Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 14:25
General
- Target 2026-04-17_01c2a5bc55f351945d4062a5138891ef_elex_wannacry.exe
- Size 60KB
- Sample260417-rrbccab18y
- SHA256 6eacf2543d4160cded8f224896e3864fa7bdd20bdd07173e921d44a952090905
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_01c2a5bc55f351945d4062a5138891ef_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_01c2a5bc55f351945d4062a5138891ef_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{020F8464-D269-4491-BBD4-4072F1DDDEEF}.exeC:\Windows\{020F8464-D269-4491-BBD4-4072F1DDDEEF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8AC51167-2D41-4f90-94B8-D4212D27E6DE}.exeC:\Windows\{8AC51167-2D41-4f90-94B8-D4212D27E6DE}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76B60AEB-1A8E-4c60-B597-6CEF921AB21A}.exeC:\Windows\{76B60AEB-1A8E-4c60-B597-6CEF921AB21A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6FFC392D-0AC8-486d-9884-D9ED1B78D3DD}.exeC:\Windows\{6FFC392D-0AC8-486d-9884-D9ED1B78D3DD}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A761FCF1-B0A6-47c5-8B76-AEF5AEB94D55}.exeC:\Windows\{A761FCF1-B0A6-47c5-8B76-AEF5AEB94D55}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{968084A3-A4C1-46bc-B6ED-07B1428476DC}.exeC:\Windows\{968084A3-A4C1-46bc-B6ED-07B1428476DC}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73382641-593D-4ea8-9DC3-AE0DD066FAC2}.exeC:\Windows\{73382641-593D-4ea8-9DC3-AE0DD066FAC2}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C5AFE11E-CA9F-4a8f-ABED-F9F54A69F27A}.exeC:\Windows\{C5AFE11E-CA9F-4a8f-ABED-F9F54A69F27A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC93172F-0E1E-448e-B3FA-C5B7C412BC92}.exeC:\Windows\{CC93172F-0E1E-448e-B3FA-C5B7C412BC92}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A1FAE27-911D-45a8-8D53-00A50C716CA0}.exeC:\Windows\{1A1FAE27-911D-45a8-8D53-00A50C716CA0}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0F12FC4-C5DE-4bab-AE3A-0BAC0A39C3E0}.exeC:\Windows\{D0F12FC4-C5DE-4bab-AE3A-0BAC0A39C3E0}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A1FA~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC931~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5AFE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73382~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96808~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A761F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6FFC3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76B60~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AC51~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{020F8~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{020F8464-D269-4491-BBD4-4072F1DDDEEF}.exe
{1A1FAE27-911D-45a8-8D53-00A50C716CA0}.exe
{6FFC392D-0AC8-486d-9884-D9ED1B78D3DD}.exe
{73382641-593D-4ea8-9DC3-AE0DD066FAC2}.exe
{76B60AEB-1A8E-4c60-B597-6CEF921AB21A}.exe
{8AC51167-2D41-4f90-94B8-D4212D27E6DE}.exe
{968084A3-A4C1-46bc-B6ED-07B1428476DC}.exe
{A761FCF1-B0A6-47c5-8B76-AEF5AEB94D55}.exe
{C5AFE11E-CA9F-4a8f-ABED-F9F54A69F27A}.exe
{CC93172F-0E1E-448e-B3FA-C5B7C412BC92}.exe
{D0F12FC4-C5DE-4bab-AE3A-0BAC0A39C3E0}.exe