Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 13:53
General
- Target 2026-04-15_08726bb060e0cff51adb265f37b03ba2_elex_wannacry.exe
- Size 64KB
- Sample260415-q7ffkaf13p
- SHA256 8dba1648f5e6fd797031b7f7ccb3c763096002d02d85135c779b952b43b0d847
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_08726bb060e0cff51adb265f37b03ba2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_08726bb060e0cff51adb265f37b03ba2_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0483CB0A-D5E3-477f-B91D-170F9705754C}.exeC:\Windows\{0483CB0A-D5E3-477f-B91D-170F9705754C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17912B81-9207-40d6-A778-E5E933E94789}.exeC:\Windows\{17912B81-9207-40d6-A778-E5E933E94789}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF85A44E-6FA2-40f9-922D-3C37375BAA9C}.exeC:\Windows\{FF85A44E-6FA2-40f9-922D-3C37375BAA9C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C9B9B392-6CBD-4a12-8D43-4CFBC3815CD9}.exeC:\Windows\{C9B9B392-6CBD-4a12-8D43-4CFBC3815CD9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{45616B2C-E050-4246-9048-16B1FAF58CEC}.exeC:\Windows\{45616B2C-E050-4246-9048-16B1FAF58CEC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4EF6FE56-ECB9-4e08-9F6A-B9C9121C1796}.exeC:\Windows\{4EF6FE56-ECB9-4e08-9F6A-B9C9121C1796}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F490A25E-5A67-4b14-9C9D-41C69F544B6F}.exeC:\Windows\{F490A25E-5A67-4b14-9C9D-41C69F544B6F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4774A4D3-D347-419c-B17C-66CDC2F5F4F0}.exeC:\Windows\{4774A4D3-D347-419c-B17C-66CDC2F5F4F0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{094F49F4-D946-4bc3-826F-FAFE08D0818A}.exeC:\Windows\{094F49F4-D946-4bc3-826F-FAFE08D0818A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C1567C8B-4B8C-4749-BB99-895F48DED0DA}.exeC:\Windows\{C1567C8B-4B8C-4749-BB99-895F48DED0DA}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{094F4~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4774A~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F490A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4EF6F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45616~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9B9B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF85A~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17912~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0483C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0483CB0A-D5E3-477f-B91D-170F9705754C}.exe
{094F49F4-D946-4bc3-826F-FAFE08D0818A}.exe
{17912B81-9207-40d6-A778-E5E933E94789}.exe
{45616B2C-E050-4246-9048-16B1FAF58CEC}.exe
{4774A4D3-D347-419c-B17C-66CDC2F5F4F0}.exe
{4EF6FE56-ECB9-4e08-9F6A-B9C9121C1796}.exe
{C1567C8B-4B8C-4749-BB99-895F48DED0DA}.exe
{C9B9B392-6CBD-4a12-8D43-4CFBC3815CD9}.exe
{F490A25E-5A67-4b14-9C9D-41C69F544B6F}.exe
{FF85A44E-6FA2-40f9-922D-3C37375BAA9C}.exe
memory/1612-28-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/1612-24-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/2256-15-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/2256-12-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/2304-30-0x0000000000B80000-0x0000000000BA5000-memory.dmp
memory/2304-34-0x0000000000B80000-0x0000000000BA5000-memory.dmp
memory/2372-42-0x0000000000670000-0x0000000000695000-memory.dmp
memory/2372-46-0x0000000000670000-0x0000000000695000-memory.dmp
memory/3020-48-0x0000000000A30000-0x0000000000A55000-memory.dmp
memory/3020-52-0x0000000000A30000-0x0000000000A55000-memory.dmp
memory/3028-54-0x0000000000B90000-0x0000000000BB5000-memory.dmp
memory/3028-58-0x0000000000B90000-0x0000000000BB5000-memory.dmp
memory/4248-40-0x0000000000A30000-0x0000000000A55000-memory.dmp
memory/4248-36-0x0000000000A30000-0x0000000000A55000-memory.dmp
memory/4292-0-0x0000000000630000-0x0000000000655000-memory.dmp
memory/4292-5-0x0000000000630000-0x0000000000655000-memory.dmp
memory/4476-10-0x0000000000A50000-0x0000000000A75000-memory.dmp
memory/4476-6-0x0000000000A50000-0x0000000000A75000-memory.dmp
memory/5004-18-0x0000000000A50000-0x0000000000A75000-memory.dmp
memory/5004-22-0x0000000000A50000-0x0000000000A75000-memory.dmp