Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 14:36
General
- Target 2026-04-20_d50279c9392b662d1651b8b33b441311_elex_wannacry.exe
- Size 64KB
- Sample260420-ryyffsdt3n
- SHA256 d31fb5b028f864e8cdbd55677756e644b2e451258aa65b2678f32e73eaaca779
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_d50279c9392b662d1651b8b33b441311_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_d50279c9392b662d1651b8b33b441311_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C5C58E2-9ACA-4fe9-ADE3-DE4C8F1AD094}.exeC:\Windows\{6C5C58E2-9ACA-4fe9-ADE3-DE4C8F1AD094}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB6B7A62-2023-4a1d-A8DD-FEABECDD03D5}.exeC:\Windows\{BB6B7A62-2023-4a1d-A8DD-FEABECDD03D5}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4320E48E-3AEE-46c7-8AB8-6ED341E54875}.exeC:\Windows\{4320E48E-3AEE-46c7-8AB8-6ED341E54875}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C6637DB-EA20-4860-A839-C98846A27524}.exeC:\Windows\{3C6637DB-EA20-4860-A839-C98846A27524}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B01FFC8-2D00-4bd1-B740-0FFF70B200C5}.exeC:\Windows\{4B01FFC8-2D00-4bd1-B740-0FFF70B200C5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF79CCAD-7E11-4668-A882-910B64FF07CA}.exeC:\Windows\{AF79CCAD-7E11-4668-A882-910B64FF07CA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AADB9BBE-906F-48fb-8088-70DFE06D6115}.exeC:\Windows\{AADB9BBE-906F-48fb-8088-70DFE06D6115}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{925F5750-78A6-401b-890F-F80E041F2CD8}.exeC:\Windows\{925F5750-78A6-401b-890F-F80E041F2CD8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49C88972-D614-4ccd-A39A-E9EFEC682F96}.exeC:\Windows\{49C88972-D614-4ccd-A39A-E9EFEC682F96}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE7BBB38-F460-45a7-99A0-1B74766AE7C7}.exeC:\Windows\{EE7BBB38-F460-45a7-99A0-1B74766AE7C7}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6D00DF98-4890-4acc-835A-EE976E92E950}.exeC:\Windows\{6D00DF98-4890-4acc-835A-EE976E92E950}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE7BB~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49C88~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{925F5~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AADB9~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF79C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B01F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C663~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4320E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB6B7~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C5C5~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{3C6637DB-EA20-4860-A839-C98846A27524}.exe
{4320E48E-3AEE-46c7-8AB8-6ED341E54875}.exe
{49C88972-D614-4ccd-A39A-E9EFEC682F96}.exe
{4B01FFC8-2D00-4bd1-B740-0FFF70B200C5}.exe
{6C5C58E2-9ACA-4fe9-ADE3-DE4C8F1AD094}.exe
{6D00DF98-4890-4acc-835A-EE976E92E950}.exe
{925F5750-78A6-401b-890F-F80E041F2CD8}.exe
{AADB9BBE-906F-48fb-8088-70DFE06D6115}.exe
{AF79CCAD-7E11-4668-A882-910B64FF07CA}.exe
{BB6B7A62-2023-4a1d-A8DD-FEABECDD03D5}.exe
{EE7BBB38-F460-45a7-99A0-1B74766AE7C7}.exe
memory/8-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/8-23-0x0000000003C50000-0x0000000003CB3000-memory.dmp
memory/8-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/8-19-0x0000000003C50000-0x0000000003CB3000-memory.dmp
memory/1512-38-0x0000000002110000-0x0000000002173000-memory.dmp
memory/1512-34-0x0000000002110000-0x0000000002173000-memory.dmp
memory/1512-39-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2152-42-0x0000000002110000-0x0000000002173000-memory.dmp
memory/2152-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2152-45-0x0000000002110000-0x0000000002173000-memory.dmp
memory/2152-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2252-80-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2252-86-0x0000000003C60000-0x0000000003CC3000-memory.dmp
memory/2252-82-0x0000000003C60000-0x0000000003CC3000-memory.dmp
memory/2252-87-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2736-10-0x0000000003C70000-0x0000000003CD3000-memory.dmp
memory/2736-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2736-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2736-15-0x0000000003C70000-0x0000000003CD3000-memory.dmp
memory/2736-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2940-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2940-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2940-30-0x0000000003BA0000-0x0000000003C03000-memory.dmp
memory/2940-27-0x0000000003BA0000-0x0000000003C03000-memory.dmp
memory/3288-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3288-50-0x0000000003CB0000-0x0000000003D13000-memory.dmp
memory/3288-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3288-55-0x0000000003CB0000-0x0000000003D13000-memory.dmp
memory/3520-6-0x0000000002230000-0x0000000002293000-memory.dmp
memory/3520-1-0x0000000002230000-0x0000000002293000-memory.dmp
memory/3520-2-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3520-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3520-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3648-89-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4048-73-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4048-78-0x0000000003CC0000-0x0000000003D23000-memory.dmp
memory/4048-74-0x0000000003CC0000-0x0000000003D23000-memory.dmp
memory/4048-79-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4528-58-0x0000000003C70000-0x0000000003CD3000-memory.dmp
memory/4528-63-0x0000000003C70000-0x0000000003CD3000-memory.dmp
memory/4528-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4528-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5116-69-0x0000000002150000-0x00000000021B3000-memory.dmp
memory/5116-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5116-66-0x0000000002150000-0x00000000021B3000-memory.dmp
memory/5116-62-0x0000000000400000-0x0000000000410000-memory.dmp