Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
16/04/2026, 07:56
General
- Target 2026-04-16_e27b467422c40eace9273904e5c1a3a8_elex_wannacry.exe
- Size 79KB
- Sample260416-js422sdz71
- SHA256 adbbfd439c8a949c760e2c8eee2ca49ad4b788f6f44d7460bd60d2cdc11dbcae
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_e27b467422c40eace9273904e5c1a3a8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_e27b467422c40eace9273904e5c1a3a8_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1C43C64-147A-480a-BFC3-7D7C79416C8D}.exeC:\Windows\{F1C43C64-147A-480a-BFC3-7D7C79416C8D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{791C07AE-A781-4ecf-9446-1A796CDF5AA1}.exeC:\Windows\{791C07AE-A781-4ecf-9446-1A796CDF5AA1}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E34E0234-CFBF-4871-8D41-080256938575}.exeC:\Windows\{E34E0234-CFBF-4871-8D41-080256938575}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E21F7F36-A347-4a5c-8BE7-ED888BEC56E4}.exeC:\Windows\{E21F7F36-A347-4a5c-8BE7-ED888BEC56E4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F602FDDD-E5BB-4480-81A7-65F820374CBF}.exeC:\Windows\{F602FDDD-E5BB-4480-81A7-65F820374CBF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B29B63F-6EE7-4d33-964D-15068AB2C70B}.exeC:\Windows\{1B29B63F-6EE7-4d33-964D-15068AB2C70B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A43A537-EA9C-460f-9D58-8C2B0981634C}.exeC:\Windows\{6A43A537-EA9C-460f-9D58-8C2B0981634C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C1F39E53-7E34-47c6-A643-C4485EBEA684}.exeC:\Windows\{C1F39E53-7E34-47c6-A643-C4485EBEA684}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6CB510BC-DEA5-42b3-A81B-DE8ADEED391D}.exeC:\Windows\{6CB510BC-DEA5-42b3-A81B-DE8ADEED391D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B92A0EE-F755-4e78-8155-BA3D787469E1}.exeC:\Windows\{6B92A0EE-F755-4e78-8155-BA3D787469E1}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1683018-A534-4e8e-B262-1599C1041029}.exeC:\Windows\{A1683018-A534-4e8e-B262-1599C1041029}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B92A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6CB51~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1F39~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A43A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B29B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F602F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E21F7~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E34E0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{791C0~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1C43~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1B29B63F-6EE7-4d33-964D-15068AB2C70B}.exe
{6A43A537-EA9C-460f-9D58-8C2B0981634C}.exe
{6B92A0EE-F755-4e78-8155-BA3D787469E1}.exe
{6CB510BC-DEA5-42b3-A81B-DE8ADEED391D}.exe
{791C07AE-A781-4ecf-9446-1A796CDF5AA1}.exe
{A1683018-A534-4e8e-B262-1599C1041029}.exe
{C1F39E53-7E34-47c6-A643-C4485EBEA684}.exe
{E21F7F36-A347-4a5c-8BE7-ED888BEC56E4}.exe
{E34E0234-CFBF-4871-8D41-080256938575}.exe
{F1C43C64-147A-480a-BFC3-7D7C79416C8D}.exe
{F602FDDD-E5BB-4480-81A7-65F820374CBF}.exe
memory/1188-58-0x0000000000430000-0x00000000004A5000-memory.dmp
memory/1188-54-0x0000000000430000-0x00000000004A5000-memory.dmp
memory/1216-60-0x0000000000500000-0x0000000000575000-memory.dmp
memory/1216-64-0x0000000000500000-0x0000000000575000-memory.dmp
memory/1480-48-0x0000000000430000-0x00000000004A5000-memory.dmp
memory/1480-51-0x0000000000430000-0x00000000004A5000-memory.dmp
memory/1696-34-0x0000000000890000-0x0000000000905000-memory.dmp
memory/1696-30-0x0000000000890000-0x0000000000905000-memory.dmp
memory/1712-18-0x0000000000750000-0x00000000007C5000-memory.dmp
memory/1712-22-0x0000000000750000-0x00000000007C5000-memory.dmp
memory/2316-12-0x0000000000850000-0x00000000008C5000-memory.dmp
memory/2316-16-0x0000000000850000-0x00000000008C5000-memory.dmp
memory/2428-42-0x0000000000550000-0x00000000005C5000-memory.dmp
memory/2428-46-0x0000000000550000-0x00000000005C5000-memory.dmp
memory/2824-0-0x00000000008B0000-0x0000000000925000-memory.dmp
memory/2824-3-0x00000000008B0000-0x0000000000925000-memory.dmp
memory/3772-9-0x00000000004A0000-0x0000000000515000-memory.dmp
memory/3772-6-0x00000000004A0000-0x0000000000515000-memory.dmp
memory/4204-24-0x0000000000500000-0x0000000000575000-memory.dmp
memory/4204-29-0x0000000000500000-0x0000000000575000-memory.dmp
memory/4232-39-0x0000000000500000-0x0000000000575000-memory.dmp
memory/4232-36-0x0000000000500000-0x0000000000575000-memory.dmp