Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/07/2026, 21:45
General
- Target 2026-07-13_995db10298458b8c8d460ffe13a9b0f6_elex_wannacry.exe
- Size 98KB
- Sample260713-1mjbtsbs8z
- SHA256 2a9c82c5b73142ac521b85d25d328ccdc52f1a3aa0e554d96fefae31a575a352
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_995db10298458b8c8d460ffe13a9b0f6_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_995db10298458b8c8d460ffe13a9b0f6_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80FC6805-3CC6-4d81-A265-C5EDCE64E4F9}.exeC:\Windows\{80FC6805-3CC6-4d81-A265-C5EDCE64E4F9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{633D289E-8956-4a92-AC62-1FCDC5324957}.exeC:\Windows\{633D289E-8956-4a92-AC62-1FCDC5324957}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E5FFF94-8AD0-4f34-8335-7FBE67F11EF2}.exeC:\Windows\{4E5FFF94-8AD0-4f34-8335-7FBE67F11EF2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7FED99E1-6701-49b6-8C00-F06154911CCD}.exeC:\Windows\{7FED99E1-6701-49b6-8C00-F06154911CCD}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C1DB85F1-4751-4403-8176-AB6EF5A19FE3}.exeC:\Windows\{C1DB85F1-4751-4403-8176-AB6EF5A19FE3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF991DF6-7CE9-4a45-B939-1E3584ABC0F6}.exeC:\Windows\{AF991DF6-7CE9-4a45-B939-1E3584ABC0F6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2550F64A-4358-4d67-A34C-43A00B5DF8C2}.exeC:\Windows\{2550F64A-4358-4d67-A34C-43A00B5DF8C2}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15680757-A03B-4590-899B-3C58F95C719A}.exeC:\Windows\{15680757-A03B-4590-899B-3C58F95C719A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E682AB8-D239-4227-B1FB-2A2B2631F549}.exeC:\Windows\{1E682AB8-D239-4227-B1FB-2A2B2631F549}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12C1161D-9838-4b9b-8107-9D0C46691012}.exeC:\Windows\{12C1161D-9838-4b9b-8107-9D0C46691012}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{596F0941-7D42-4b1d-91D6-C79BBC66C387}.exeC:\Windows\{596F0941-7D42-4b1d-91D6-C79BBC66C387}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12C11~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E682~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15680~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2550F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF991~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1DB8~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7FED9~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E5FF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{633D2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80FC6~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{12C1161D-9838-4b9b-8107-9D0C46691012}.exe
{15680757-A03B-4590-899B-3C58F95C719A}.exe
{1E682AB8-D239-4227-B1FB-2A2B2631F549}.exe
{2550F64A-4358-4d67-A34C-43A00B5DF8C2}.exe
{4E5FFF94-8AD0-4f34-8335-7FBE67F11EF2}.exe
{596F0941-7D42-4b1d-91D6-C79BBC66C387}.exe
{633D289E-8956-4a92-AC62-1FCDC5324957}.exe
{7FED99E1-6701-49b6-8C00-F06154911CCD}.exe
{80FC6805-3CC6-4d81-A265-C5EDCE64E4F9}.exe
{AF991DF6-7CE9-4a45-B939-1E3584ABC0F6}.exe
{C1DB85F1-4751-4403-8176-AB6EF5A19FE3}.exe
memory/616-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/616-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1100-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1100-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1276-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1276-28-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1376-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1376-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1772-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1772-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2240-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2240-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2456-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2456-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2456-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4128-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4128-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4264-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4264-68-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4360-75-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4360-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4864-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4864-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5016-77-0x0000000000400000-0x0000000000411000-memory.dmp