Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
19/04/2026, 08:31
General
- Target 2026-04-19_1c6dcaa1ec27269535e1290384ac5524_elex_wannacry.exe
- Size 60KB
- Sample260419-ke5xvsbw21
- SHA256 0656f927b238958a21b831bacdc995580370cc9b1357c12f92ccfb118487321e
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_1c6dcaa1ec27269535e1290384ac5524_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_1c6dcaa1ec27269535e1290384ac5524_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBF132C4-9A55-496a-9F07-8AC0D2B79A2D}.exeC:\Windows\{CBF132C4-9A55-496a-9F07-8AC0D2B79A2D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC09EF20-13B8-4fd0-BD22-04281ACE6955}.exeC:\Windows\{CC09EF20-13B8-4fd0-BD22-04281ACE6955}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA4AD540-96B3-494d-93FB-25BB4CCECD35}.exeC:\Windows\{FA4AD540-96B3-494d-93FB-25BB4CCECD35}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C174C0B7-4F30-49a5-AA15-059723CA9251}.exeC:\Windows\{C174C0B7-4F30-49a5-AA15-059723CA9251}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD0993BD-2584-4762-822A-842243D5E3B1}.exeC:\Windows\{BD0993BD-2584-4762-822A-842243D5E3B1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5D36012-8C2A-4077-B133-19B49C6BE928}.exeC:\Windows\{A5D36012-8C2A-4077-B133-19B49C6BE928}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C0D4862E-3327-475a-8203-E4C2A0685900}.exeC:\Windows\{C0D4862E-3327-475a-8203-E4C2A0685900}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CF796EB-35DC-46e4-B147-79F3F9E7DAB8}.exeC:\Windows\{9CF796EB-35DC-46e4-B147-79F3F9E7DAB8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{051A58B9-CB29-4a6e-A164-5E5C50059407}.exeC:\Windows\{051A58B9-CB29-4a6e-A164-5E5C50059407}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F60B0F01-69AC-4c9f-ACD1-6067348BFBBD}.exeC:\Windows\{F60B0F01-69AC-4c9f-ACD1-6067348BFBBD}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C71CC0C1-2B0A-4817-BCB8-F8FF76FFE3F4}.exeC:\Windows\{C71CC0C1-2B0A-4817-BCB8-F8FF76FFE3F4}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F60B0~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{051A5~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CF79~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0D48~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5D36~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD099~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C174C~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA4AD~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC09E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBF13~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{051A58B9-CB29-4a6e-A164-5E5C50059407}.exe
{9CF796EB-35DC-46e4-B147-79F3F9E7DAB8}.exe
{A5D36012-8C2A-4077-B133-19B49C6BE928}.exe
{BD0993BD-2584-4762-822A-842243D5E3B1}.exe
{C0D4862E-3327-475a-8203-E4C2A0685900}.exe
{C174C0B7-4F30-49a5-AA15-059723CA9251}.exe
{C71CC0C1-2B0A-4817-BCB8-F8FF76FFE3F4}.exe
{CBF132C4-9A55-496a-9F07-8AC0D2B79A2D}.exe
{CC09EF20-13B8-4fd0-BD22-04281ACE6955}.exe
{F60B0F01-69AC-4c9f-ACD1-6067348BFBBD}.exe
{FA4AD540-96B3-494d-93FB-25BB4CCECD35}.exe
memory/1284-48-0x0000000000860000-0x000000000091F000-memory.dmp
memory/1284-52-0x0000000000860000-0x000000000091F000-memory.dmp
memory/2428-36-0x0000000000810000-0x00000000008CF000-memory.dmp
memory/2428-41-0x0000000000810000-0x00000000008CF000-memory.dmp
memory/2852-0-0x00000000009A0000-0x0000000000A5F000-memory.dmp
memory/2852-5-0x00000000009A0000-0x0000000000A5F000-memory.dmp
memory/2860-24-0x00000000005A0000-0x000000000065F000-memory.dmp
memory/2860-29-0x00000000005A0000-0x000000000065F000-memory.dmp
memory/3172-46-0x0000000000730000-0x00000000007EF000-memory.dmp
memory/3172-42-0x0000000000730000-0x00000000007EF000-memory.dmp
memory/3944-35-0x0000000000870000-0x000000000092F000-memory.dmp
memory/3944-30-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4164-60-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/4164-64-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/4648-10-0x0000000000940000-0x00000000009FF000-memory.dmp
memory/4648-6-0x0000000000940000-0x00000000009FF000-memory.dmp
memory/4748-54-0x0000000000750000-0x000000000080F000-memory.dmp
memory/4748-57-0x0000000000750000-0x000000000080F000-memory.dmp
memory/5328-22-0x0000000000800000-0x00000000008BF000-memory.dmp
memory/5328-18-0x0000000000800000-0x00000000008BF000-memory.dmp
memory/5932-16-0x00000000009F0000-0x0000000000AAF000-memory.dmp
memory/5932-12-0x00000000009F0000-0x0000000000AAF000-memory.dmp