Analysis
- max time kernel
150s - max time network
135s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 12:37
General
- Target 2026-04-16_00a468fe092c60f5ce3610c13509110b_elex_wannacry.exe
- Size 68KB
- Sample260416-ptfczaav2w
- SHA256 4b328f65a472d056dc246b41257bcbd60d9c9ae43aa1ccafdfb945b56e0a2638
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 31 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_00a468fe092c60f5ce3610c13509110b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_00a468fe092c60f5ce3610c13509110b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{727FFB68-E32E-40da-870A-55A0DEF4F600}.exeC:\Windows\{727FFB68-E32E-40da-870A-55A0DEF4F600}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21464003-D5DB-4d31-B36E-EBA0CE34A0D0}.exeC:\Windows\{21464003-D5DB-4d31-B36E-EBA0CE34A0D0}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A9335ADB-BB17-4f9e-8916-6366D76C22EE}.exeC:\Windows\{A9335ADB-BB17-4f9e-8916-6366D76C22EE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{41CD2D53-1718-4d1a-9005-6A18AE56974B}.exeC:\Windows\{41CD2D53-1718-4d1a-9005-6A18AE56974B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1AA861B6-5996-47b5-B615-69272322AC5C}.exeC:\Windows\{1AA861B6-5996-47b5-B615-69272322AC5C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01BE6433-07C0-43f8-8FD9-9D53066CA0F1}.exeC:\Windows\{01BE6433-07C0-43f8-8FD9-9D53066CA0F1}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDBF2988-BF7E-4537-AA8A-C3D1F028A9E9}.exeC:\Windows\{BDBF2988-BF7E-4537-AA8A-C3D1F028A9E9}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0070EA57-99AF-4bc8-9E6B-FC3397E043E7}.exeC:\Windows\{0070EA57-99AF-4bc8-9E6B-FC3397E043E7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{950C8C96-52AB-4fd6-ADCA-B0A23FEB2515}.exeC:\Windows\{950C8C96-52AB-4fd6-ADCA-B0A23FEB2515}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{939CDDBB-7D45-40fd-B937-77BCF98AB84D}.exeC:\Windows\{939CDDBB-7D45-40fd-B937-77BCF98AB84D}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{950C8~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0070E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDBF2~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01BE6~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1AA86~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41CD2~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9335~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21464~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{727FF~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0070EA57-99AF-4bc8-9E6B-FC3397E043E7}.exe
{01BE6433-07C0-43f8-8FD9-9D53066CA0F1}.exe
{1AA861B6-5996-47b5-B615-69272322AC5C}.exe
{21464003-D5DB-4d31-B36E-EBA0CE34A0D0}.exe
{41CD2D53-1718-4d1a-9005-6A18AE56974B}.exe
{727FFB68-E32E-40da-870A-55A0DEF4F600}.exe
{939CDDBB-7D45-40fd-B937-77BCF98AB84D}.exe
{950C8C96-52AB-4fd6-ADCA-B0A23FEB2515}.exe
{A9335ADB-BB17-4f9e-8916-6366D76C22EE}.exe
{BDBF2988-BF7E-4537-AA8A-C3D1F028A9E9}.exe
memory/408-21-0x0000000000730000-0x000000000077A000-memory.dmp
memory/408-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/408-17-0x0000000000730000-0x000000000077A000-memory.dmp
memory/1172-40-0x0000000000860000-0x00000000008AA000-memory.dmp
memory/1172-38-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1172-44-0x0000000000860000-0x00000000008AA000-memory.dmp
memory/1172-45-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1272-24-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1272-25-0x0000000000840000-0x000000000088A000-memory.dmp
memory/1272-31-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1272-29-0x0000000000840000-0x000000000088A000-memory.dmp
memory/1296-77-0x00000000009A0000-0x00000000009EA000-memory.dmp
memory/1296-73-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1296-79-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1296-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1296-72-0x00000000009A0000-0x00000000009EA000-memory.dmp
memory/1928-52-0x00000000009A0000-0x00000000009EA000-memory.dmp
memory/1928-46-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1928-48-0x00000000009A0000-0x00000000009EA000-memory.dmp
memory/1928-53-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2008-8-0x00000000009A0000-0x00000000009EA000-memory.dmp
memory/2008-9-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2008-1-0x00000000009A0000-0x00000000009EA000-memory.dmp
memory/2008-2-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2008-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2244-14-0x00000000009A0000-0x00000000009EA000-memory.dmp
memory/2244-15-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2244-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2244-10-0x00000000009A0000-0x00000000009EA000-memory.dmp
memory/2976-55-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2976-60-0x0000000000840000-0x000000000088A000-memory.dmp
memory/2976-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2976-56-0x0000000000840000-0x000000000088A000-memory.dmp
memory/3580-80-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3580-81-0x00000000009A0000-0x00000000009EA000-memory.dmp
memory/4560-64-0x0000000000880000-0x00000000008CA000-memory.dmp
memory/4560-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4560-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4560-68-0x0000000000880000-0x00000000008CA000-memory.dmp
memory/5040-36-0x0000000000880000-0x00000000008CA000-memory.dmp
memory/5040-37-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5040-32-0x0000000000880000-0x00000000008CA000-memory.dmp