Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 04:29
General
- Target 2026-04-20_96c42a7680ab431990b2e7f98aeec2a7_elex_wannacry.exe
- Size 116KB
- Sample260420-e4hwqsgz7j
- SHA256 fc883779486d4bb0dabc855a4e0391cafa5f17f35dca48ef806387a1f10d9fea
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_96c42a7680ab431990b2e7f98aeec2a7_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_96c42a7680ab431990b2e7f98aeec2a7_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF567E9B-2263-4681-828C-E7F1BAA10455}.exeC:\Windows\{FF567E9B-2263-4681-828C-E7F1BAA10455}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EABA8C9E-833E-4bdf-9F81-E04147925A05}.exeC:\Windows\{EABA8C9E-833E-4bdf-9F81-E04147925A05}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{720B253C-A250-4f3f-83CB-CEF49B423472}.exeC:\Windows\{720B253C-A250-4f3f-83CB-CEF49B423472}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32CC1A74-1D18-4214-9907-31FE7B773F5A}.exeC:\Windows\{32CC1A74-1D18-4214-9907-31FE7B773F5A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCFEF470-9379-4ef5-BB39-D42882C9E7FA}.exeC:\Windows\{CCFEF470-9379-4ef5-BB39-D42882C9E7FA}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{767A00D8-9AFB-48e2-AA67-1E8BD09DF8EC}.exeC:\Windows\{767A00D8-9AFB-48e2-AA67-1E8BD09DF8EC}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3AE602C4-2C1E-4d47-9285-FB84D17B566B}.exeC:\Windows\{3AE602C4-2C1E-4d47-9285-FB84D17B566B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F849883-FF14-4fef-897E-A6934303DED5}.exeC:\Windows\{6F849883-FF14-4fef-897E-A6934303DED5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F732B88-0545-4e92-BCDA-B7531DB37AEC}.exeC:\Windows\{9F732B88-0545-4e92-BCDA-B7531DB37AEC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{159BBFE2-75FB-41e4-9551-AF20F7E2C92A}.exeC:\Windows\{159BBFE2-75FB-41e4-9551-AF20F7E2C92A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99E97DBE-B5C4-4570-BE1F-44DE17F6EE68}.exeC:\Windows\{99E97DBE-B5C4-4570-BE1F-44DE17F6EE68}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{159BB~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F732~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F849~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3AE60~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{767A0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCFEF~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32CC1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{720B2~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EABA8~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF567~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{159BBFE2-75FB-41e4-9551-AF20F7E2C92A}.exe
{32CC1A74-1D18-4214-9907-31FE7B773F5A}.exe
{3AE602C4-2C1E-4d47-9285-FB84D17B566B}.exe
{6F849883-FF14-4fef-897E-A6934303DED5}.exe
{720B253C-A250-4f3f-83CB-CEF49B423472}.exe
{767A00D8-9AFB-48e2-AA67-1E8BD09DF8EC}.exe
{99E97DBE-B5C4-4570-BE1F-44DE17F6EE68}.exe
{9F732B88-0545-4e92-BCDA-B7531DB37AEC}.exe
{CCFEF470-9379-4ef5-BB39-D42882C9E7FA}.exe
{EABA8C9E-833E-4bdf-9F81-E04147925A05}.exe
{FF567E9B-2263-4681-828C-E7F1BAA10455}.exe