Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 01:46
General
- Target 2026-07-13_163281fa9f46bbcdf4e253a5d9499451_elex_wannacry.exe
- Size 60KB
- Sample260714-b67fbsct9l
- SHA256 1869482926247c448400c9d9ba14931a16b5bb2e4aa9b01ae315e766d0d9ebc4
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_163281fa9f46bbcdf4e253a5d9499451_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_163281fa9f46bbcdf4e253a5d9499451_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44502284-EACA-4649-BD52-7BA3C8E1C8F9}.exeC:\Windows\{44502284-EACA-4649-BD52-7BA3C8E1C8F9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4643BC6D-2D04-47f7-A2CA-0A9A93097A76}.exeC:\Windows\{4643BC6D-2D04-47f7-A2CA-0A9A93097A76}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A859F427-9045-4dd5-A2B0-0906C71EBF77}.exeC:\Windows\{A859F427-9045-4dd5-A2B0-0906C71EBF77}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB6FB65E-2666-45a7-BA64-F9A56A38ED50}.exeC:\Windows\{DB6FB65E-2666-45a7-BA64-F9A56A38ED50}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5B8D34D-454D-4896-8F38-849058DC6224}.exeC:\Windows\{E5B8D34D-454D-4896-8F38-849058DC6224}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6DB848F0-7C81-4268-9C14-A6F3116F34DA}.exeC:\Windows\{6DB848F0-7C81-4268-9C14-A6F3116F34DA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{186CE3A3-7890-4656-83FB-581408E2B5DF}.exeC:\Windows\{186CE3A3-7890-4656-83FB-581408E2B5DF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81E48BE6-FF4A-40ac-A193-69FEA63D9212}.exeC:\Windows\{81E48BE6-FF4A-40ac-A193-69FEA63D9212}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D772D699-6135-497a-9F65-69FEDAE78A91}.exeC:\Windows\{D772D699-6135-497a-9F65-69FEDAE78A91}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B61A6D1C-1804-4673-8D78-764CB6D4CFBE}.exeC:\Windows\{B61A6D1C-1804-4673-8D78-764CB6D4CFBE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0ECF2256-3B19-4a3b-97C5-E1F4E2989F1D}.exeC:\Windows\{0ECF2256-3B19-4a3b-97C5-E1F4E2989F1D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B61A6~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D772D~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81E48~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{186CE~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6DB84~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5B8D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB6FB~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A859F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4643B~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44502~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0ECF2256-3B19-4a3b-97C5-E1F4E2989F1D}.exe
{186CE3A3-7890-4656-83FB-581408E2B5DF}.exe
{44502284-EACA-4649-BD52-7BA3C8E1C8F9}.exe
{4643BC6D-2D04-47f7-A2CA-0A9A93097A76}.exe
{6DB848F0-7C81-4268-9C14-A6F3116F34DA}.exe
{81E48BE6-FF4A-40ac-A193-69FEA63D9212}.exe
{A859F427-9045-4dd5-A2B0-0906C71EBF77}.exe
{B61A6D1C-1804-4673-8D78-764CB6D4CFBE}.exe
{D772D699-6135-497a-9F65-69FEDAE78A91}.exe
{DB6FB65E-2666-45a7-BA64-F9A56A38ED50}.exe
{E5B8D34D-454D-4896-8F38-849058DC6224}.exe