Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 17:26
General
- Target 2026-07-30_7ba93c8209b4c2b2aba8c4a1968d660f_elex_wannacry.exe
- Size 60KB
- Sample260730-vz7bjatblh
- SHA256 baa8bb5d756eadfc4f5516ee55e7ee6d47f2ec5056bb28e6ad9599ed14b0d831
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_7ba93c8209b4c2b2aba8c4a1968d660f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_7ba93c8209b4c2b2aba8c4a1968d660f_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52B06F5E-37B6-496a-8AAA-278A542222DD}.exeC:\Windows\{52B06F5E-37B6-496a-8AAA-278A542222DD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76751E91-2763-4e6d-9E97-1B3DA754ADCC}.exeC:\Windows\{76751E91-2763-4e6d-9E97-1B3DA754ADCC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7437601-C56D-48cb-AA77-F9E8D59B9201}.exeC:\Windows\{A7437601-C56D-48cb-AA77-F9E8D59B9201}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{867CB8C5-B270-4caa-97E1-D679BBCACCC3}.exeC:\Windows\{867CB8C5-B270-4caa-97E1-D679BBCACCC3}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{307DE60B-CE04-4655-99ED-132ABF9EE9FC}.exeC:\Windows\{307DE60B-CE04-4655-99ED-132ABF9EE9FC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E586A2F-37F2-48ca-8A77-54BE893E3DF9}.exeC:\Windows\{2E586A2F-37F2-48ca-8A77-54BE893E3DF9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52E4DEBD-35F3-4640-8E34-82A3AF80280F}.exeC:\Windows\{52E4DEBD-35F3-4640-8E34-82A3AF80280F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3AA2CC23-2E67-4d8d-A716-0E2369DE5B0F}.exeC:\Windows\{3AA2CC23-2E67-4d8d-A716-0E2369DE5B0F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F85A416E-F23C-47e7-9FC1-9B5AB33F68CB}.exeC:\Windows\{F85A416E-F23C-47e7-9FC1-9B5AB33F68CB}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FF478A1-0F82-47be-8C16-BFD1135EEE4A}.exeC:\Windows\{0FF478A1-0F82-47be-8C16-BFD1135EEE4A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E1F8AC5-1E71-4f1e-8676-30A014570065}.exeC:\Windows\{3E1F8AC5-1E71-4f1e-8676-30A014570065}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FF47~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F85A4~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3AA2C~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52E4D~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E586~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{307DE~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{867CB~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7437~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76751~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52B06~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0FF478A1-0F82-47be-8C16-BFD1135EEE4A}.exe
{2E586A2F-37F2-48ca-8A77-54BE893E3DF9}.exe
{307DE60B-CE04-4655-99ED-132ABF9EE9FC}.exe
{3AA2CC23-2E67-4d8d-A716-0E2369DE5B0F}.exe
{3E1F8AC5-1E71-4f1e-8676-30A014570065}.exe
{52B06F5E-37B6-496a-8AAA-278A542222DD}.exe
{52E4DEBD-35F3-4640-8E34-82A3AF80280F}.exe
{76751E91-2763-4e6d-9E97-1B3DA754ADCC}.exe
{867CB8C5-B270-4caa-97E1-D679BBCACCC3}.exe
{A7437601-C56D-48cb-AA77-F9E8D59B9201}.exe
{F85A416E-F23C-47e7-9FC1-9B5AB33F68CB}.exe