Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 17:40
General
- Target 2026-04-20_279dfd15576fafc877ac2351b1b4fbee_elex_wannacry.exe
- Size 64KB
- Sample260420-v86flabs7m
- SHA256 5085984ba0d0692cbda969661a90a8e7b8c38e0841e8ffe7a6f1b491c87ca55e
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 34 IoCs
- Detects Windows executables referencing non-Windows User-Agents 34 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_279dfd15576fafc877ac2351b1b4fbee_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_279dfd15576fafc877ac2351b1b4fbee_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{594FD869-79CD-4643-952B-99E9BCD97FE2}.exeC:\Windows\{594FD869-79CD-4643-952B-99E9BCD97FE2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33B5FE72-62CA-4f7e-B5C1-79F9B7A67017}.exeC:\Windows\{33B5FE72-62CA-4f7e-B5C1-79F9B7A67017}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E64D5EAB-EDF3-4d51-AE2C-A733748F7845}.exeC:\Windows\{E64D5EAB-EDF3-4d51-AE2C-A733748F7845}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{88634A2B-F7C4-45ec-9645-31097F0CE9A4}.exeC:\Windows\{88634A2B-F7C4-45ec-9645-31097F0CE9A4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2258348F-C37D-47fe-B856-5EDD4182981B}.exeC:\Windows\{2258348F-C37D-47fe-B856-5EDD4182981B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E29A1EC-602D-4d35-B858-CB1BA3D8BF3C}.exeC:\Windows\{9E29A1EC-602D-4d35-B858-CB1BA3D8BF3C}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{851606BF-981A-4282-B618-94B12770B2F4}.exeC:\Windows\{851606BF-981A-4282-B618-94B12770B2F4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9F982DE-A206-4682-940E-666AADF1D807}.exeC:\Windows\{F9F982DE-A206-4682-940E-666AADF1D807}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0800DE8-317B-45f9-B68F-174BC836EDE6}.exeC:\Windows\{D0800DE8-317B-45f9-B68F-174BC836EDE6}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F8BDC07E-4279-4e67-B9FE-59B7B6F3B285}.exeC:\Windows\{F8BDC07E-4279-4e67-B9FE-59B7B6F3B285}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CEA26D0C-A31B-4633-9C54-1B58355B3D13}.exeC:\Windows\{CEA26D0C-A31B-4633-9C54-1B58355B3D13}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8BDC~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0800~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9F98~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85160~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E29A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22583~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88634~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E64D5~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33B5F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{594FD~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2258348F-C37D-47fe-B856-5EDD4182981B}.exe
{33B5FE72-62CA-4f7e-B5C1-79F9B7A67017}.exe
{594FD869-79CD-4643-952B-99E9BCD97FE2}.exe
{851606BF-981A-4282-B618-94B12770B2F4}.exe
{88634A2B-F7C4-45ec-9645-31097F0CE9A4}.exe
{9E29A1EC-602D-4d35-B858-CB1BA3D8BF3C}.exe
{CEA26D0C-A31B-4633-9C54-1B58355B3D13}.exe
{D0800DE8-317B-45f9-B68F-174BC836EDE6}.exe
{E64D5EAB-EDF3-4d51-AE2C-A733748F7845}.exe
{F8BDC07E-4279-4e67-B9FE-59B7B6F3B285}.exe
{F9F982DE-A206-4682-940E-666AADF1D807}.exe
memory/228-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/228-73-0x00000000008E0000-0x0000000000976000-memory.dmp
memory/228-72-0x0000000000400000-0x0000000000410000-memory.dmp
memory/228-76-0x00000000008E0000-0x0000000000976000-memory.dmp
memory/724-19-0x00000000008A0000-0x0000000000936000-memory.dmp
memory/724-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/724-22-0x00000000008A0000-0x0000000000936000-memory.dmp
memory/724-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/992-85-0x0000000000780000-0x0000000000816000-memory.dmp
memory/992-80-0x0000000000400000-0x0000000000410000-memory.dmp
memory/992-86-0x0000000000400000-0x0000000000410000-memory.dmp
memory/992-81-0x0000000000780000-0x0000000000816000-memory.dmp
memory/1168-32-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1168-31-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/1168-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1168-27-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/1636-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1636-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1636-14-0x0000000000750000-0x00000000007E6000-memory.dmp
memory/1636-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1636-10-0x0000000000750000-0x00000000007E6000-memory.dmp
memory/1768-87-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3500-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3500-61-0x00000000008A0000-0x0000000000936000-memory.dmp
memory/3500-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3500-57-0x00000000008A0000-0x0000000000936000-memory.dmp
memory/3904-39-0x0000000000650000-0x00000000006E6000-memory.dmp
memory/3904-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3904-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3904-35-0x0000000000650000-0x00000000006E6000-memory.dmp
memory/4772-1-0x0000000000900000-0x0000000000996000-memory.dmp
memory/4772-7-0x0000000000900000-0x0000000000996000-memory.dmp
memory/4772-2-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4772-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4772-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5320-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5320-42-0x00000000005A0000-0x0000000000636000-memory.dmp
memory/5320-46-0x00000000005A0000-0x0000000000636000-memory.dmp
memory/5468-49-0x0000000000720000-0x00000000007B6000-memory.dmp
memory/5468-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5468-53-0x0000000000720000-0x00000000007B6000-memory.dmp
memory/5808-68-0x0000000000750000-0x00000000007E6000-memory.dmp
memory/5808-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5808-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5808-65-0x0000000000750000-0x00000000007E6000-memory.dmp