Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 16:17
General
- Target 2026-07-14_d513ff2d1fd95125554ac1d87df3d600_elex_wannacry.exe
- Size 88KB
- Sample260714-trcxaaaz3x
- SHA256 4117923855dbb370410b144c1e72b2c320f8ea50b41efe6997561cccca251fd4
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_d513ff2d1fd95125554ac1d87df3d600_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_d513ff2d1fd95125554ac1d87df3d600_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F4068DB7-0956-4529-93C2-C14AD9C04DCD}.exeC:\Windows\{F4068DB7-0956-4529-93C2-C14AD9C04DCD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15423D57-F90D-432a-9D5B-46E00A1AF787}.exeC:\Windows\{15423D57-F90D-432a-9D5B-46E00A1AF787}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E8963F6-BD06-40cb-B2DA-3B4C65DE918A}.exeC:\Windows\{6E8963F6-BD06-40cb-B2DA-3B4C65DE918A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10FDAE07-F179-4612-A292-F06B92DD8914}.exeC:\Windows\{10FDAE07-F179-4612-A292-F06B92DD8914}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A99D353-70DA-42cc-9DAB-4DE7FEFFBC85}.exeC:\Windows\{8A99D353-70DA-42cc-9DAB-4DE7FEFFBC85}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9663C58A-F288-4f95-8A92-57C329E957A8}.exeC:\Windows\{9663C58A-F288-4f95-8A92-57C329E957A8}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C453542F-FF0A-456c-BE87-E55C12024A96}.exeC:\Windows\{C453542F-FF0A-456c-BE87-E55C12024A96}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB93FB56-34BE-4015-9E15-6D45A90A8593}.exeC:\Windows\{BB93FB56-34BE-4015-9E15-6D45A90A8593}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{925C470C-530C-4776-B9FE-1B3EC6101580}.exeC:\Windows\{925C470C-530C-4776-B9FE-1B3EC6101580}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71DF374D-1902-4c6b-93B6-74F12EA8971A}.exeC:\Windows\{71DF374D-1902-4c6b-93B6-74F12EA8971A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFE5F110-A05B-4ebd-A24C-FDB55EAF4862}.exeC:\Windows\{BFE5F110-A05B-4ebd-A24C-FDB55EAF4862}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71DF3~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{925C4~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB93F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4535~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9663C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A99D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10FDA~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E896~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15423~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4068~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{10FDAE07-F179-4612-A292-F06B92DD8914}.exe
{15423D57-F90D-432a-9D5B-46E00A1AF787}.exe
{6E8963F6-BD06-40cb-B2DA-3B4C65DE918A}.exe
{71DF374D-1902-4c6b-93B6-74F12EA8971A}.exe
{8A99D353-70DA-42cc-9DAB-4DE7FEFFBC85}.exe
{925C470C-530C-4776-B9FE-1B3EC6101580}.exe
{9663C58A-F288-4f95-8A92-57C329E957A8}.exe
{BB93FB56-34BE-4015-9E15-6D45A90A8593}.exe
{BFE5F110-A05B-4ebd-A24C-FDB55EAF4862}.exe
{C453542F-FF0A-456c-BE87-E55C12024A96}.exe
{F4068DB7-0956-4529-93C2-C14AD9C04DCD}.exe