Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 16:39
General
- Target 2026-07-14_95000d29fa24e6d1e3d1e92cc643108d_elex_wannacry.exe
- Size 59KB
- Sample260714-t563aagx7k
- SHA256 344a4236a4939a8a95ac61d28561c84e1424200ed42006f475e6d0f00d1a2df5
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_95000d29fa24e6d1e3d1e92cc643108d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_95000d29fa24e6d1e3d1e92cc643108d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32892F4A-AFAC-4765-81E1-775005E47C5A}.exeC:\Windows\{32892F4A-AFAC-4765-81E1-775005E47C5A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86FBD220-2129-4195-8E7B-1B1667708A52}.exeC:\Windows\{86FBD220-2129-4195-8E7B-1B1667708A52}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{326FD281-7774-4dae-B01D-0A816A746DEB}.exeC:\Windows\{326FD281-7774-4dae-B01D-0A816A746DEB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05AFBB40-91DA-457e-897E-3157358FABDD}.exeC:\Windows\{05AFBB40-91DA-457e-897E-3157358FABDD}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D6EB4BE0-28B8-45e4-A44F-55759AD39E7A}.exeC:\Windows\{D6EB4BE0-28B8-45e4-A44F-55759AD39E7A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49EFE4A9-80F3-4e47-AA6F-D4D005B7C25D}.exeC:\Windows\{49EFE4A9-80F3-4e47-AA6F-D4D005B7C25D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78A88237-5CDA-4744-880C-F451755E6B23}.exeC:\Windows\{78A88237-5CDA-4744-880C-F451755E6B23}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F29C083E-539F-489b-8CBB-39BDEBC12F5F}.exeC:\Windows\{F29C083E-539F-489b-8CBB-39BDEBC12F5F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD515DC9-F55D-456c-AF20-D7C296263748}.exeC:\Windows\{FD515DC9-F55D-456c-AF20-D7C296263748}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{536D016C-7572-4cd0-A4F8-66421D586724}.exeC:\Windows\{536D016C-7572-4cd0-A4F8-66421D586724}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F91584CC-5118-4fb4-9F3A-150DFC0E0FA6}.exeC:\Windows\{F91584CC-5118-4fb4-9F3A-150DFC0E0FA6}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{536D0~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD515~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F29C0~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78A88~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49EFE~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6EB4~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05AFB~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{326FD~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86FBD~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32892~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{05AFBB40-91DA-457e-897E-3157358FABDD}.exe
{326FD281-7774-4dae-B01D-0A816A746DEB}.exe
{32892F4A-AFAC-4765-81E1-775005E47C5A}.exe
{49EFE4A9-80F3-4e47-AA6F-D4D005B7C25D}.exe
{536D016C-7572-4cd0-A4F8-66421D586724}.exe
{78A88237-5CDA-4744-880C-F451755E6B23}.exe
{86FBD220-2129-4195-8E7B-1B1667708A52}.exe
{D6EB4BE0-28B8-45e4-A44F-55759AD39E7A}.exe
{F29C083E-539F-489b-8CBB-39BDEBC12F5F}.exe
{F91584CC-5118-4fb4-9F3A-150DFC0E0FA6}.exe
{FD515DC9-F55D-456c-AF20-D7C296263748}.exe