Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
18/04/2026, 11:45
General
- Target 2026-04-18_0e8f41ddf28fca642051d2d46c2f02b9_elex_wannacry.exe
- Size 60KB
- Sample260418-nw49fagy2j
- SHA256 be623b131f09c0ff0b0478b41d2f3fe8cd401b30c791a535c7e6ded433d237c4
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_0e8f41ddf28fca642051d2d46c2f02b9_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_0e8f41ddf28fca642051d2d46c2f02b9_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F5CEF32C-4ABF-4a75-BC0A-1BC90B6E7D32}.exeC:\Windows\{F5CEF32C-4ABF-4a75-BC0A-1BC90B6E7D32}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5A96C45-B375-4b79-8F50-3A2AD638989B}.exeC:\Windows\{E5A96C45-B375-4b79-8F50-3A2AD638989B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61D9CCB2-B8C3-41f7-B5C1-CD417FEA238C}.exeC:\Windows\{61D9CCB2-B8C3-41f7-B5C1-CD417FEA238C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3BE13F5-44C6-4e5c-BCD2-A2E1DC25EC90}.exeC:\Windows\{B3BE13F5-44C6-4e5c-BCD2-A2E1DC25EC90}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4A6A331-35F2-48e3-97D4-92C56A413721}.exeC:\Windows\{A4A6A331-35F2-48e3-97D4-92C56A413721}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5FF85D8C-3B2A-4a36-AC08-5B343A6C7BF5}.exeC:\Windows\{5FF85D8C-3B2A-4a36-AC08-5B343A6C7BF5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8FFCCD6E-8A3C-4aaa-BBF6-E118A8E1FB80}.exeC:\Windows\{8FFCCD6E-8A3C-4aaa-BBF6-E118A8E1FB80}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85E4EE56-2030-4d08-8E97-D10BC7E0AB07}.exeC:\Windows\{85E4EE56-2030-4d08-8E97-D10BC7E0AB07}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C332C67F-D2D4-4e55-868B-C4770BF812A8}.exeC:\Windows\{C332C67F-D2D4-4e55-868B-C4770BF812A8}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB1182B5-554C-49f1-880C-6981CAE8ECE4}.exeC:\Windows\{DB1182B5-554C-49f1-880C-6981CAE8ECE4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB5A1410-2A98-4ccd-BB87-E87EB647871A}.exeC:\Windows\{CB5A1410-2A98-4ccd-BB87-E87EB647871A}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB118~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C332C~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85E4E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FFCC~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FF85~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4A6A~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3BE1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61D9C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5A96~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5CEF~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{5FF85D8C-3B2A-4a36-AC08-5B343A6C7BF5}.exe
{61D9CCB2-B8C3-41f7-B5C1-CD417FEA238C}.exe
{85E4EE56-2030-4d08-8E97-D10BC7E0AB07}.exe
{8FFCCD6E-8A3C-4aaa-BBF6-E118A8E1FB80}.exe
{A4A6A331-35F2-48e3-97D4-92C56A413721}.exe
{B3BE13F5-44C6-4e5c-BCD2-A2E1DC25EC90}.exe
{C332C67F-D2D4-4e55-868B-C4770BF812A8}.exe
{CB5A1410-2A98-4ccd-BB87-E87EB647871A}.exe
{DB1182B5-554C-49f1-880C-6981CAE8ECE4}.exe
{E5A96C45-B375-4b79-8F50-3A2AD638989B}.exe
{F5CEF32C-4ABF-4a75-BC0A-1BC90B6E7D32}.exe
memory/1120-41-0x0000000000550000-0x00000000005C5000-memory.dmp
memory/1120-36-0x0000000000550000-0x00000000005C5000-memory.dmp
memory/2088-30-0x0000000000500000-0x0000000000575000-memory.dmp
memory/2088-34-0x0000000000500000-0x0000000000575000-memory.dmp
memory/2944-10-0x0000000000790000-0x0000000000805000-memory.dmp
memory/2944-6-0x0000000000790000-0x0000000000805000-memory.dmp
memory/3732-60-0x0000000000650000-0x00000000006C5000-memory.dmp
memory/3732-63-0x0000000000650000-0x00000000006C5000-memory.dmp
memory/4192-46-0x00000000008A0000-0x0000000000915000-memory.dmp
memory/4192-42-0x00000000008A0000-0x0000000000915000-memory.dmp
memory/4564-5-0x00000000009F0000-0x0000000000A65000-memory.dmp
memory/4564-0-0x00000000009F0000-0x0000000000A65000-memory.dmp
memory/4852-16-0x0000000000530000-0x00000000005A5000-memory.dmp
memory/4852-12-0x0000000000530000-0x00000000005A5000-memory.dmp
memory/4980-27-0x0000000000990000-0x0000000000A05000-memory.dmp
memory/4980-24-0x0000000000990000-0x0000000000A05000-memory.dmp
memory/5416-48-0x0000000000660000-0x00000000006D5000-memory.dmp
memory/5416-51-0x0000000000660000-0x00000000006D5000-memory.dmp
memory/5776-54-0x0000000000850000-0x00000000008C5000-memory.dmp
memory/5776-57-0x0000000000850000-0x00000000008C5000-memory.dmp
memory/5980-22-0x0000000000610000-0x0000000000685000-memory.dmp
memory/5980-18-0x0000000000610000-0x0000000000685000-memory.dmp