Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 15:39
General
- Target 2026-04-15_3e242f2bb3884f40f8dce231c9754123_elex_wannacry.exe
- Size 64KB
- Sample260415-s3nbqact2l
- SHA256 b124e097d0441956ef131693b0df9cb5f352b6a8b8714f8fb9b9761223510691
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 32 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 32 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_3e242f2bb3884f40f8dce231c9754123_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_3e242f2bb3884f40f8dce231c9754123_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9F91FB6-2CDB-4cf0-9DD6-E01F9415FAFC}.exeC:\Windows\{F9F91FB6-2CDB-4cf0-9DD6-E01F9415FAFC}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B562D602-5E04-402d-90F6-7CF6550561EF}.exeC:\Windows\{B562D602-5E04-402d-90F6-7CF6550561EF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A5DD9A7-E3E4-44ec-9B86-729AE6FAE816}.exeC:\Windows\{8A5DD9A7-E3E4-44ec-9B86-729AE6FAE816}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F6F59621-5916-437a-8A1E-72C8FCF8735F}.exeC:\Windows\{F6F59621-5916-437a-8A1E-72C8FCF8735F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FE14998-2769-47ff-A6CA-1CA1E40BC602}.exeC:\Windows\{0FE14998-2769-47ff-A6CA-1CA1E40BC602}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76AA7822-4D3B-4cea-940A-20CDA113C321}.exeC:\Windows\{76AA7822-4D3B-4cea-940A-20CDA113C321}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D4D1882C-CEBA-4a2b-B805-582DAF05277D}.exeC:\Windows\{D4D1882C-CEBA-4a2b-B805-582DAF05277D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52B7CECB-E9F6-4d39-B31A-56B1C7B8AA39}.exeC:\Windows\{52B7CECB-E9F6-4d39-B31A-56B1C7B8AA39}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{34E50021-DD27-4671-A0CD-30CE2005552F}.exeC:\Windows\{34E50021-DD27-4671-A0CD-30CE2005552F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{95FDD994-22B5-4192-A001-6DA5423FC89C}.exeC:\Windows\{95FDD994-22B5-4192-A001-6DA5423FC89C}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34E50~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52B7C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4D18~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76AA7~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FE14~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6F59~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A5DD~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B562D~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9F91~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0FE14998-2769-47ff-A6CA-1CA1E40BC602}.exe
{34E50021-DD27-4671-A0CD-30CE2005552F}.exe
{52B7CECB-E9F6-4d39-B31A-56B1C7B8AA39}.exe
{76AA7822-4D3B-4cea-940A-20CDA113C321}.exe
{8A5DD9A7-E3E4-44ec-9B86-729AE6FAE816}.exe
{95FDD994-22B5-4192-A001-6DA5423FC89C}.exe
{B562D602-5E04-402d-90F6-7CF6550561EF}.exe
{D4D1882C-CEBA-4a2b-B805-582DAF05277D}.exe
{F6F59621-5916-437a-8A1E-72C8FCF8735F}.exe
{F9F91FB6-2CDB-4cf0-9DD6-E01F9415FAFC}.exe
memory/1176-60-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1176-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1396-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2552-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2552-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2724-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2724-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2916-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2916-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2916-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3200-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3200-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3704-61-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3984-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3984-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4816-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4816-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4816-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5072-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5072-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5092-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5092-48-0x0000000000400000-0x0000000000410000-memory.dmp