Analysis
- max time kernel
149s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 13:20
General
- Target 2026-04-15_049287ef0ba208976668babf5f4f0625_elex_wannacry.exe
- Size 79KB
- Sample260415-qlhnsshx9t
- SHA256 67f68a04ddad29bc3a1d9fb16dec926d5ca2ad8df6790a0f908d43807543ebb1
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_049287ef0ba208976668babf5f4f0625_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_049287ef0ba208976668babf5f4f0625_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D28982F3-D237-4bab-BE94-94CAE9F87538}.exeC:\Windows\{D28982F3-D237-4bab-BE94-94CAE9F87538}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E4C3575-EE3C-4fb7-8258-7A5C5011E451}.exeC:\Windows\{1E4C3575-EE3C-4fb7-8258-7A5C5011E451}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C21899B2-04AE-4741-81A0-84C582EA47D9}.exeC:\Windows\{C21899B2-04AE-4741-81A0-84C582EA47D9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2859BA0B-1F69-49fa-8DDC-D14819509A5A}.exeC:\Windows\{2859BA0B-1F69-49fa-8DDC-D14819509A5A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B1593A4-E320-4a39-99DC-E985CED62B22}.exeC:\Windows\{3B1593A4-E320-4a39-99DC-E985CED62B22}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D4992A36-B328-4071-A1B0-130AC72EEF2D}.exeC:\Windows\{D4992A36-B328-4071-A1B0-130AC72EEF2D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D4E889A9-B009-495f-9F61-5EA9E2BCD008}.exeC:\Windows\{D4E889A9-B009-495f-9F61-5EA9E2BCD008}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F02864D-22EB-4738-819F-1883D2B23217}.exeC:\Windows\{2F02864D-22EB-4738-819F-1883D2B23217}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{433641D7-4876-4a06-AFEC-CE1C31B1B85F}.exeC:\Windows\{433641D7-4876-4a06-AFEC-CE1C31B1B85F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{55403576-9614-45c7-B439-BF595E9612E7}.exeC:\Windows\{55403576-9614-45c7-B439-BF595E9612E7}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{728CC3B0-57D6-4d2a-8079-AB374AA0AAEE}.exeC:\Windows\{728CC3B0-57D6-4d2a-8079-AB374AA0AAEE}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55403~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{43364~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F028~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4E88~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4992~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B159~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2859B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2189~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E4C3~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2898~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1E4C3575-EE3C-4fb7-8258-7A5C5011E451}.exe
{2859BA0B-1F69-49fa-8DDC-D14819509A5A}.exe
{2F02864D-22EB-4738-819F-1883D2B23217}.exe
{3B1593A4-E320-4a39-99DC-E985CED62B22}.exe
{433641D7-4876-4a06-AFEC-CE1C31B1B85F}.exe
{55403576-9614-45c7-B439-BF595E9612E7}.exe
{728CC3B0-57D6-4d2a-8079-AB374AA0AAEE}.exe
{C21899B2-04AE-4741-81A0-84C582EA47D9}.exe
{D28982F3-D237-4bab-BE94-94CAE9F87538}.exe
{D4992A36-B328-4071-A1B0-130AC72EEF2D}.exe
{D4E889A9-B009-495f-9F61-5EA9E2BCD008}.exe
memory/672-34-0x0000000000880000-0x000000000093F000-memory.dmp
memory/672-30-0x0000000000880000-0x000000000093F000-memory.dmp
memory/864-46-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/864-42-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/952-24-0x0000000000720000-0x00000000007DF000-memory.dmp
memory/952-28-0x0000000000720000-0x00000000007DF000-memory.dmp
memory/2228-0-0x0000000000AA0000-0x0000000000B5F000-memory.dmp
memory/2228-4-0x0000000000AA0000-0x0000000000B5F000-memory.dmp
memory/2372-16-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/2372-12-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/2892-48-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/2892-52-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/3032-58-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/3032-54-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/3716-9-0x0000000000870000-0x000000000092F000-memory.dmp
memory/3716-6-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4724-36-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4724-40-0x0000000000870000-0x000000000092F000-memory.dmp
memory/5008-60-0x00000000009E0000-0x0000000000A9F000-memory.dmp
memory/5008-64-0x00000000009E0000-0x0000000000A9F000-memory.dmp
memory/5056-18-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/5056-22-0x0000000000830000-0x00000000008EF000-memory.dmp