Overview

overview

10

Static

static

10

2026-07-15...ry.exe

windows10-2004-x64

10

2026-07-15...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/07/2026, 15:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-15_8586a64825ffd4268e232e0652b28e33_elex_wannacry.exe
  • Size 80KB
  • Sample260715-styfbsax3x
  • SHA256 5d9b636d7fd5b4490ee0856f5767ac6417c412534c3310046b1e868c4dfb50d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverystormserpersistenceupxworm

Malware Config

Signatures

  • Family: Stormser, StormDDoS, StormAttack, Stormer

    Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.

    wormstormser
  • Detects Stormser aka Storm DDoS and StormAttack 44 IoCs
  • UPX dump on OEP (original entry point) 44 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 11 IoCs
  • UPX packed file 44 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_8586a64825ffd4268e232e0652b28e33_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_8586a64825ffd4268e232e0652b28e33_elex_wannacry.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4164
    • C:\Windows\{3B573DCA-521C-45bb-9AF2-B4B37A621C9A}.exe
      C:\Windows\{3B573DCA-521C-45bb-9AF2-B4B37A621C9A}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:736
      • C:\Windows\{1D456272-0CC6-4bf0-A37F-702C90E313FA}.exe
        C:\Windows\{1D456272-0CC6-4bf0-A37F-702C90E313FA}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4168
        • C:\Windows\{2F4C6BEC-B545-4c8f-99B1-FAA3DABB8A71}.exe
          C:\Windows\{2F4C6BEC-B545-4c8f-99B1-FAA3DABB8A71}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Windows\{7B24D9C6-1DA9-4848-B5E2-88D7474F89D0}.exe
            C:\Windows\{7B24D9C6-1DA9-4848-B5E2-88D7474F89D0}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4108
            • C:\Windows\{B871E7C5-C2E7-4cb6-B91D-6E45E2431FF4}.exe
              C:\Windows\{B871E7C5-C2E7-4cb6-B91D-6E45E2431FF4}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2280
              • C:\Windows\{9EE163AF-5FEE-457a-B0D3-0E0972585F62}.exe
                C:\Windows\{9EE163AF-5FEE-457a-B0D3-0E0972585F62}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:220
                • C:\Windows\{FE2889D4-6A57-4c2e-B6CC-FEF6D81A2AB9}.exe
                  C:\Windows\{FE2889D4-6A57-4c2e-B6CC-FEF6D81A2AB9}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:748
                  • C:\Windows\{D4C73775-6F7A-4ee1-8D29-4262B389AA78}.exe
                    C:\Windows\{D4C73775-6F7A-4ee1-8D29-4262B389AA78}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1136
                    • C:\Windows\{552595E6-C93B-4a6a-A00E-0DBD3DABF781}.exe
                      C:\Windows\{552595E6-C93B-4a6a-A00E-0DBD3DABF781}.exe
                      10⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2052
                      • C:\Windows\{C19E20F3-98AC-4cd5-8EF4-1461A77BB65E}.exe
                        C:\Windows\{C19E20F3-98AC-4cd5-8EF4-1461A77BB65E}.exe
                        11⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4644
                        • C:\Windows\{6DD02CBE-8AF0-40e8-BA00-F864528FB627}.exe
                          C:\Windows\{6DD02CBE-8AF0-40e8-BA00-F864528FB627}.exe
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2200
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{C19E2~1.EXE > nul
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:556
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{55259~1.EXE > nul
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:3964
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{D4C73~1.EXE > nul
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:3916
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{FE288~1.EXE > nul
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:2348
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{9EE16~1.EXE > nul
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1684
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{B871E~1.EXE > nul
                7⤵
                • System Location Discovery: System Language Discovery
                PID:888
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{7B24D~1.EXE > nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4424
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{2F4C6~1.EXE > nul
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1188
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{1D456~1.EXE > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4520
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B573~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3340
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        {1D456272-0CC6-4bf0-A37F-702C90E313FA}.exe
        • Path C:\Windows\{1D456272-0CC6-4bf0-A37F-702C90E313FA}.exe
        • Size 80KB
        • SHA256 f6db9aa3d4dc4778b6d16ceea46039712b6aba748d2bb8b668db143aa53ef5dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {2F4C6BEC-B545-4c8f-99B1-FAA3DABB8A71}.exe
        • Path C:\Windows\{2F4C6BEC-B545-4c8f-99B1-FAA3DABB8A71}.exe
        • Size 80KB
        • SHA256 81f7a316f7d048186ee64a051ec3eac784e5cbe1b411cf702ae8930f12cd64f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {3B573DCA-521C-45bb-9AF2-B4B37A621C9A}.exe
        • Path C:\Windows\{3B573DCA-521C-45bb-9AF2-B4B37A621C9A}.exe
        • Size 80KB
        • SHA256 ce839cf0a355759ad821c80d78e096fea7ef8ba1e4991c540f5f5a8ce6d543ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {552595E6-C93B-4a6a-A00E-0DBD3DABF781}.exe
        • Path C:\Windows\{552595E6-C93B-4a6a-A00E-0DBD3DABF781}.exe
        • Size 80KB
        • SHA256 2ae49e1dd863ed92b537a71e5870d5c5573cf4536ac984ac3ee83ff7bc1a35b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {6DD02CBE-8AF0-40e8-BA00-F864528FB627}.exe
        • Path C:\Windows\{6DD02CBE-8AF0-40e8-BA00-F864528FB627}.exe
        • Size 80KB
        • SHA256 e76b713c1d7181a432ff60c19dfbd3999ee30ada13e44f9ce3e69b8688328021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {7B24D9C6-1DA9-4848-B5E2-88D7474F89D0}.exe
        • Path C:\Windows\{7B24D9C6-1DA9-4848-B5E2-88D7474F89D0}.exe
        • Size 80KB
        • SHA256 770c3f294e4b549801e2f2bcfd99ef796436c3d0cfb9db8b0b62402dc605bf38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {9EE163AF-5FEE-457a-B0D3-0E0972585F62}.exe
        • Path C:\Windows\{9EE163AF-5FEE-457a-B0D3-0E0972585F62}.exe
        • Size 80KB
        • SHA256 8f6d9904a3ecf869f6cf2d6c87747df64a037ace1bba9a596c4fb3cbb83c376c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {B871E7C5-C2E7-4cb6-B91D-6E45E2431FF4}.exe
        • Path C:\Windows\{B871E7C5-C2E7-4cb6-B91D-6E45E2431FF4}.exe
        • Size 80KB
        • SHA256 bc6efabfa5fb8629b68d1f651a5cfc7186cfb559687a63b5f72a0f3f531514a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {C19E20F3-98AC-4cd5-8EF4-1461A77BB65E}.exe
        • Path C:\Windows\{C19E20F3-98AC-4cd5-8EF4-1461A77BB65E}.exe
        • Size 80KB
        • SHA256 2ea1e1d3b7f9b1d144d99b614c8501ec61739b57d3aa919e291d7a115e042bcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {D4C73775-6F7A-4ee1-8D29-4262B389AA78}.exe
        • Path C:\Windows\{D4C73775-6F7A-4ee1-8D29-4262B389AA78}.exe
        • Size 80KB
        • SHA256 98860b4a8e35c45fc395bf2a077eb43e7a0af00819b2e85c771aba7e70da1286
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {FE2889D4-6A57-4c2e-B6CC-FEF6D81A2AB9}.exe
        • Path C:\Windows\{FE2889D4-6A57-4c2e-B6CC-FEF6D81A2AB9}.exe
        • Size 80KB
        • SHA256 ea277f89e915d5a87970e5152d67a52a1b8ae18f541f7bed38351cfa15659814
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/220-40-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/220-42-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/220-47-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/736-5-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/736-8-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/736-12-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/748-52-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/748-49-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/748-46-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1136-60-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1136-56-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/1136-54-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2052-63-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2052-68-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2052-62-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2200-76-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2280-39-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2280-35-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4108-34-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4108-29-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4108-27-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4164-1-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4164-6-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4164-0-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4168-13-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4168-19-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4168-15-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4596-20-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4596-22-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4596-26-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4644-69-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4644-70-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/4644-74-0x0000000000400000-0x0000000000413000-memory.dmp
        Download