Analysis
- max time kernel
148s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
15/07/2026, 02:14
General
- Target 2026-07-15_b0224d5d3ff79a9fb3266fde5e83692d_elex_wannacry.exe
- Size 60KB
- Sample260715-cn5pfscv3x
- SHA256 0535a42982cac1091b5216c50ba39e7f36c57a94ef5937904511c94b40caa61c
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_b0224d5d3ff79a9fb3266fde5e83692d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_b0224d5d3ff79a9fb3266fde5e83692d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{140A511D-E2A5-4bf9-8A97-66CFD3B804FE}.exeC:\Windows\{140A511D-E2A5-4bf9-8A97-66CFD3B804FE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{716E83F3-0B63-4854-A22C-BA0188C1346F}.exeC:\Windows\{716E83F3-0B63-4854-A22C-BA0188C1346F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FE1F0DA-75FC-4dd9-BF96-C3B22C7DAF9F}.exeC:\Windows\{2FE1F0DA-75FC-4dd9-BF96-C3B22C7DAF9F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A606EAA1-8801-4f69-94CA-4ED4987695AA}.exeC:\Windows\{A606EAA1-8801-4f69-94CA-4ED4987695AA}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF6F45C8-61E0-4350-9AED-9211D34B7D86}.exeC:\Windows\{DF6F45C8-61E0-4350-9AED-9211D34B7D86}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{34EF9B46-729B-414b-B010-B7DC3863F9E9}.exeC:\Windows\{34EF9B46-729B-414b-B010-B7DC3863F9E9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51AAD12F-34A4-4621-ABCA-AF42E84401E1}.exeC:\Windows\{51AAD12F-34A4-4621-ABCA-AF42E84401E1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7AF3966B-F8DD-414d-B88A-7CDDB5DFFD00}.exeC:\Windows\{7AF3966B-F8DD-414d-B88A-7CDDB5DFFD00}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{879175C4-C711-4fee-B89B-FBA0A103A3EA}.exeC:\Windows\{879175C4-C711-4fee-B89B-FBA0A103A3EA}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A456872D-F0F6-45bc-BFC2-6FD64F45C035}.exeC:\Windows\{A456872D-F0F6-45bc-BFC2-6FD64F45C035}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{30A2CADF-8E4C-4aaa-831A-F7B0FB72CAE3}.exeC:\Windows\{30A2CADF-8E4C-4aaa-831A-F7B0FB72CAE3}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4568~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87917~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7AF39~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51AAD~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34EF9~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF6F4~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A606E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FE1F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{716E8~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{140A5~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{140A511D-E2A5-4bf9-8A97-66CFD3B804FE}.exe
{2FE1F0DA-75FC-4dd9-BF96-C3B22C7DAF9F}.exe
{30A2CADF-8E4C-4aaa-831A-F7B0FB72CAE3}.exe
{34EF9B46-729B-414b-B010-B7DC3863F9E9}.exe
{51AAD12F-34A4-4621-ABCA-AF42E84401E1}.exe
{716E83F3-0B63-4854-A22C-BA0188C1346F}.exe
{7AF3966B-F8DD-414d-B88A-7CDDB5DFFD00}.exe
{879175C4-C711-4fee-B89B-FBA0A103A3EA}.exe
{A456872D-F0F6-45bc-BFC2-6FD64F45C035}.exe
{A606EAA1-8801-4f69-94CA-4ED4987695AA}.exe
{DF6F45C8-61E0-4350-9AED-9211D34B7D86}.exe