Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 12:08
General
- Target 2026-04-15_d228c682c574a5c98c1e7bed0fb2835c_elex_wannacry.exe
- Size 372KB
- Sample260415-pbcjcsf12z
- SHA256 bfd245f85487294c59d6baccab38eaf2dfee92e8c04de8ca9836657b06fef220
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_d228c682c574a5c98c1e7bed0fb2835c_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_d228c682c574a5c98c1e7bed0fb2835c_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B4976EAE-B981-4e88-9DE3-CA482F13AF2C}.exeC:\Windows\{B4976EAE-B981-4e88-9DE3-CA482F13AF2C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2C85EEE-9CEB-4e85-A9E6-2587697D5632}.exeC:\Windows\{A2C85EEE-9CEB-4e85-A9E6-2587697D5632}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87C1E8E4-02B2-4c05-964F-1C232BB56FC3}.exeC:\Windows\{87C1E8E4-02B2-4c05-964F-1C232BB56FC3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{68850E2E-2297-45a0-B7B3-234C447663F0}.exeC:\Windows\{68850E2E-2297-45a0-B7B3-234C447663F0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9CFD17B-D974-45f2-8A75-EB737AA62DDF}.exeC:\Windows\{B9CFD17B-D974-45f2-8A75-EB737AA62DDF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CFE46172-38E9-45b6-AD37-B58DD8A3DE37}.exeC:\Windows\{CFE46172-38E9-45b6-AD37-B58DD8A3DE37}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A178F844-CEDF-4577-B8B3-315C268AA49C}.exeC:\Windows\{A178F844-CEDF-4577-B8B3-315C268AA49C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5CA659BF-3DFC-47b9-BECF-75E62312D4B0}.exeC:\Windows\{5CA659BF-3DFC-47b9-BECF-75E62312D4B0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B21F95AA-65E8-493a-9D18-25BB08372BCC}.exeC:\Windows\{B21F95AA-65E8-493a-9D18-25BB08372BCC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92781E3E-8F4A-48ca-888B-98B45453E88B}.exeC:\Windows\{92781E3E-8F4A-48ca-888B-98B45453E88B}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3F7E9699-6FF5-4906-A503-88C6DEDC32CB}.exeC:\Windows\{3F7E9699-6FF5-4906-A503-88C6DEDC32CB}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92781~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B21F9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CA65~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A178F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CFE46~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9CFD~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68850~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87C1E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2C85~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4976~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{3F7E9699-6FF5-4906-A503-88C6DEDC32CB}.exe
{5CA659BF-3DFC-47b9-BECF-75E62312D4B0}.exe
{68850E2E-2297-45a0-B7B3-234C447663F0}.exe
{87C1E8E4-02B2-4c05-964F-1C232BB56FC3}.exe
{92781E3E-8F4A-48ca-888B-98B45453E88B}.exe
{A178F844-CEDF-4577-B8B3-315C268AA49C}.exe
{A2C85EEE-9CEB-4e85-A9E6-2587697D5632}.exe
{B21F95AA-65E8-493a-9D18-25BB08372BCC}.exe
{B4976EAE-B981-4e88-9DE3-CA482F13AF2C}.exe
{B9CFD17B-D974-45f2-8A75-EB737AA62DDF}.exe
{CFE46172-38E9-45b6-AD37-B58DD8A3DE37}.exe
memory/1040-60-0x0000000000790000-0x0000000000817000-memory.dmp
memory/1040-64-0x0000000000790000-0x0000000000817000-memory.dmp
memory/1244-24-0x0000000000570000-0x00000000005F7000-memory.dmp
memory/1244-28-0x0000000000570000-0x00000000005F7000-memory.dmp
memory/2396-4-0x00000000005A0000-0x0000000000627000-memory.dmp
memory/2396-0-0x00000000005A0000-0x0000000000627000-memory.dmp
memory/3736-48-0x00000000007E0000-0x0000000000867000-memory.dmp
memory/3736-52-0x00000000007E0000-0x0000000000867000-memory.dmp
memory/4604-23-0x0000000000810000-0x0000000000897000-memory.dmp
memory/4604-18-0x0000000000810000-0x0000000000897000-memory.dmp
memory/5080-42-0x00000000005A0000-0x0000000000627000-memory.dmp
memory/5080-45-0x00000000005A0000-0x0000000000627000-memory.dmp
memory/5140-9-0x0000000000930000-0x00000000009B7000-memory.dmp
memory/5140-6-0x0000000000930000-0x00000000009B7000-memory.dmp
memory/5244-54-0x00000000006F0000-0x0000000000777000-memory.dmp
memory/5244-58-0x00000000006F0000-0x0000000000777000-memory.dmp
memory/5540-30-0x00000000007E0000-0x0000000000867000-memory.dmp
memory/5540-34-0x00000000007E0000-0x0000000000867000-memory.dmp
memory/5684-36-0x0000000000480000-0x0000000000507000-memory.dmp
memory/5684-40-0x0000000000480000-0x0000000000507000-memory.dmp
memory/5720-17-0x00000000008E0000-0x0000000000967000-memory.dmp
memory/5720-12-0x00000000008E0000-0x0000000000967000-memory.dmp