Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 10:18
General
- Target 2026-07-23_04368989cd4ec96a595f6cec2fe13bc2_elex_rincux_wannacry.exe
- Size 64KB
- Sample260723-mcdfyazyhs
- SHA256 38b1de8928cea3bdc8643aba92b4b362bf5ab9c5d25d12614bfc0812ed32fc1d
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Detects Windows executables referencing non-Windows User-Agents 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_04368989cd4ec96a595f6cec2fe13bc2_elex_rincux_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_04368989cd4ec96a595f6cec2fe13bc2_elex_rincux_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFF2BF4D-2602-4cf4-9DFF-09D53ABCBD42}.exeC:\Windows\{BFF2BF4D-2602-4cf4-9DFF-09D53ABCBD42}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FBF1165-783C-403f-9AC7-9C20D8E4F372}.exeC:\Windows\{0FBF1165-783C-403f-9AC7-9C20D8E4F372}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B27F557-9D6F-4cdd-8779-A82B7CEE52D0}.exeC:\Windows\{4B27F557-9D6F-4cdd-8779-A82B7CEE52D0}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{836C45DB-60CF-44cc-A8CD-D3EE319D46F4}.exeC:\Windows\{836C45DB-60CF-44cc-A8CD-D3EE319D46F4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4D7C51E3-B066-4908-94DA-4DCBF0401CC0}.exeC:\Windows\{4D7C51E3-B066-4908-94DA-4DCBF0401CC0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D535589-F5D4-41ec-9538-F9718B7C86B0}.exeC:\Windows\{1D535589-F5D4-41ec-9538-F9718B7C86B0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A39A156-E114-47d7-8304-35939BE3B732}.exeC:\Windows\{3A39A156-E114-47d7-8304-35939BE3B732}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7154A65A-3903-4d32-9F1E-3D87713C7ED1}.exeC:\Windows\{7154A65A-3903-4d32-9F1E-3D87713C7ED1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8CD43BB-E8C3-42e6-9682-8E26E98382B7}.exeC:\Windows\{E8CD43BB-E8C3-42e6-9682-8E26E98382B7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03D69E29-57A9-4569-B1DA-7DDD7CB345FD}.exeC:\Windows\{03D69E29-57A9-4569-B1DA-7DDD7CB345FD}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32DCDBCF-10F5-416a-9E6C-BE283F46C499}.exeC:\Windows\{32DCDBCF-10F5-416a-9E6C-BE283F46C499}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03D69~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8CD4~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7154A~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A39A~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D535~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D7C5~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{836C4~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B27F~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FBF1~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFF2B~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{03D69E29-57A9-4569-B1DA-7DDD7CB345FD}.exe
{0FBF1165-783C-403f-9AC7-9C20D8E4F372}.exe
{1D535589-F5D4-41ec-9538-F9718B7C86B0}.exe
{32DCDBCF-10F5-416a-9E6C-BE283F46C499}.exe
{3A39A156-E114-47d7-8304-35939BE3B732}.exe
{4B27F557-9D6F-4cdd-8779-A82B7CEE52D0}.exe
{4D7C51E3-B066-4908-94DA-4DCBF0401CC0}.exe
{7154A65A-3903-4d32-9F1E-3D87713C7ED1}.exe
{836C45DB-60CF-44cc-A8CD-D3EE319D46F4}.exe
{BFF2BF4D-2602-4cf4-9DFF-09D53ABCBD42}.exe
{E8CD43BB-E8C3-42e6-9682-8E26E98382B7}.exe
memory/916-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/916-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/916-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/992-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/992-61-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1108-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1108-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1568-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1748-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1748-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2000-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2000-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3640-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3640-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3816-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3816-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4220-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4220-75-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4384-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4384-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4508-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4508-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4816-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4816-15-0x0000000000400000-0x0000000000410000-memory.dmp