CE-F592F4D356A7}.exe
{8B11DA38-0199-4db1-AD2E-8396123807E3}.exe
{C8FE02D5-7AC8-41ad-8D40-731D73FF9C95}.exe
{CAE6A938-9D59-47d4-82B6-3C6BBA68A2E5}.exe
{D97F85FF-95A4-458c-BCCD-32A7FD886656}.exe
{F1EF0C7D-DC4D-4738-ACD8-AEFA62B964A6}.exe
memory/2400-62-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2400-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2844-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2844-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2844-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3008-72-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3008-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3164-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3164-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3348-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3348-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3468-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3468-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3524-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3524-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3936-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4996-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4996-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5104-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5104-9-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5104-15-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5656-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5656-76-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5680-43-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5680-36-0x0000000000400000-0x0000000000411000-memory.dmp