Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/07/2026, 04:27
General
- Target 2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe
- Size 59KB
- Sample260713-e227lady5s
- SHA256 6b71964648da0605b280ea8a30a74380772f421bff9e1199423778965106ad8f
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_6b0a872f8b83bb653fe89ee4162ecc84_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27ABB2CD-29A0-4e66-8982-E9C8488B20D6}.exeC:\Windows\{27ABB2CD-29A0-4e66-8982-E9C8488B20D6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4900563D-2360-41e0-9C71-DE6FED222FB6}.exeC:\Windows\{4900563D-2360-41e0-9C71-DE6FED222FB6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44E819A1-D9D4-43b0-A393-13EF36E4B854}.exeC:\Windows\{44E819A1-D9D4-43b0-A393-13EF36E4B854}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A129A4D-961C-47a5-B3C3-8C1534A3B818}.exeC:\Windows\{1A129A4D-961C-47a5-B3C3-8C1534A3B818}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{63835E25-CC43-43d8-ABC2-943478F112C4}.exeC:\Windows\{63835E25-CC43-43d8-ABC2-943478F112C4}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C87CFB97-B2DF-4a11-82FB-2CD737D7EDB0}.exeC:\Windows\{C87CFB97-B2DF-4a11-82FB-2CD737D7EDB0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94E3CDD5-6E86-4e6d-95B2-C0CA58865C40}.exeC:\Windows\{94E3CDD5-6E86-4e6d-95B2-C0CA58865C40}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{342C1539-0A55-4678-95F9-3A5196D00D28}.exeC:\Windows\{342C1539-0A55-4678-95F9-3A5196D00D28}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3A482E4-62C9-4ee3-BE7E-DBD4E7438C8D}.exeC:\Windows\{A3A482E4-62C9-4ee3-BE7E-DBD4E7438C8D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28E748F0-A049-4b1a-A8E0-2346ED88CEC8}.exeC:\Windows\{28E748F0-A049-4b1a-A8E0-2346ED88CEC8}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{885D195C-3E5E-4fe2-89EB-B6B96A4525DB}.exeC:\Windows\{885D195C-3E5E-4fe2-89EB-B6B96A4525DB}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28E74~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3A48~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{342C1~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94E3C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C87CF~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63835~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A129~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44E81~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49005~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27ABB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1A129A4D-961C-47a5-B3C3-8C1534A3B818}.exe
{27ABB2CD-29A0-4e66-8982-E9C8488B20D6}.exe
{28E748F0-A049-4b1a-A8E0-2346ED88CEC8}.exe
{342C1539-0A55-4678-95F9-3A5196D00D28}.exe
{44E819A1-D9D4-43b0-A393-13EF36E4B854}.exe
{4900563D-2360-41e0-9C71-DE6FED222FB6}.exe
{63835E25-CC43-43d8-ABC2-943478F112C4}.exe
{885D195C-3E5E-4fe2-89EB-B6B96A4525DB}.exe
{94E3CDD5-6E86-4e6d-95B2-C0CA58865C40}.exe
{A3A482E4-62C9-4ee3-BE7E-DBD4E7438C8D}.exe
{C87CFB97-B2DF-4a11-82FB-2CD737D7EDB0}.exe