Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 02:05
General
- Target 2026-07-15_2c37be78cf48a6aac67dba771f40a031_elex_wannacry.exe
- Size 60KB
- Sample260716-ch22daet6y
- SHA256 a5e67f944333168eda0aa0ef06ce9e14ccac98b99eb965e24eed47395f2fa0d7
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_2c37be78cf48a6aac67dba771f40a031_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_2c37be78cf48a6aac67dba771f40a031_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{297FA1CB-CBAE-48cf-9D18-2833DEE84F9E}.exeC:\Windows\{297FA1CB-CBAE-48cf-9D18-2833DEE84F9E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13AD20ED-19A8-4d47-85FB-C224FF778671}.exeC:\Windows\{13AD20ED-19A8-4d47-85FB-C224FF778671}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{588489A2-E7E2-422c-AC78-BA9938BB92A6}.exeC:\Windows\{588489A2-E7E2-422c-AC78-BA9938BB92A6}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B586DF28-AC81-454c-9376-FAD494E0C10F}.exeC:\Windows\{B586DF28-AC81-454c-9376-FAD494E0C10F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9ED70B70-EAFF-4352-9300-21B2F140CFC2}.exeC:\Windows\{9ED70B70-EAFF-4352-9300-21B2F140CFC2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE54BE2A-B28F-40c9-A049-C7D4682CCEC7}.exeC:\Windows\{DE54BE2A-B28F-40c9-A049-C7D4682CCEC7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A60260E-2045-4a9b-9BD2-0DA8867DCD03}.exeC:\Windows\{7A60260E-2045-4a9b-9BD2-0DA8867DCD03}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0D270DA8-FD79-480a-A51B-0625262A1917}.exeC:\Windows\{0D270DA8-FD79-480a-A51B-0625262A1917}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A02252FA-B3F8-47af-A4E5-93D52830A167}.exeC:\Windows\{A02252FA-B3F8-47af-A4E5-93D52830A167}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D2EADB38-0EB7-47fc-B6F6-422B93EA5456}.exeC:\Windows\{D2EADB38-0EB7-47fc-B6F6-422B93EA5456}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6004810A-9436-4802-974F-6CE0CAE97BFD}.exeC:\Windows\{6004810A-9436-4802-974F-6CE0CAE97BFD}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2EAD~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0225~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D270~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A602~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE54B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9ED70~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B586D~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58848~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13AD2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{297FA~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0D270DA8-FD79-480a-A51B-0625262A1917}.exe
{13AD20ED-19A8-4d47-85FB-C224FF778671}.exe
{297FA1CB-CBAE-48cf-9D18-2833DEE84F9E}.exe
{588489A2-E7E2-422c-AC78-BA9938BB92A6}.exe
{6004810A-9436-4802-974F-6CE0CAE97BFD}.exe
{7A60260E-2045-4a9b-9BD2-0DA8867DCD03}.exe
{9ED70B70-EAFF-4352-9300-21B2F140CFC2}.exe
{A02252FA-B3F8-47af-A4E5-93D52830A167}.exe
{B586DF28-AC81-454c-9376-FAD494E0C10F}.exe
{D2EADB38-0EB7-47fc-B6F6-422B93EA5456}.exe
{DE54BE2A-B28F-40c9-A049-C7D4682CCEC7}.exe