Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
18/04/2026, 03:52
General
- Target 2026-04-18_8d035bd5b8d76201303f96d2a0a5c108_elex_wannacry.exe
- Size 168KB
- Sample260418-efgnrsf12z
- SHA256 43d1144eb5dc62790e101b3758023071e9d76b467213d4e854865a7d0b213386
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_8d035bd5b8d76201303f96d2a0a5c108_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_8d035bd5b8d76201303f96d2a0a5c108_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8EF4F8DE-B3CD-4779-99C3-B83A578F0D40}.exeC:\Windows\{8EF4F8DE-B3CD-4779-99C3-B83A578F0D40}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0E974D1-76F4-4f5f-8263-E1093BBBD6E4}.exeC:\Windows\{A0E974D1-76F4-4f5f-8263-E1093BBBD6E4}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F60E3F1A-44E8-4296-99C4-29ABF92944DC}.exeC:\Windows\{F60E3F1A-44E8-4296-99C4-29ABF92944DC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7937BEAF-50A6-4b12-BECC-1E63A2FFF99B}.exeC:\Windows\{7937BEAF-50A6-4b12-BECC-1E63A2FFF99B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{948D3D0B-B8F7-4972-A38A-9591B74E256B}.exeC:\Windows\{948D3D0B-B8F7-4972-A38A-9591B74E256B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6823EF9D-1101-4657-8C96-80FD73F99341}.exeC:\Windows\{6823EF9D-1101-4657-8C96-80FD73F99341}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5BF01958-CDB4-4e82-940C-F0D95D97CA6F}.exeC:\Windows\{5BF01958-CDB4-4e82-940C-F0D95D97CA6F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0549D970-9F5D-4d05-91D5-C3EAF9CB7D61}.exeC:\Windows\{0549D970-9F5D-4d05-91D5-C3EAF9CB7D61}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBDC2EB0-11FA-4b7b-BF1A-43FE27B40960}.exeC:\Windows\{BBDC2EB0-11FA-4b7b-BF1A-43FE27B40960}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A76EB9F7-9B3C-437d-A98A-39CF0948F4EB}.exeC:\Windows\{A76EB9F7-9B3C-437d-A98A-39CF0948F4EB}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBDC2~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0549D~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5BF01~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6823E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{948D3~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7937B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F60E3~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0E97~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8EF4F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0549D970-9F5D-4d05-91D5-C3EAF9CB7D61}.exe
{5BF01958-CDB4-4e82-940C-F0D95D97CA6F}.exe
{6823EF9D-1101-4657-8C96-80FD73F99341}.exe
{7937BEAF-50A6-4b12-BECC-1E63A2FFF99B}.exe
{8EF4F8DE-B3CD-4779-99C3-B83A578F0D40}.exe
{948D3D0B-B8F7-4972-A38A-9591B74E256B}.exe
{A0E974D1-76F4-4f5f-8263-E1093BBBD6E4}.exe
{A76EB9F7-9B3C-437d-A98A-39CF0948F4EB}.exe
{BBDC2EB0-11FA-4b7b-BF1A-43FE27B40960}.exe
{F60E3F1A-44E8-4296-99C4-29ABF92944DC}.exe
memory/424-18-0x0000000000640000-0x00000000006FB000-memory.dmp
memory/1436-24-0x0000000000870000-0x000000000092B000-memory.dmp
memory/1564-36-0x0000000000980000-0x0000000000A3B000-memory.dmp
memory/2496-6-0x00000000009C0000-0x0000000000A7B000-memory.dmp
memory/3480-0-0x00000000009F0000-0x0000000000AAB000-memory.dmp
memory/4084-54-0x0000000000990000-0x0000000000A4B000-memory.dmp
memory/4756-42-0x0000000000850000-0x000000000090B000-memory.dmp
memory/4960-48-0x00000000008E0000-0x000000000099B000-memory.dmp
memory/5840-12-0x00000000008F0000-0x00000000009AB000-memory.dmp
memory/6028-30-0x0000000000860000-0x000000000091B000-memory.dmp