Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/07/2026, 01:59
General
- Target 2026-07-15_43d5e3ff2ced17eef9a7737a14878fd1_elex_wannacry.exe
- Size 64KB
- Sample260716-celj8aes8s
- SHA256 874b49bd2f382015d3a719c13f7a50f6984cb0cfd35a87cd6af533c9456c7df2
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_43d5e3ff2ced17eef9a7737a14878fd1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_43d5e3ff2ced17eef9a7737a14878fd1_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A83C71D6-D24C-48d3-92B6-BE1501E58DB0}.exeC:\Windows\{A83C71D6-D24C-48d3-92B6-BE1501E58DB0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F832441B-4C07-46c3-B443-B4E58B563396}.exeC:\Windows\{F832441B-4C07-46c3-B443-B4E58B563396}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FEC70AFD-C48F-4065-9929-80084E1B310C}.exeC:\Windows\{FEC70AFD-C48F-4065-9929-80084E1B310C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F63D7D7-D333-4741-BF8D-8A71876D5131}.exeC:\Windows\{4F63D7D7-D333-4741-BF8D-8A71876D5131}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13BC29A4-EB58-4dea-806C-2BD60190988E}.exeC:\Windows\{13BC29A4-EB58-4dea-806C-2BD60190988E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC4099AA-6ED1-40b9-A0A3-C8A14A388684}.exeC:\Windows\{DC4099AA-6ED1-40b9-A0A3-C8A14A388684}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2F69CD8-4BFF-41d9-A6BE-966DE4FA61F7}.exeC:\Windows\{F2F69CD8-4BFF-41d9-A6BE-966DE4FA61F7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{518C164D-B3A5-4167-9A80-870748583657}.exeC:\Windows\{518C164D-B3A5-4167-9A80-870748583657}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A49DACB-328C-458f-A908-661DA867B549}.exeC:\Windows\{6A49DACB-328C-458f-A908-661DA867B549}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D22D78D-6B1E-4338-A41A-6E7286C79016}.exeC:\Windows\{1D22D78D-6B1E-4338-A41A-6E7286C79016}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A94F7516-3F10-473a-9C54-202B17BC9BBF}.exeC:\Windows\{A94F7516-3F10-473a-9C54-202B17BC9BBF}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D22D~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A49D~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{518C1~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2F69~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC409~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13BC2~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F63D~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FEC70~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8324~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A83C7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{13BC29A4-EB58-4dea-806C-2BD60190988E}.exe
{1D22D78D-6B1E-4338-A41A-6E7286C79016}.exe
{4F63D7D7-D333-4741-BF8D-8A71876D5131}.exe
{518C164D-B3A5-4167-9A80-870748583657}.exe
{6A49DACB-328C-458f-A908-661DA867B549}.exe
{A83C71D6-D24C-48d3-92B6-BE1501E58DB0}.exe
{A94F7516-3F10-473a-9C54-202B17BC9BBF}.exe
{DC4099AA-6ED1-40b9-A0A3-C8A14A388684}.exe
{F2F69CD8-4BFF-41d9-A6BE-966DE4FA61F7}.exe
{F832441B-4C07-46c3-B443-B4E58B563396}.exe
{FEC70AFD-C48F-4065-9929-80084E1B310C}.exe
memory/368-38-0x0000000000400000-0x0000000000410000-memory.dmp
memory/368-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/700-61-0x0000000000400000-0x0000000000410000-memory.dmp
memory/700-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1128-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2076-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2076-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2428-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2428-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2544-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2544-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3364-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3364-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3412-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3412-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3652-66-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4012-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4012-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4012-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4976-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4976-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4976-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5004-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5004-42-0x0000000000400000-0x0000000000410000-memory.dmp