Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 14:06
General
- Target 2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe
- Size 64KB
- Sample260419-rexd2scv9p
- SHA256 fbec33dd5e4a9cc5b4dd11120c882874269cbe95bf266019ef742d1c929fd5be
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_a58d1f38c8b34bc016e67d1b85dac541_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A55F4DEE-240A-4c0e-9EE4-73D6978C0238}.exeC:\Windows\{A55F4DEE-240A-4c0e-9EE4-73D6978C0238}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{47FC2131-85BE-48f7-98F4-290CD34BE36B}.exeC:\Windows\{47FC2131-85BE-48f7-98F4-290CD34BE36B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8E3E9E06-FBAE-4923-820C-D7A78D1B59E6}.exeC:\Windows\{8E3E9E06-FBAE-4923-820C-D7A78D1B59E6}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C9CFFAC-7A63-438d-BBF5-D5FFA12B4652}.exeC:\Windows\{5C9CFFAC-7A63-438d-BBF5-D5FFA12B4652}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5867FC90-45AE-4cbe-B73B-8894667EC99B}.exeC:\Windows\{5867FC90-45AE-4cbe-B73B-8894667EC99B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA824DF3-70FE-4145-A546-B22637921A52}.exeC:\Windows\{FA824DF3-70FE-4145-A546-B22637921A52}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D94100A0-E109-40cb-8174-30D29656AC29}.exeC:\Windows\{D94100A0-E109-40cb-8174-30D29656AC29}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1568206F-EE9F-4b28-AA95-651C2965BBDB}.exeC:\Windows\{1568206F-EE9F-4b28-AA95-651C2965BBDB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA267805-F341-4af4-8093-E6E03E6A2FC2}.exeC:\Windows\{DA267805-F341-4af4-8093-E6E03E6A2FC2}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC700996-260C-4290-A7E0-35330547204C}.exeC:\Windows\{CC700996-260C-4290-A7E0-35330547204C}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA267~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15682~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9410~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA824~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5867F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C9CF~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8E3E9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47FC2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A55F4~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1568206F-EE9F-4b28-AA95-651C2965BBDB}.exe
{47FC2131-85BE-48f7-98F4-290CD34BE36B}.exe
{5867FC90-45AE-4cbe-B73B-8894667EC99B}.exe
{5C9CFFAC-7A63-438d-BBF5-D5FFA12B4652}.exe
{8E3E9E06-FBAE-4923-820C-D7A78D1B59E6}.exe
{A55F4DEE-240A-4c0e-9EE4-73D6978C0238}.exe
{CC700996-260C-4290-A7E0-35330547204C}.exe
{D94100A0-E109-40cb-8174-30D29656AC29}.exe
{DA267805-F341-4af4-8093-E6E03E6A2FC2}.exe
{FA824DF3-70FE-4145-A546-B22637921A52}.exe
memory/1444-12-0x0000000003CB0000-0x0000000003D8A000-memory.dmp
memory/1444-15-0x0000000003CB0000-0x0000000003D8A000-memory.dmp
memory/2040-28-0x0000000003C60000-0x0000000003D3A000-memory.dmp
memory/2040-24-0x0000000003C60000-0x0000000003D3A000-memory.dmp
memory/2476-58-0x0000000003D00000-0x0000000003DDA000-memory.dmp
memory/2476-54-0x0000000003D00000-0x0000000003DDA000-memory.dmp
memory/3292-42-0x00000000021D0000-0x00000000022AA000-memory.dmp
memory/3292-46-0x00000000021D0000-0x00000000022AA000-memory.dmp
memory/3652-34-0x0000000003C70000-0x0000000003D4A000-memory.dmp
memory/3652-30-0x0000000003C70000-0x0000000003D4A000-memory.dmp
memory/5008-18-0x0000000003C30000-0x0000000003D0A000-memory.dmp
memory/5008-22-0x0000000003C30000-0x0000000003D0A000-memory.dmp
memory/5016-10-0x0000000003C00000-0x0000000003CDA000-memory.dmp
memory/5016-6-0x0000000003C00000-0x0000000003CDA000-memory.dmp
memory/5060-5-0x00000000022A0000-0x000000000237A000-memory.dmp
memory/5060-0-0x00000000022A0000-0x000000000237A000-memory.dmp
memory/5628-40-0x0000000003D30000-0x0000000003E0A000-memory.dmp
memory/5628-36-0x0000000003D30000-0x0000000003E0A000-memory.dmp
memory/5884-48-0x0000000002210000-0x00000000022EA000-memory.dmp
memory/5884-52-0x0000000002210000-0x00000000022EA000-memory.dmp