Overview

overview

10

Static

static

10

2026-07-13...ry.exe

windows10-2004-x64

10

2026-07-13...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 01:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-13_55484646110c8c644ca4a2bc552b27df_elex_wannacry.exe
  • Size 72KB
  • Sample260714-bspclab18p
  • SHA256 a898735953a6e12038fde5083b101fde0d7881a25b4f9da6ff115ecc0e797211
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverystormserpersistenceupxworm

Malware Config

Signatures

  • Family: Stormser, StormDDoS, StormAttack, Stormer

    Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.

    wormstormser
  • Detects Stormser aka Storm DDoS and StormAttack 45 IoCs
  • UPX dump on OEP (original entry point) 45 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 11 IoCs
  • UPX packed file 45 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_55484646110c8c644ca4a2bc552b27df_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-13_55484646110c8c644ca4a2bc552b27df_elex_wannacry.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5704
    • C:\Windows\{ED07D694-DF5C-4d84-80AA-AAD8CF6E666D}.exe
      C:\Windows\{ED07D694-DF5C-4d84-80AA-AAD8CF6E666D}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4688
      • C:\Windows\{E66F9B99-ABCC-4001-B624-268C4DB30595}.exe
        C:\Windows\{E66F9B99-ABCC-4001-B624-268C4DB30595}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3680
        • C:\Windows\{E35F1367-7127-45b3-BB1A-A4FB40C73804}.exe
          C:\Windows\{E35F1367-7127-45b3-BB1A-A4FB40C73804}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1328
          • C:\Windows\{720B7A38-61BC-40a9-8058-AA1997D546F5}.exe
            C:\Windows\{720B7A38-61BC-40a9-8058-AA1997D546F5}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4900
            • C:\Windows\{C5267AB3-ABAB-4d9d-8DB1-995B6050C366}.exe
              C:\Windows\{C5267AB3-ABAB-4d9d-8DB1-995B6050C366}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3296
              • C:\Windows\{7C5B032A-80BD-4746-801F-01BCC600B3C6}.exe
                C:\Windows\{7C5B032A-80BD-4746-801F-01BCC600B3C6}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:912
                • C:\Windows\{9F767BF6-E414-4816-901A-6A5257DCFA33}.exe
                  C:\Windows\{9F767BF6-E414-4816-901A-6A5257DCFA33}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2488
                  • C:\Windows\{8434D040-D426-4b93-BDD7-EA1C2BBB5300}.exe
                    C:\Windows\{8434D040-D426-4b93-BDD7-EA1C2BBB5300}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3384
                    • C:\Windows\{256A7E92-CF6B-4a92-95C7-CF630285F4C0}.exe
                      C:\Windows\{256A7E92-CF6B-4a92-95C7-CF630285F4C0}.exe
                      10⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2748
                      • C:\Windows\{8AEDF68C-AFF3-4e19-B8DC-31F5E87A45B7}.exe
                        C:\Windows\{8AEDF68C-AFF3-4e19-B8DC-31F5E87A45B7}.exe
                        11⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:5348
                        • C:\Windows\{9C2B3483-D167-4112-AEC0-B1A45EC047D3}.exe
                          C:\Windows\{9C2B3483-D167-4112-AEC0-B1A45EC047D3}.exe
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:4936
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{8AEDF~1.EXE > nul
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:3484
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{256A7~1.EXE > nul
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:4896
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{8434D~1.EXE > nul
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:2756
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{9F767~1.EXE > nul
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:1592
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{7C5B0~1.EXE > nul
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1412
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{C5267~1.EXE > nul
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4704
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{720B7~1.EXE > nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:756
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{E35F1~1.EXE > nul
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2504
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{E66F9~1.EXE > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4760
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ED07D~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1304
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4444

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        {256A7E92-CF6B-4a92-95C7-CF630285F4C0}.exe
        • Path C:\Windows\{256A7E92-CF6B-4a92-95C7-CF630285F4C0}.exe
        • Size 72KB
        • SHA256 7b1c7b8392af82d61b7add1187076794c6fd034b5a9699d7d6023d951b813b90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {720B7A38-61BC-40a9-8058-AA1997D546F5}.exe
        • Path C:\Windows\{720B7A38-61BC-40a9-8058-AA1997D546F5}.exe
        • Size 72KB
        • SHA256 6b6000fcd1efa813c458c31b45213ba854444985b328795c60e85ad62792fce1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {7C5B032A-80BD-4746-801F-01BCC600B3C6}.exe
        • Path C:\Windows\{7C5B032A-80BD-4746-801F-01BCC600B3C6}.exe
        • Size 72KB
        • SHA256 0f760f12df4259a6035f017a30ba123e82c4c9e97aed1a5695e376bb17ee178a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {8434D040-D426-4b93-BDD7-EA1C2BBB5300}.exe
        • Path C:\Windows\{8434D040-D426-4b93-BDD7-EA1C2BBB5300}.exe
        • Size 72KB
        • SHA256 42cc1aabc94a728ca118293b194b4b622f3d5c317ff7dd46b0cda9ab0f38bf1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {8AEDF68C-AFF3-4e19-B8DC-31F5E87A45B7}.exe
        • Path C:\Windows\{8AEDF68C-AFF3-4e19-B8DC-31F5E87A45B7}.exe
        • Size 72KB
        • SHA256 1764c2072b8efa99ba6aba0625a2bb72fe7ef80f6bc1e73c17f7c3f8f777b2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {9C2B3483-D167-4112-AEC0-B1A45EC047D3}.exe
        • Path C:\Windows\{9C2B3483-D167-4112-AEC0-B1A45EC047D3}.exe
        • Size 72KB
        • SHA256 12debdff2fdfdf0d8f0133f2d2161c839b243a4194e4f6e0b01e7903de273474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {9F767BF6-E414-4816-901A-6A5257DCFA33}.exe
        • Path C:\Windows\{9F767BF6-E414-4816-901A-6A5257DCFA33}.exe
        • Size 72KB
        • SHA256 939ac48ceb0f757aa85790d796f0854ae2bbbf43a06c2c7b65f6e7d7192c6d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {C5267AB3-ABAB-4d9d-8DB1-995B6050C366}.exe
        • Path C:\Windows\{C5267AB3-ABAB-4d9d-8DB1-995B6050C366}.exe
        • Size 72KB
        • SHA256 ff6084f0572816e4a15ef14336411dd620b9350368bc820cf5c1279d6ccce1cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {E35F1367-7127-45b3-BB1A-A4FB40C73804}.exe
        • Path C:\Windows\{E35F1367-7127-45b3-BB1A-A4FB40C73804}.exe
        • Size 72KB
        • SHA256 79f5ab6d9324735d890aba0e29ed085a959cfe3ee317040b9be8e8a461fc7519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {E66F9B99-ABCC-4001-B624-268C4DB30595}.exe
        • Path C:\Windows\{E66F9B99-ABCC-4001-B624-268C4DB30595}.exe
        • Size 72KB
        • SHA256 d03d63d3b907e12b89a721a2c9260b7f220c58a4f0305d1f48817162dbde5bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {ED07D694-DF5C-4d84-80AA-AAD8CF6E666D}.exe
        • Path C:\Windows\{ED07D694-DF5C-4d84-80AA-AAD8CF6E666D}.exe
        • Size 72KB
        • SHA256 58b453a1c412a0677822f605d945795473a107dc10393f1a4f35f1bc7396787d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/912-49-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/912-53-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/912-47-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1328-22-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1328-25-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1328-31-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2488-55-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2488-61-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2488-57-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2748-77-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2748-73-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2748-70-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3296-39-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3296-41-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3296-46-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3384-71-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3384-63-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3384-65-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3680-23-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3680-15-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/3680-17-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4688-9-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4688-13-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4688-6-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4900-30-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4900-37-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4900-33-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4936-86-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5348-79-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5348-81-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5348-87-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5704-7-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5704-0-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/5704-1-0x0000000000400000-0x0000000000413000-memory.dmp
        Download