Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/07/2026, 02:43
General
- Target 2026-07-15_6bcbccb790dc68eb6ff410776a39e0a3_elex_wannacry.exe
- Size 88KB
- Sample260715-c7trascz7x
- SHA256 e4268f44bcb46f1fe806fd4fc228f98063c25831838c301201490955b6270dd1
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_6bcbccb790dc68eb6ff410776a39e0a3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_6bcbccb790dc68eb6ff410776a39e0a3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FE843CDD-0BF7-4740-8154-C54233C15184}.exeC:\Windows\{FE843CDD-0BF7-4740-8154-C54233C15184}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{793B9F34-0FC3-4f0d-AF30-67D8CCDF1A8C}.exeC:\Windows\{793B9F34-0FC3-4f0d-AF30-67D8CCDF1A8C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD86B9A4-F26D-4438-AD9F-282364CB4B72}.exeC:\Windows\{CD86B9A4-F26D-4438-AD9F-282364CB4B72}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F46FF04-7A07-456a-901B-A55C16248D5B}.exeC:\Windows\{6F46FF04-7A07-456a-901B-A55C16248D5B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7BF311D1-B15F-4c2a-8764-672931166960}.exeC:\Windows\{7BF311D1-B15F-4c2a-8764-672931166960}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD66241D-819F-4252-96AF-CCBA582813E6}.exeC:\Windows\{BD66241D-819F-4252-96AF-CCBA582813E6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C5793F15-EF3C-4f33-8417-0A6731476F19}.exeC:\Windows\{C5793F15-EF3C-4f33-8417-0A6731476F19}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6FCFEDC6-0123-4355-8886-7EDE249D82A0}.exeC:\Windows\{6FCFEDC6-0123-4355-8886-7EDE249D82A0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{602E305F-659E-479d-B9A3-3D2A34106C47}.exeC:\Windows\{602E305F-659E-479d-B9A3-3D2A34106C47}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04311590-A427-4a6d-A454-60A72B092A0B}.exeC:\Windows\{04311590-A427-4a6d-A454-60A72B092A0B}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F3D62D29-28E3-4169-A9F5-F6F42FB940F6}.exeC:\Windows\{F3D62D29-28E3-4169-A9F5-F6F42FB940F6}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04311~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{602E3~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6FCFE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5793~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD662~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7BF31~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F46F~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD86B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{793B9~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE843~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{04311590-A427-4a6d-A454-60A72B092A0B}.exe
{602E305F-659E-479d-B9A3-3D2A34106C47}.exe
{6F46FF04-7A07-456a-901B-A55C16248D5B}.exe
{6FCFEDC6-0123-4355-8886-7EDE249D82A0}.exe
{793B9F34-0FC3-4f0d-AF30-67D8CCDF1A8C}.exe
{7BF311D1-B15F-4c2a-8764-672931166960}.exe
{BD66241D-819F-4252-96AF-CCBA582813E6}.exe
{C5793F15-EF3C-4f33-8417-0A6731476F19}.exe
{CD86B9A4-F26D-4438-AD9F-282364CB4B72}.exe
{F3D62D29-28E3-4169-A9F5-F6F42FB940F6}.exe
{FE843CDD-0BF7-4740-8154-C54233C15184}.exe