Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
18/04/2026, 11:45
General
- Target 2026-04-18_0e8f41ddf28fca642051d2d46c2f02b9_elex_wannacry.exe
- Size 60KB
- Sample260418-nw49fagy2j
- SHA256 be623b131f09c0ff0b0478b41d2f3fe8cd401b30c791a535c7e6ded433d237c4
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_0e8f41ddf28fca642051d2d46c2f02b9_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_0e8f41ddf28fca642051d2d46c2f02b9_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3562FA82-1692-4b80-970D-CAB8E17EAEEE}.exeC:\Windows\{3562FA82-1692-4b80-970D-CAB8E17EAEEE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F73B9AED-BCAA-4e56-9DB3-14D3AA572C17}.exeC:\Windows\{F73B9AED-BCAA-4e56-9DB3-14D3AA572C17}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B6BD7286-E038-4fe0-B89E-4714ADD14A43}.exeC:\Windows\{B6BD7286-E038-4fe0-B89E-4714ADD14A43}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B0391BB4-62AD-44dc-9EE5-59EFE634261E}.exeC:\Windows\{B0391BB4-62AD-44dc-9EE5-59EFE634261E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A43E5EA7-5F7F-4c5b-80E2-489DDCFFC824}.exeC:\Windows\{A43E5EA7-5F7F-4c5b-80E2-489DDCFFC824}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FBC3D089-120F-49b3-9C47-4BF755E49FBD}.exeC:\Windows\{FBC3D089-120F-49b3-9C47-4BF755E49FBD}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94E95852-8BB0-4dbc-991B-68794B6925DC}.exeC:\Windows\{94E95852-8BB0-4dbc-991B-68794B6925DC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35F4F941-FBEF-4630-9696-57F2D31BA62F}.exeC:\Windows\{35F4F941-FBEF-4630-9696-57F2D31BA62F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEC0311B-E6DC-4dd9-9636-7A57BAB70060}.exeC:\Windows\{AEC0311B-E6DC-4dd9-9636-7A57BAB70060}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77D2D5B7-E86B-4139-8C9C-CA349ADB29AA}.exeC:\Windows\{77D2D5B7-E86B-4139-8C9C-CA349ADB29AA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B48E3309-5B24-4001-BEE5-D1A4032ABF1E}.exeC:\Windows\{B48E3309-5B24-4001-BEE5-D1A4032ABF1E}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77D2D~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEC03~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35F4F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94E95~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBC3D~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A43E5~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0391~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6BD7~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F73B9~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3562F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{3562FA82-1692-4b80-970D-CAB8E17EAEEE}.exe
{35F4F941-FBEF-4630-9696-57F2D31BA62F}.exe
{77D2D5B7-E86B-4139-8C9C-CA349ADB29AA}.exe
{94E95852-8BB0-4dbc-991B-68794B6925DC}.exe
{A43E5EA7-5F7F-4c5b-80E2-489DDCFFC824}.exe
{AEC0311B-E6DC-4dd9-9636-7A57BAB70060}.exe
{B0391BB4-62AD-44dc-9EE5-59EFE634261E}.exe
{B48E3309-5B24-4001-BEE5-D1A4032ABF1E}.exe
{B6BD7286-E038-4fe0-B89E-4714ADD14A43}.exe
{F73B9AED-BCAA-4e56-9DB3-14D3AA572C17}.exe
{FBC3D089-120F-49b3-9C47-4BF755E49FBD}.exe
memory/564-60-0x0000000000990000-0x00000000009DA000-memory.dmp
memory/564-64-0x0000000000990000-0x00000000009DA000-memory.dmp
memory/2288-58-0x0000000000650000-0x000000000069A000-memory.dmp
memory/2288-54-0x0000000000650000-0x000000000069A000-memory.dmp
memory/3900-48-0x0000000000820000-0x000000000086A000-memory.dmp
memory/3900-52-0x0000000000820000-0x000000000086A000-memory.dmp
memory/4580-6-0x0000000000670000-0x00000000006BA000-memory.dmp
memory/4580-10-0x0000000000670000-0x00000000006BA000-memory.dmp
memory/4912-36-0x0000000000660000-0x00000000006AA000-memory.dmp
memory/4912-40-0x0000000000660000-0x00000000006AA000-memory.dmp
memory/4940-0-0x00000000006B0000-0x00000000006FA000-memory.dmp
memory/4940-5-0x00000000006B0000-0x00000000006FA000-memory.dmp
memory/4956-30-0x0000000000820000-0x000000000086A000-memory.dmp
memory/4956-34-0x0000000000820000-0x000000000086A000-memory.dmp
memory/5276-24-0x0000000000960000-0x00000000009AA000-memory.dmp
memory/5276-28-0x0000000000960000-0x00000000009AA000-memory.dmp
memory/5516-16-0x0000000000970000-0x00000000009BA000-memory.dmp
memory/5516-12-0x0000000000970000-0x00000000009BA000-memory.dmp
memory/5576-22-0x0000000000670000-0x00000000006BA000-memory.dmp
memory/5576-18-0x0000000000670000-0x00000000006BA000-memory.dmp
memory/6068-46-0x00000000009B0000-0x00000000009FA000-memory.dmp
memory/6068-42-0x00000000009B0000-0x00000000009FA000-memory.dmp