Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 15:39
General
- Target 2026-04-15_3e242f2bb3884f40f8dce231c9754123_elex_wannacry.exe
- Size 64KB
- Sample260415-s3nbqact2l
- SHA256 b124e097d0441956ef131693b0df9cb5f352b6a8b8714f8fb9b9761223510691
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 37 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 37 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_3e242f2bb3884f40f8dce231c9754123_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_3e242f2bb3884f40f8dce231c9754123_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{706DACDD-D48F-43ff-9195-CE5F5E09F384}.exeC:\Windows\{706DACDD-D48F-43ff-9195-CE5F5E09F384}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1BD99FD5-72EB-4654-A16E-889B74402C87}.exeC:\Windows\{1BD99FD5-72EB-4654-A16E-889B74402C87}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{620E07EE-49B9-4deb-A9CD-BADD46A0BA94}.exeC:\Windows\{620E07EE-49B9-4deb-A9CD-BADD46A0BA94}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58BF91CA-FEA7-4f7b-BAF2-957531D2F271}.exeC:\Windows\{58BF91CA-FEA7-4f7b-BAF2-957531D2F271}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F8CACDC5-4FA0-410e-84BE-24EF6289C3AB}.exeC:\Windows\{F8CACDC5-4FA0-410e-84BE-24EF6289C3AB}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3E180BD-9F65-4b21-A07F-5421E7588BB9}.exeC:\Windows\{A3E180BD-9F65-4b21-A07F-5421E7588BB9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{557EA034-AEE5-44c6-9C2C-A5F8050776F8}.exeC:\Windows\{557EA034-AEE5-44c6-9C2C-A5F8050776F8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77E941E5-95E7-4523-9E43-0A7674F07F9F}.exeC:\Windows\{77E941E5-95E7-4523-9E43-0A7674F07F9F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A393B716-46A5-43c9-9C16-0594A3F46A66}.exeC:\Windows\{A393B716-46A5-43c9-9C16-0594A3F46A66}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B77E3B2-A524-4cd2-AF70-974F62343063}.exeC:\Windows\{0B77E3B2-A524-4cd2-AF70-974F62343063}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75C96478-B718-4c4f-8D14-3BC2EEA09AF1}.exeC:\Windows\{75C96478-B718-4c4f-8D14-3BC2EEA09AF1}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B77E~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A393B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77E94~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{557EA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3E18~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8CAC~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58BF9~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{620E0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1BD99~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{706DA~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0B77E3B2-A524-4cd2-AF70-974F62343063}.exe
{1BD99FD5-72EB-4654-A16E-889B74402C87}.exe
{557EA034-AEE5-44c6-9C2C-A5F8050776F8}.exe
{58BF91CA-FEA7-4f7b-BAF2-957531D2F271}.exe
{620E07EE-49B9-4deb-A9CD-BADD46A0BA94}.exe
{706DACDD-D48F-43ff-9195-CE5F5E09F384}.exe
{75C96478-B718-4c4f-8D14-3BC2EEA09AF1}.exe
{77E941E5-95E7-4523-9E43-0A7674F07F9F}.exe
{A393B716-46A5-43c9-9C16-0594A3F46A66}.exe
{A3E180BD-9F65-4b21-A07F-5421E7588BB9}.exe
{F8CACDC5-4FA0-410e-84BE-24EF6289C3AB}.exe
memory/632-63-0x0000000000720000-0x00000000009A1000-memory.dmp
memory/632-58-0x0000000000720000-0x00000000009A1000-memory.dmp
memory/632-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/632-59-0x0000000000400000-0x0000000000410000-memory.dmp
memory/632-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/812-84-0x00000000007D0000-0x0000000000A51000-memory.dmp
memory/812-89-0x00000000007D0000-0x0000000000A51000-memory.dmp
memory/812-90-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1692-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1692-42-0x00000000007D0000-0x0000000000A51000-memory.dmp
memory/1692-48-0x00000000007D0000-0x0000000000A51000-memory.dmp
memory/1692-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1692-38-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2068-18-0x0000000000830000-0x0000000000AB1000-memory.dmp
memory/2068-21-0x0000000000830000-0x0000000000AB1000-memory.dmp
memory/2068-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2068-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3104-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3104-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3104-1-0x00000000009D0000-0x0000000000C51000-memory.dmp
memory/3104-2-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3104-5-0x00000000009D0000-0x0000000000C51000-memory.dmp
memory/3192-91-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3984-10-0x0000000000830000-0x0000000000AB1000-memory.dmp
memory/3984-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3984-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3984-15-0x0000000000830000-0x0000000000AB1000-memory.dmp
memory/4172-73-0x0000000000740000-0x00000000009C1000-memory.dmp
memory/4172-68-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4172-66-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4172-74-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4172-67-0x0000000000740000-0x00000000009C1000-memory.dmp
memory/4444-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4444-81-0x0000000000770000-0x00000000009F1000-memory.dmp
memory/4444-83-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4444-75-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4444-76-0x0000000000770000-0x00000000009F1000-memory.dmp
memory/4456-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4456-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4456-39-0x00000000007E0000-0x0000000000A61000-memory.dmp
memory/4456-34-0x00000000007E0000-0x0000000000A61000-memory.dmp
memory/4680-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4680-26-0x00000000007F0000-0x0000000000A71000-memory.dmp
memory/4680-32-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4680-31-0x00000000007F0000-0x0000000000A71000-memory.dmp
memory/4976-54-0x00000000007E0000-0x0000000000A61000-memory.dmp
memory/4976-50-0x00000000007E0000-0x0000000000A61000-memory.dmp
memory/4976-56-0x0000000000400000-0x0000000000410000-memory.dmp