Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/07/2026, 02:04
General
- Target 2026-07-15_c5d7744e7e7acdb1619200627ff75c7f_elex_wannacry.exe
- Size 90KB
- Sample260715-chbjescs7w
- SHA256 5c3e7de863874508d8dc8a5bbf47129658285f84b3a2bedaa7fd894655a75a7f
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_c5d7744e7e7acdb1619200627ff75c7f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_c5d7744e7e7acdb1619200627ff75c7f_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4095400D-97B9-4b58-BEAF-87C12BD9C5CF}.exeC:\Windows\{4095400D-97B9-4b58-BEAF-87C12BD9C5CF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B7F083A-029C-48da-8B63-99B158660849}.exeC:\Windows\{4B7F083A-029C-48da-8B63-99B158660849}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2881B078-B887-4d63-80C7-0B3399BE584F}.exeC:\Windows\{2881B078-B887-4d63-80C7-0B3399BE584F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E3D0E538-BB78-4a90-BA08-F1190EF0B9C7}.exeC:\Windows\{E3D0E538-BB78-4a90-BA08-F1190EF0B9C7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7B1B05F5-3728-4ab4-93A5-1E43C2885C69}.exeC:\Windows\{7B1B05F5-3728-4ab4-93A5-1E43C2885C69}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6EE39D44-3E80-459d-BDEA-A71DA8E9B433}.exeC:\Windows\{6EE39D44-3E80-459d-BDEA-A71DA8E9B433}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E6792B1-6801-4575-94BC-810DA7E12575}.exeC:\Windows\{5E6792B1-6801-4575-94BC-810DA7E12575}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8DB673B8-F708-436b-8A44-86B57DEBDA76}.exeC:\Windows\{8DB673B8-F708-436b-8A44-86B57DEBDA76}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6865FBB6-D8AE-402c-BAD7-7581B5D40179}.exeC:\Windows\{6865FBB6-D8AE-402c-BAD7-7581B5D40179}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A75FF571-B81A-4869-BE37-7EA4BB6F223A}.exeC:\Windows\{A75FF571-B81A-4869-BE37-7EA4BB6F223A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3CA05664-F5FD-4d80-9FFB-376384B9C945}.exeC:\Windows\{3CA05664-F5FD-4d80-9FFB-376384B9C945}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A75FF~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6865F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8DB67~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E679~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6EE39~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B1B0~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3D0E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2881B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B7F0~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40954~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2881B078-B887-4d63-80C7-0B3399BE584F}.exe
{3CA05664-F5FD-4d80-9FFB-376384B9C945}.exe
{4095400D-97B9-4b58-BEAF-87C12BD9C5CF}.exe
{4B7F083A-029C-48da-8B63-99B158660849}.exe
{5E6792B1-6801-4575-94BC-810DA7E12575}.exe
{6865FBB6-D8AE-402c-BAD7-7581B5D40179}.exe
{6EE39D44-3E80-459d-BDEA-A71DA8E9B433}.exe
{7B1B05F5-3728-4ab4-93A5-1E43C2885C69}.exe
{8DB673B8-F708-436b-8A44-86B57DEBDA76}.exe
{A75FF571-B81A-4869-BE37-7EA4BB6F223A}.exe
{E3D0E538-BB78-4a90-BA08-F1190EF0B9C7}.exe
memory/244-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/244-50-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1056-76-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1056-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1192-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1192-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1192-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1840-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1840-23-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1840-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1968-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1968-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3292-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3536-14-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3536-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3796-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3796-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4208-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4208-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4512-48-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4512-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5168-43-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5168-36-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5940-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5940-12-0x0000000000400000-0x0000000000411000-memory.dmp