Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
19/04/2026, 03:57
General
- Target 2026-04-19_8f1d40f08b841bb8fe8f5d5bd8faae62_elex_wannacry.exe
- Size 60KB
- Sample260419-ejctzsht7w
- SHA256 a0694a2de69069b1f2e838acdbe0c92525274850e53ef4b1f58a55e3d17c8011
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_8f1d40f08b841bb8fe8f5d5bd8faae62_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_8f1d40f08b841bb8fe8f5d5bd8faae62_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA85551F-DF99-49d4-9233-EA629DF64FB3}.exeC:\Windows\{DA85551F-DF99-49d4-9233-EA629DF64FB3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3729E26F-E01E-41fa-B53F-EC71CA6D6D4C}.exeC:\Windows\{3729E26F-E01E-41fa-B53F-EC71CA6D6D4C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFD42888-9082-4810-92B1-1A5D5CFDA950}.exeC:\Windows\{AFD42888-9082-4810-92B1-1A5D5CFDA950}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16567A7E-ADBE-45ae-8F20-0391C026CC3F}.exeC:\Windows\{16567A7E-ADBE-45ae-8F20-0391C026CC3F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E3637D5-D0F9-4841-818D-0B2C56D887AD}.exeC:\Windows\{7E3637D5-D0F9-4841-818D-0B2C56D887AD}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB7C2020-A560-4170-9101-49C62BA4AD86}.exeC:\Windows\{FB7C2020-A560-4170-9101-49C62BA4AD86}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F476B5B-222F-4cfe-9366-14BB9E04B460}.exeC:\Windows\{7F476B5B-222F-4cfe-9366-14BB9E04B460}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0EBC0CB2-3861-4945-8030-C4A590E94D7A}.exeC:\Windows\{0EBC0CB2-3861-4945-8030-C4A590E94D7A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93924033-E4AD-40a2-943E-5AF80E854C2A}.exeC:\Windows\{93924033-E4AD-40a2-943E-5AF80E854C2A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E5449E6-3785-4223-8F24-F030F9D66B2A}.exeC:\Windows\{0E5449E6-3785-4223-8F24-F030F9D66B2A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5680905-882E-4530-AD60-DDE0CF3BCAB6}.exeC:\Windows\{A5680905-882E-4530-AD60-DDE0CF3BCAB6}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E544~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93924~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EBC0~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F476~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB7C2~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E363~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16567~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFD42~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3729E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA855~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0E5449E6-3785-4223-8F24-F030F9D66B2A}.exe
{0EBC0CB2-3861-4945-8030-C4A590E94D7A}.exe
{16567A7E-ADBE-45ae-8F20-0391C026CC3F}.exe
{3729E26F-E01E-41fa-B53F-EC71CA6D6D4C}.exe
{7E3637D5-D0F9-4841-818D-0B2C56D887AD}.exe
{7F476B5B-222F-4cfe-9366-14BB9E04B460}.exe
{93924033-E4AD-40a2-943E-5AF80E854C2A}.exe
{A5680905-882E-4530-AD60-DDE0CF3BCAB6}.exe
{AFD42888-9082-4810-92B1-1A5D5CFDA950}.exe
{DA85551F-DF99-49d4-9233-EA629DF64FB3}.exe
{FB7C2020-A560-4170-9101-49C62BA4AD86}.exe
memory/1668-54-0x00000000020E0000-0x000000000213F000-memory.dmp
memory/1668-59-0x00000000020E0000-0x000000000213F000-memory.dmp
memory/2128-10-0x0000000002150000-0x00000000021AF000-memory.dmp
memory/2128-6-0x0000000002150000-0x00000000021AF000-memory.dmp
memory/2924-39-0x0000000001FF0000-0x000000000204F000-memory.dmp
memory/2924-36-0x0000000001FF0000-0x000000000204F000-memory.dmp
memory/3932-30-0x0000000003C80000-0x0000000003CDF000-memory.dmp
memory/3932-33-0x0000000003C80000-0x0000000003CDF000-memory.dmp
memory/4188-48-0x0000000002120000-0x000000000217F000-memory.dmp
memory/4188-51-0x0000000002120000-0x000000000217F000-memory.dmp
memory/4212-5-0x0000000003DB0000-0x0000000003E0F000-memory.dmp
memory/4212-0-0x0000000003DB0000-0x0000000003E0F000-memory.dmp
memory/4560-22-0x0000000003C70000-0x0000000003CCF000-memory.dmp
memory/4560-18-0x0000000003C70000-0x0000000003CCF000-memory.dmp
memory/4572-47-0x0000000003CF0000-0x0000000003D4F000-memory.dmp
memory/4572-42-0x0000000003CF0000-0x0000000003D4F000-memory.dmp
memory/4744-17-0x0000000003BA0000-0x0000000003BFF000-memory.dmp
memory/4744-12-0x0000000003BA0000-0x0000000003BFF000-memory.dmp
memory/5008-28-0x0000000002000000-0x000000000205F000-memory.dmp
memory/5008-24-0x0000000002000000-0x000000000205F000-memory.dmp
memory/5108-60-0x0000000000750000-0x00000000007AF000-memory.dmp
memory/5108-64-0x0000000000750000-0x00000000007AF000-memory.dmp