Analysis
- max time kernel
149s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 15:01
General
- Target 2026-04-17_25b9f45900490715dfb1da49fd71106a_elex_wannacry.exe
- Size 60KB
- Sample260417-sd4meacz7t
- SHA256 91e935fa8cb4f35479e34831f4af78c6973caa9eb959390efe074f3fde4ac08c
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_25b9f45900490715dfb1da49fd71106a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_25b9f45900490715dfb1da49fd71106a_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1793EEBC-83D8-4209-B34C-2AFF469BA5B3}.exeC:\Windows\{1793EEBC-83D8-4209-B34C-2AFF469BA5B3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF86A9FB-0A81-4760-AF65-90A4431DFCE7}.exeC:\Windows\{DF86A9FB-0A81-4760-AF65-90A4431DFCE7}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AAA82BA7-CBC7-45f6-B998-DA19B9261C15}.exeC:\Windows\{AAA82BA7-CBC7-45f6-B998-DA19B9261C15}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{69616236-DA33-44e3-8FAA-D4BC7CC7850C}.exeC:\Windows\{69616236-DA33-44e3-8FAA-D4BC7CC7850C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D430A2C4-2BCE-4a9e-B768-6E32353CA1F7}.exeC:\Windows\{D430A2C4-2BCE-4a9e-B768-6E32353CA1F7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C34DB50E-D419-4d75-94F5-82380411D316}.exeC:\Windows\{C34DB50E-D419-4d75-94F5-82380411D316}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2282F32-E10C-442f-B484-5F80E9FA0A89}.exeC:\Windows\{F2282F32-E10C-442f-B484-5F80E9FA0A89}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EDE3D9C9-F7A2-4f57-822D-EECF30AD8FAB}.exeC:\Windows\{EDE3D9C9-F7A2-4f57-822D-EECF30AD8FAB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44C046ED-B994-449e-BE0F-885D06B8F7A8}.exeC:\Windows\{44C046ED-B994-449e-BE0F-885D06B8F7A8}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0224EEF3-8730-4067-8DC5-F11FEC539846}.exeC:\Windows\{0224EEF3-8730-4067-8DC5-F11FEC539846}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44C04~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EDE3D~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2282~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C34DB~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D430A~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69616~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAA82~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF86A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1793E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0224EEF3-8730-4067-8DC5-F11FEC539846}.exe
{1793EEBC-83D8-4209-B34C-2AFF469BA5B3}.exe
{44C046ED-B994-449e-BE0F-885D06B8F7A8}.exe
{69616236-DA33-44e3-8FAA-D4BC7CC7850C}.exe
{AAA82BA7-CBC7-45f6-B998-DA19B9261C15}.exe
{C34DB50E-D419-4d75-94F5-82380411D316}.exe
{D430A2C4-2BCE-4a9e-B768-6E32353CA1F7}.exe
{DF86A9FB-0A81-4760-AF65-90A4431DFCE7}.exe
{EDE3D9C9-F7A2-4f57-822D-EECF30AD8FAB}.exe
{F2282F32-E10C-442f-B484-5F80E9FA0A89}.exe
memory/468-34-0x00000000009C0000-0x0000000000A82000-memory.dmp
memory/468-30-0x00000000009C0000-0x0000000000A82000-memory.dmp
memory/876-48-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/876-53-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/1692-0-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/1692-5-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/1820-40-0x0000000000840000-0x0000000000902000-memory.dmp
memory/1820-36-0x0000000000840000-0x0000000000902000-memory.dmp
memory/2100-10-0x0000000000860000-0x0000000000922000-memory.dmp
memory/2100-6-0x0000000000860000-0x0000000000922000-memory.dmp
memory/2508-28-0x0000000000870000-0x0000000000932000-memory.dmp
memory/2508-24-0x0000000000870000-0x0000000000932000-memory.dmp
memory/3456-54-0x0000000000630000-0x00000000006F2000-memory.dmp
memory/3456-58-0x0000000000630000-0x00000000006F2000-memory.dmp
memory/4500-15-0x0000000000980000-0x0000000000A42000-memory.dmp
memory/4500-12-0x0000000000980000-0x0000000000A42000-memory.dmp
memory/4796-21-0x0000000000850000-0x0000000000912000-memory.dmp
memory/4796-18-0x0000000000850000-0x0000000000912000-memory.dmp
memory/4820-42-0x0000000000900000-0x00000000009C2000-memory.dmp
memory/4820-46-0x0000000000900000-0x00000000009C2000-memory.dmp