Analysis
- max time kernel
149s - max time network
115s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 12:31
General
- Target 2026-04-20_3911565b3a5a7844ba55f114ca6f3562_elex_wannacry.exe
- Size 60KB
- Sample260420-pp1hcaew3w
- SHA256 c72fcff3c00a67f1fad68bf69b58e1b8329f33796cad5904039e221e85acff10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_3911565b3a5a7844ba55f114ca6f3562_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_3911565b3a5a7844ba55f114ca6f3562_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C546321-40C8-484d-B2DD-5886F324AF26}.exeC:\Windows\{4C546321-40C8-484d-B2DD-5886F324AF26}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10837465-A45C-46f6-AFDF-F1595396FA03}.exeC:\Windows\{10837465-A45C-46f6-AFDF-F1595396FA03}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B05EF663-F134-465e-83C1-FBF7726B4344}.exeC:\Windows\{B05EF663-F134-465e-83C1-FBF7726B4344}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31EEE66A-BA6E-44d8-A976-E7B071B705BB}.exeC:\Windows\{31EEE66A-BA6E-44d8-A976-E7B071B705BB}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4571404-2C37-4e98-8EE7-25BF8B99E414}.exeC:\Windows\{E4571404-2C37-4e98-8EE7-25BF8B99E414}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{826239C0-64D6-4141-9A96-6BCBCFF71200}.exeC:\Windows\{826239C0-64D6-4141-9A96-6BCBCFF71200}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E14489C0-81AD-499e-951E-4CAE8929626C}.exeC:\Windows\{E14489C0-81AD-499e-951E-4CAE8929626C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F4D1C232-FFEB-481d-853B-5E36294A34FA}.exeC:\Windows\{F4D1C232-FFEB-481d-853B-5E36294A34FA}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B7E394E0-2953-48d0-8FD2-83CEB8EDBDE6}.exeC:\Windows\{B7E394E0-2953-48d0-8FD2-83CEB8EDBDE6}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E54B5E5F-2E12-4cc7-924B-3D0A8A08BE9D}.exeC:\Windows\{E54B5E5F-2E12-4cc7-924B-3D0A8A08BE9D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F16A089-6E66-4213-ABA5-75890811E972}.exeC:\Windows\{4F16A089-6E66-4213-ABA5-75890811E972}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E54B5~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7E39~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4D1C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1448~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82623~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4571~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31EEE~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B05EF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10837~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C546~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{10837465-A45C-46f6-AFDF-F1595396FA03}.exe
{31EEE66A-BA6E-44d8-A976-E7B071B705BB}.exe
{4C546321-40C8-484d-B2DD-5886F324AF26}.exe
{4F16A089-6E66-4213-ABA5-75890811E972}.exe
{826239C0-64D6-4141-9A96-6BCBCFF71200}.exe
{B05EF663-F134-465e-83C1-FBF7726B4344}.exe
{B7E394E0-2953-48d0-8FD2-83CEB8EDBDE6}.exe
{E14489C0-81AD-499e-951E-4CAE8929626C}.exe
{E4571404-2C37-4e98-8EE7-25BF8B99E414}.exe
{E54B5E5F-2E12-4cc7-924B-3D0A8A08BE9D}.exe
{F4D1C232-FFEB-481d-853B-5E36294A34FA}.exe
memory/956-9-0x0000000000960000-0x0000000000A1F000-memory.dmp
memory/956-6-0x0000000000960000-0x0000000000A1F000-memory.dmp
memory/1108-5-0x0000000000AA0000-0x0000000000B5F000-memory.dmp
memory/1108-0-0x0000000000AA0000-0x0000000000B5F000-memory.dmp
memory/1456-60-0x0000000000960000-0x0000000000A1F000-memory.dmp
memory/1456-64-0x0000000000960000-0x0000000000A1F000-memory.dmp
memory/1644-48-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/1644-52-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/2824-58-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/2824-54-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/3676-12-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/3676-16-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/3696-28-0x0000000000970000-0x0000000000A2F000-memory.dmp
memory/3696-24-0x0000000000970000-0x0000000000A2F000-memory.dmp
memory/3700-47-0x0000000000A10000-0x0000000000ACF000-memory.dmp
memory/3700-42-0x0000000000A10000-0x0000000000ACF000-memory.dmp
memory/3752-36-0x00000000009C0000-0x0000000000A7F000-memory.dmp
memory/3752-40-0x00000000009C0000-0x0000000000A7F000-memory.dmp
memory/4316-30-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/4316-34-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/4732-22-0x00000000009D0000-0x0000000000A8F000-memory.dmp
memory/4732-18-0x00000000009D0000-0x0000000000A8F000-memory.dmp